René's URL Explorer Experiment


Title: Search for the CodeQL bundle in multiple places. by chrisgavin · Pull Request #123 · github/codeql-action · GitHub

Open Graph Title: Search for the CodeQL bundle in multiple places. by chrisgavin · Pull Request #123 · github/codeql-action

X Title: Search for the CodeQL bundle in multiple places. by chrisgavin · Pull Request #123 · github/codeql-action

Description: The aim of this change is to resolve a number of issues with where the CodeQL bundle is fetched from. In many cases it is either not possible or not desired to fetch the CodeQL bundle from the canonical location at https://github.com/github/codeql-action/releases/download/codeql-bundle-20200630/codeql-bundle.tar.gz. This might be because you are using the Action on a runner that does not have internet access. It may also be because you've copied the CodeQL Action repository to your own organization so that you can control what code is running on your runner machines. The general idea of this change was inspired by the way the Actions runner attempts to find an Action. We can apply a similar principle to finding the CodeQL bundle. This process works by looking for the CodeQL bundle in a place that's as local as possible and then working outwards. It checks if the bundle exists: On $our_github_instance at the repository name for the current Action. On $our_github_instance at github/codeql-action. On GitHub.com at github/codeql-action. It downloads the bundle from the first place it finds it. For symmetry I initially considered also checking GitHub.com at the repository name for the current Action, however I decided against that due to the accidental security risk someone might expose themselves to if they incorrectly mirror the Action without copying the bundle. To check whether the bundle exists in these locations we use the GitHub API. This is required because on GHES you must authenticate to access the API, even for accessing public projects. The one exception to this is when we're finally getting the bundle from the canonical location. In this case we do not use the API. This is because if we access the API from GHES we cannot authenticate with our token, meaning we have to make the request anonymously. You could easily run out of API rate limit making these anonymous requests. Because we know for sure the bundle exists in the canonical location we can safely download it directly rather than using the API. This change currently relies on two hacks to work around limitations in other parts of Actions. I've opened pull requests to solve these limitations but it's unclear when they might be reviewed. The two pull requests are: actions/runner#585 to avoid having to extract the current Action name from the file path at which it happens to be running. actions/toolkit#530 to allow providing headers directly to the downloadTool(...) method of the toolcache. Sorry for the excessive description. This change ended up being a bit more complicated than I expected and I wanted to make it clear why I made the design decision I have. Merge / deployment checklist Confirm this change is backwards compatible with existing workflows. Confirm the readme has been updated if necessary.

Open Graph Description: The aim of this change is to resolve a number of issues with where the CodeQL bundle is fetched from. In many cases it is either not possible or not desired to fetch the CodeQL bundle from the cano...

X Description: The aim of this change is to resolve a number of issues with where the CodeQL bundle is fetched from. In many cases it is either not possible or not desired to fetch the CodeQL bundle from the cano...

Opengraph URL: https://github.com/github/codeql-action/pull/123

X: @github

direct link

Domain: github.com

route-pattern/:user_id/:repository/pull/:id/files(.:format)
route-controllerpull_requests
route-actionfiles
fetch-noncev2:6faddab3-6aa6-f186-43c5-f973f09d06e9
current-catalog-service-hashae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b
request-idA4DE:364C95:7321A2:9D4EF0:6A552792
html-safe-nonced1beea0b4660789e91ed09932dfd7fe78224b24cbeaa8ba7b515cda168f1e057
visitor-payloadeyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJBNERFOjM2NEM5NTo3MzIxQTI6OUQ0RUYwOjZBNTUyNzkyIiwidmlzaXRvcl9pZCI6Ijc3NjE3ODI0MDk5NzMyNzg2MTEiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ==
visitor-hmac108e94c7bbb380dd474e0cbfd5136f9760d70b3f2dd23be6ef91cddab08e6977
hovercard-subject-tagpull_request:456269466
github-keyboard-shortcutsrepository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot
google-site-verificationApib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
octolytics-urlhttps://collector.github.com/github/collect
analytics-location///pull_requests/show/files
fb:app_id1401488693436528
apple-itunes-appapp-id=1477376905, app-argument=https://github.com/github/codeql-action/pull/123/files
twitter:imagehttps://avatars.githubusercontent.com/u/5584439?s=400&v=4
twitter:cardsummary_large_image
og:imagehttps://avatars.githubusercontent.com/u/5584439?s=400&v=4
og:image:altThe aim of this change is to resolve a number of issues with where the CodeQL bundle is fetched from. In many cases it is either not possible or not desired to fetch the CodeQL bundle from the cano...
og:site_nameGitHub
og:typeobject
hostnamegithub.com
expected-hostnamegithub.com
None682d273eacb2ac51680c6eb9c0b270f029f7ce74c32090f319083c34497e28a5
turbo-cache-controlno-preview
diff-viewunified
go-importgithub.com/github/codeql-action git https://github.com/github/codeql-action.git
octolytics-dimension-user_id9919
octolytics-dimension-user_logingithub
octolytics-dimension-repository_id259445878
octolytics-dimension-repository_nwogithub/codeql-action
octolytics-dimension-repository_publictrue
octolytics-dimension-repository_is_forkfalse
octolytics-dimension-repository_network_root_id259445878
octolytics-dimension-repository_network_root_nwogithub/codeql-action
turbo-body-classeslogged-out env-production page-responsive full-width
disable-turbotrue
browser-stats-urlhttps://api.github.com/_private/browser/stats
browser-errors-urlhttps://api.github.com/_private/browser/errors
release358dd24ad7465d20e3fae729b5b169d35b0dd7f8
ui-targetfull
theme-color#1e2327
color-schemelight dark

Links:

Skip to contenthttps://github.com/github/codeql-action/pull/123/files#start-of-content
https://github.com/
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql-action%2Fpull%2F123%2Ffiles
GitHub CopilotWrite better code with AIhttps://github.com/features/copilot
GitHub Copilot appDirect agents from issue to mergehttps://github.com/features/ai/github-app
MCP RegistryNewIntegrate external toolshttps://github.com/mcp
ActionsAutomate any workflowhttps://github.com/features/actions
CodespacesInstant dev environmentshttps://github.com/features/codespaces
IssuesPlan and track workhttps://github.com/features/issues
Code ReviewManage code changeshttps://github.com/features/code-review
GitHub Advanced SecurityFind and fix vulnerabilitieshttps://github.com/security/advanced-security
Code securitySecure your code as you buildhttps://github.com/security/advanced-security/code-security
Secret protectionStop leaks before they starthttps://github.com/security/advanced-security/secret-protection
Why GitHubhttps://github.com/why-github
Documentationhttps://docs.github.com
Bloghttps://github.blog
Changeloghttps://github.blog/changelog
Marketplacehttps://github.com/marketplace
View all featureshttps://github.com/features
Enterpriseshttps://github.com/enterprise
Small and medium teamshttps://github.com/team
Startupshttps://github.com/enterprise/startups
Nonprofitshttps://github.com/solutions/industry/nonprofits
App Modernizationhttps://github.com/solutions/use-case/app-modernization
DevSecOpshttps://github.com/solutions/use-case/devsecops
DevOpshttps://github.com/solutions/use-case/devops
CI/CDhttps://github.com/solutions/use-case/ci-cd
View all use caseshttps://github.com/solutions/use-case
Healthcarehttps://github.com/solutions/industry/healthcare
Financial serviceshttps://github.com/solutions/industry/financial-services
Manufacturinghttps://github.com/solutions/industry/manufacturing
Governmenthttps://github.com/solutions/industry/government
View all industrieshttps://github.com/solutions/industry
View all solutionshttps://github.com/solutions
AIhttps://github.com/resources/articles?topic=ai
Software Developmenthttps://github.com/resources/articles?topic=software-development
DevOpshttps://github.com/resources/articles?topic=devops
Securityhttps://github.com/resources/articles?topic=security
View all topicshttps://github.com/resources/articles
Customer storieshttps://github.com/customer-stories
Events & webinarshttps://github.com/resources/events
Ebooks & reportshttps://github.com/resources/whitepapers
Business insightshttps://github.com/solutions/executive-insights
GitHub Skillshttps://skills.github.com
Documentationhttps://docs.github.com
Customer supporthttps://support.github.com
Community forumhttps://github.com/orgs/community/discussions
Trust centerhttps://github.com/trust-center
Partnershttps://github.com/partners
View all resourceshttps://github.com/resources
GitHub SponsorsFund open source developershttps://github.com/open-source/sponsors
Security Labhttps://securitylab.github.com
Maintainer Communityhttps://maintainers.github.com
Acceleratorhttps://github.com/open-source/accelerator
GitHub Starshttps://stars.github.com
Archive Programhttps://archiveprogram.github.com
Topicshttps://github.com/topics
Trendinghttps://github.com/trending
Collectionshttps://github.com/collections
Enterprise platformAI-powered developer platformhttps://github.com/enterprise
GitHub Advanced SecurityEnterprise-grade security featureshttps://github.com/security/advanced-security
Copilot for BusinessEnterprise-grade AI featureshttps://github.com/features/copilot/copilot-business
Premium SupportEnterprise-grade 24/7 supporthttps://github.com/enterprise/premium-support
Pricinghttps://github.com/pricing
Search syntax tipshttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
documentationhttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql-action%2Fpull%2F123%2Ffiles
Sign up https://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fpull_requests%2Fshow%2Ffiles&source=header-repo&source_repo=github%2Fcodeql-action
Reloadhttps://github.com/github/codeql-action/pull/123/files
Reloadhttps://github.com/github/codeql-action/pull/123/files
Reloadhttps://github.com/github/codeql-action/pull/123/files
Please reload this pagehttps://github.com/github/codeql-action/pull/123/files
github https://github.com/github
codeql-actionhttps://github.com/github/codeql-action
Notifications https://github.com/login?return_to=%2Fgithub%2Fcodeql-action
Fork 472 https://github.com/login?return_to=%2Fgithub%2Fcodeql-action
Star 1.6k https://github.com/login?return_to=%2Fgithub%2Fcodeql-action
Code https://github.com/github/codeql-action
Issues 156 https://github.com/github/codeql-action/issues
Pull requests 25 https://github.com/github/codeql-action/pulls
Actions https://github.com/github/codeql-action/actions
Models https://github.com/github/codeql-action/models
Security and quality 2 https://github.com/github/codeql-action/security
Insights https://github.com/github/codeql-action/pulse
Code https://github.com/github/codeql-action
Issues https://github.com/github/codeql-action/issues
Pull requests https://github.com/github/codeql-action/pulls
Actions https://github.com/github/codeql-action/actions
Models https://github.com/github/codeql-action/models
Security and quality https://github.com/github/codeql-action/security
Insights https://github.com/github/codeql-action/pulse
Sign up for GitHub https://github.com/signup?return_to=%2Fgithub%2Fcodeql-action%2Fissues%2Fnew%2Fchoose
terms of servicehttps://docs.github.com/terms
privacy statementhttps://docs.github.com/privacy
Sign inhttps://github.com/login?return_to=%2Fgithub%2Fcodeql-action%2Fissues%2Fnew%2Fchoose
chrisgavinhttps://github.com/chrisgavin
mainhttps://github.com/github/codeql-action/tree/main
search-for-bundlehttps://github.com/github/codeql-action/tree/search-for-bundle
Conversation 16 https://github.com/github/codeql-action/pull/123
Findings https://github.com/github/codeql-action/pull/123/findings
Commits 10 https://github.com/github/codeql-action/pull/123/commits
Checks 0 https://github.com/github/codeql-action/pull/123/checks
Files changed https://github.com/github/codeql-action/pull/123/files
Please reload this pagehttps://github.com/github/codeql-action/pull/123/files
Search for the CodeQL bundle in multiple places. https://github.com/github/codeql-action/pull/123/files#top
Show all changes 10 commits https://github.com/github/codeql-action/pull/123/files
813cb04 Search for the CodeQL bundle in multiple places. chrisgavin Jul 10, 2020 https://github.com/github/codeql-action/pull/123/commits/813cb0479fbbedd3ededa41c1c28209aa22353d8
337dbe5 Remove an unneeded check. chrisgavin Jul 27, 2020 https://github.com/github/codeql-action/pull/123/commits/337dbe561812417db3e7531e065dab0c4d4e0680
bfaa0cf Restructure code to remove an error that can never be thrown. chrisgavin Jul 27, 2020 https://github.com/github/codeql-action/pull/123/commits/bfaa0cf943bc3532a60d82cec28200681ccd3830
0f88c01 Change `INSTANCE_API_URL` constant to a method. chrisgavin Jul 27, 2020 https://github.com/github/codeql-action/pull/123/commits/0f88c0111fe3ae5d663a96637ebab35eb7d5307d
5f05731 Fix a typo. chrisgavin Jul 27, 2020 https://github.com/github/codeql-action/pull/123/commits/5f057318b6fac4f2a143d516f1a986a93892b3a7
f4e72f4 Add a comment explaining an edge-case. chrisgavin Jul 27, 2020 https://github.com/github/codeql-action/pull/123/commits/f4e72f4a09d769d17602543b20907ce3bf9038bb
175d681 Factor out reimplementation of toolcache download into its own method. chrisgavin Jul 27, 2020 https://github.com/github/codeql-action/pull/123/commits/175d6818356f0e39205934508f5dc24ae8946e2d
74b4d8a Remove `DEFAULT_` from some constant names. chrisgavin Jul 27, 2020 https://github.com/github/codeql-action/pull/123/commits/74b4d8a6db218da4e7160df958e493f7d685efbf
5587e12 Add a missing space. chrisgavin Jul 27, 2020 https://github.com/github/codeql-action/pull/123/commits/5587e128ff75c5ab3df15d9f04817e4f84228f68
f5ccce0 Merge branch 'main' into search-for-bundle chrisgavin Jul 30, 2020 https://github.com/github/codeql-action/pull/123/commits/f5ccce0c86071c15e105934678e5fca47c0013e9
Clear filters https://github.com/github/codeql-action/pull/123/files
Please reload this pagehttps://github.com/github/codeql-action/pull/123/files
Please reload this pagehttps://github.com/github/codeql-action/pull/123/files
action.yml https://github.com/github/codeql-action/pull/123/files#diff-fd71db664f07e928bfadb8476a94d8c04c0cb181d42073444aa140a3906d9cde
codeql.js https://github.com/github/codeql-action/pull/123/files#diff-5bd808ec74194675da6319beb80c228163039f26c9ddf1b8bf3eef9b12c9341b
codeql.js.map https://github.com/github/codeql-action/pull/123/files#diff-325a6cb428a1dafbcfbd43461aa4ae95826c648a3f9a7d7b6e6bf05878152d64
codeql.ts https://github.com/github/codeql-action/pull/123/files#diff-473ad8cf33ad034dc4f9ae468a3ce5d87106ace4f96f6a23a000261d46efaa60
https://github.com/github/codeql-action/blob/main/CODEOWNERS#L1
init/action.ymlhttps://github.com/github/codeql-action/pull/123/files#diff-fd71db664f07e928bfadb8476a94d8c04c0cb181d42073444aa140a3906d9cde
View file https://github.com/github/codeql-action/blob/f5ccce0c86071c15e105934678e5fca47c0013e9/init/action.yml
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql-action/pull/123/{{ revealButtonHref }}
https://github.com/github/codeql-action/pull/123/files#diff-fd71db664f07e928bfadb8476a94d8c04c0cb181d42073444aa140a3906d9cde
https://github.com/github/codeql-action/pull/123/files#diff-fd71db664f07e928bfadb8476a94d8c04c0cb181d42073444aa140a3906d9cde
https://github.com/github/codeql-action/blob/main/CODEOWNERS#L1
lib/codeql.jshttps://github.com/github/codeql-action/pull/123/files#diff-5bd808ec74194675da6319beb80c228163039f26c9ddf1b8bf3eef9b12c9341b
View file https://github.com/github/codeql-action/blob/f5ccce0c86071c15e105934678e5fca47c0013e9/lib/codeql.js
Open in desktop https://desktop.github.com
how customized files appear on GitHubhttps://docs.github.com/github/administering-a-repository/customizing-how-changed-files-appear-on-github
Please reload this pagehttps://github.com/github/codeql-action/pull/123/files
Please reload this pagehttps://github.com/github/codeql-action/pull/123/files
https://github.com
Termshttps://docs.github.com/site-policy/github-terms/github-terms-of-service
Privacyhttps://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Securityhttps://github.com/security
Statushttps://www.githubstatus.com/
Communityhttps://github.community/
Docshttps://docs.github.com/
Contacthttps://support.github.com?tags=dotcom-footer

Viewport: width=device-width

URLs of crawlers that visited me.