René's URL Explorer Experiment

Title: C#: Automatically use configured private registry feeds by mbg · Pull Request #18850 · github/codeql · GitHub

Open Graph Title: C#: Automatically use configured private registry feeds by mbg · Pull Request #18850 · github/codeql

X Title: C#: Automatically use configured private registry feeds by mbg · Pull Request #18850 · github/codeql

Description: When private package registries are configured for Default Setup, we initialise the Dependabot proxy to provide an authenticated proxy for those registries. As of #18029, the C# extractor is able to make use of the authenticated Dependabot proxy to connect to those private package registries. However, in some scenarios, the address of the private package registries is not actually stored in the nuget.config files for a project. Since we only restore dependencies from feeds that are configured in nuget.config files, we are unable to restore dependencies from private registries in this case. Ordinary CI workflows for such projects rely on injecting the feed addresses into the configuration. This PR modifies the NugetPackageRestorer to "inject" any private package registry feeds that are configured through the UI into the package restore process by passing them to dotnet on the command-line. This allows private package registries to be used without needing the address to be stored in the repository. The CodeQL Action that initialises the Dependabot proxy provides the private registry feed URLs as an output as of github/codeql-action#2652 (and annotates them with their type as of github/codeql-action#2672). A future version of the Default Setup workflow will propagate that output to the analyze step / CodeQL extractors. Approach The approach I chose for this implementation is to detect when the CODEQL_PROXY_URLS environment is set, extract nuget feeds from the JSON array that is expected to be stored in it, and then pass those feed URLs, along with others that we discovered in the nuget.config files, to dotnet on the command-line. Using the command-line has the advantage that we do not need to modify (and later clean-up) configuration files on disk, but the disadvantage that dotnet will only use feeds given to it on the command-line and ignore those in configuration files entirely. This means that we must provide all feeds that we want to use on the command-line. To minimise the risk of breaking what was already working before, nuget feeds are only passed to dotnet on the command-line when the Dependabot proxy is configured (i.e. when private package registries are being used). If not, then the old behaviour of implicitly using nuget.config files continues to be used.

Open Graph Description: When private package registries are configured for Default Setup, we initialise the Dependabot proxy to provide an authenticated proxy for those registries. As of #18029, the C# extractor is able ...

X Description: When private package registries are configured for Default Setup, we initialise the Dependabot proxy to provide an authenticated proxy for those registries. As of #18029, the C# extractor is able ...

Opengraph URL: https://github.com/github/codeql/pull/18850

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width