Also look for the CodeQL bundle at the custom GitHub AE endpoint.

github · Feb 15, 2021 · f8c5dac · f8c5dac
1 parent 781e3bc
commit f8c5dac
Showing 27 changed files with 2,159 additions and 3 deletions.
diff --git a/lib/codeql.js b/lib/codeql.js
diff --git a/lib/codeql.js.map b/lib/codeql.js.map
diff --git a/node_modules/decode-uri-component/index.js b/node_modules/decode-uri-component/index.js
diff --git a/node_modules/decode-uri-component/license b/node_modules/decode-uri-component/license
diff --git a/node_modules/decode-uri-component/package.json b/node_modules/decode-uri-component/package.json
diff --git a/node_modules/decode-uri-component/readme.md b/node_modules/decode-uri-component/readme.md
diff --git a/node_modules/filter-obj/index.js b/node_modules/filter-obj/index.js
diff --git a/node_modules/filter-obj/license b/node_modules/filter-obj/license
diff --git a/node_modules/filter-obj/package.json b/node_modules/filter-obj/package.json
diff --git a/node_modules/filter-obj/readme.md b/node_modules/filter-obj/readme.md
diff --git a/node_modules/query-string/index.d.ts b/node_modules/query-string/index.d.ts
diff --git a/node_modules/query-string/index.js b/node_modules/query-string/index.js
diff --git a/node_modules/query-string/license b/node_modules/query-string/license
diff --git a/node_modules/query-string/package.json b/node_modules/query-string/package.json
diff --git a/node_modules/query-string/readme.md b/node_modules/query-string/readme.md
diff --git a/node_modules/split-on-first/index.d.ts b/node_modules/split-on-first/index.d.ts
diff --git a/node_modules/split-on-first/index.js b/node_modules/split-on-first/index.js
diff --git a/node_modules/split-on-first/license b/node_modules/split-on-first/license
diff --git a/node_modules/split-on-first/package.json b/node_modules/split-on-first/package.json
diff --git a/node_modules/split-on-first/readme.md b/node_modules/split-on-first/readme.md
diff --git a/node_modules/strict-uri-encode/index.js b/node_modules/strict-uri-encode/index.js
diff --git a/node_modules/strict-uri-encode/license b/node_modules/strict-uri-encode/license
diff --git a/node_modules/strict-uri-encode/package.json b/node_modules/strict-uri-encode/package.json
diff --git a/node_modules/strict-uri-encode/readme.md b/node_modules/strict-uri-encode/readme.md
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -37,6 +37,7 @@
     "long": "^4.0.0",
     "md5": "^2.2.1",
     "path": "^0.12.7",
+    "query-string": "^6.14.0",
     "semver": "^7.3.2",
     "uuid": "^8.3.0",
     "zlib": "^1.0.5"

diff --git a/src/codeql.ts b/src/codeql.ts
@@ -8,6 +8,7 @@ import * as http from "@actions/http-client";
 import { IHeaders } from "@actions/http-client/interfaces";
 import * as toolcache from "@actions/tool-cache";
 import { default as deepEqual } from "fast-deep-equal";
+import { default as queryString } from "query-string";
 import * as semver from "semver";
 import { v4 as uuidV4 } from "uuid";
 
@@ -212,6 +213,31 @@ async function getCodeQLBundleDownloadURL(
       );
     }
   }
+  try {
+    const release = await api
+      .getApiClient(apiDetails)
+      .request("GET /enterprise/code-scanning/codeql-bundle/find/{tag}", {
+        tag: CODEQL_BUNDLE_VERSION,
+      });
+    const assetID = release.data.assets[codeQLBundleName];
+    if (assetID !== undefined) {
+      const download = await api
+        .getApiClient(apiDetails)
+        .request(
+          "GET /enterprise/code-scanning/codeql-bundle/download/{asset_id}",
+          { asset_id: assetID }
+        );
+      const downloadURL = download.data.url;
+      logger.info(
+        `Found CodeQL bundle at GitHub AE endpoint with URL ${downloadURL}.`
+      );
+      return downloadURL;
+    }
+  } catch (e) {
+    logger.info(
+      `Attempted to fetch bundle from GitHub AE endpoint but got error ${e}.`
+    );
+  }
   return `https://github.com/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${CODEQL_BUNDLE_VERSION}/${codeQLBundleName}`;
 }
 
@@ -291,11 +317,17 @@ export async function setupCodeQL(
         codeqlURL = await getCodeQLBundleDownloadURL(apiDetails, mode, logger);
       }
 
+      const parsedCodeQLURL = new URL(codeqlURL);
+      const parsedQueryString = queryString.parse(parsedCodeQLURL.search);
       const headers: IHeaders = { accept: "application/octet-stream" };
       // We only want to provide an authorization header if we are downloading
       // from the same GitHub instance the Action is running on.
       // This avoids leaking Enterprise tokens to dotcom.
-      if (codeqlURL.startsWith(`${apiDetails.url}/`)) {
+      // We also don't want to send an authorization header if there's already a token provided in the URL.
+      if (
+        codeqlURL.startsWith(`${apiDetails.url}/`) &&
+        parsedQueryString["token"] === undefined
+      ) {
         logger.debug("Downloading CodeQL bundle with token.");
         headers.authorization = `token ${apiDetails.auth}`;
       } else {