Skip to content

Commit 9ea8840

Browse files
CopilotCopilot
authored
Enterprise: replace hardcoded github.com with GITHUB_SERVER_URL in safe output JS (#19621)
1 parent fada5ce commit 9ea8840

10 files changed

+109
-15
lines changed

‎.changeset/patch-enterprise-safe-output-url.md‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎actions/setup/js/autofix_code_scanning_alert.cjs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ async function main(config = {}) {
100100
headers: { "X-GitHub-Api-Version": "2022-11-28" },
101101
});
102102

103-
const autofixUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/security/code-scanning/${alertNumber}`;
103+
const autofixUrl = `${process.env.GITHUB_SERVER_URL || "https://github.com"}/${context.repo.owner}/${context.repo.repo}/security/code-scanning/${alertNumber}`;
104104
core.info(`✓ Successfully created autofix for code scanning alert ${alertNumber}: ${autofixUrl}`);
105105

106106
processedAutofixes.push({

‎actions/setup/js/check_workflow_timestamp_api.cjs‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ async function main() {
3131

3232
const { owner, repo } = context.repo;
3333
const ref = context.sha;
34+
const githubServerUrl = process.env.GITHUB_SERVER_URL || "https://github.com";
3435

3536
// Helper function to get the last commit for a file
3637
async function getLastCommitForFile(path) {
@@ -151,10 +152,10 @@ async function main() {
151152
.addRaw("**Files:**\n")
152153
.addRaw(`- Source: \`${workflowMdPath}\`\n`)
153154
.addRaw(` - Last commit: ${workflowTimestamp}\n`)
154-
.addRaw(` - Commit SHA: [\`${workflowCommit.sha.substring(0, 7)}\`](https://github.com/${owner}/${repo}/commit/${workflowCommit.sha})\n`)
155+
.addRaw(` - Commit SHA: [\`${workflowCommit.sha.substring(0, 7)}\`](${githubServerUrl}/${owner}/${repo}/commit/${workflowCommit.sha})\n`)
155156
.addRaw(`- Lock: \`${lockFilePath}\`\n`)
156157
.addRaw(` - Last commit: ${lockTimestamp}\n`)
157-
.addRaw(` - Commit SHA: [\`${lockCommit.sha.substring(0, 7)}\`](https://github.com/${owner}/${repo}/commit/${lockCommit.sha})\n\n`)
158+
.addRaw(` - Commit SHA: [\`${lockCommit.sha.substring(0, 7)}\`](${githubServerUrl}/${owner}/${repo}/commit/${lockCommit.sha})\n\n`)
158159
.addRaw("**Action Required:** Run `gh aw compile` to regenerate the lock file.\n\n");
159160

160161
await summary.write();
@@ -179,11 +180,11 @@ async function main() {
179180
.addRaw("**Files:**\n")
180181
.addRaw(`- Source: \`${workflowMdPath}\`\n`)
181182
.addRaw(` - Last commit: ${workflowTimestamp}\n`)
182-
.addRaw(` - Commit SHA: [\`${workflowCommit.sha.substring(0, 7)}\`](https://github.com/${owner}/${repo}/commit/${workflowCommit.sha})\n`)
183+
.addRaw(` - Commit SHA: [\`${workflowCommit.sha.substring(0, 7)}\`](${githubServerUrl}/${owner}/${repo}/commit/${workflowCommit.sha})\n`)
183184
.addRaw(` - Frontmatter hash: \`${hashComparison.recomputedHash.substring(0, 12)}...\`\n`)
184185
.addRaw(`- Lock: \`${lockFilePath}\`\n`)
185186
.addRaw(` - Last commit: ${lockTimestamp}\n`)
186-
.addRaw(` - Commit SHA: [\`${lockCommit.sha.substring(0, 7)}\`](https://github.com/${owner}/${repo}/commit/${lockCommit.sha})\n`)
187+
.addRaw(` - Commit SHA: [\`${lockCommit.sha.substring(0, 7)}\`](${githubServerUrl}/${owner}/${repo}/commit/${lockCommit.sha})\n`)
187188
.addRaw(` - Stored hash: \`${hashComparison.storedHash.substring(0, 12)}...\`\n\n`)
188189
.addRaw("**Action Required:** Run `gh aw compile` to regenerate the lock file.\n\n");
189190

@@ -223,11 +224,11 @@ async function main() {
223224
.addRaw("**Files:**\n")
224225
.addRaw(`- Source: \`${workflowMdPath}\`\n`)
225226
.addRaw(` - Last commit: ${workflowTimestamp}\n`)
226-
.addRaw(` - Commit SHA: [\`${workflowCommit.sha.substring(0, 7)}\`](https://github.com/${owner}/${repo}/commit/${workflowCommit.sha})\n`)
227+
.addRaw(` - Commit SHA: [\`${workflowCommit.sha.substring(0, 7)}\`](${githubServerUrl}/${owner}/${repo}/commit/${workflowCommit.sha})\n`)
227228
.addRaw(` - Frontmatter hash: \`${hashComparison.recomputedHash.substring(0, 12)}...\`\n`)
228229
.addRaw(`- Lock: \`${lockFilePath}\`\n`)
229230
.addRaw(` - Last commit: ${lockTimestamp}\n`)
230-
.addRaw(` - Commit SHA: [\`${lockCommit.sha.substring(0, 7)}\`](https://github.com/${owner}/${repo}/commit/${lockCommit.sha})\n`)
231+
.addRaw(` - Commit SHA: [\`${lockCommit.sha.substring(0, 7)}\`](${githubServerUrl}/${owner}/${repo}/commit/${lockCommit.sha})\n`)
231232
.addRaw(` - Stored hash: \`${hashComparison.storedHash.substring(0, 12)}...\`\n\n`)
232233
.addRaw("**Action Required:** Run `gh aw compile` to regenerate the lock file.\n\n");
233234

‎actions/setup/js/create_project.cjs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -375,7 +375,7 @@ async function main(config = {}, githubClient = null) {
375375

376376
if (resolved && resolved.repo && resolved.number) {
377377
// Build the proper GitHub issue URL
378-
const resolvedUrl = `https://github.com/${resolved.repo}/issues/${resolved.number}`;
378+
const resolvedUrl = `${process.env.GITHUB_SERVER_URL || "https://github.com"}/${resolved.repo}/issues/${resolved.number}`;
379379
core.info(`Resolved temporary ID ${tempIdStr} in item_url to ${resolvedUrl}`);
380380
item_url = resolvedUrl;
381381
} else {

‎actions/setup/js/extra_empty_commit.cjs‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,9 @@ async function pushExtraEmptyCommit({ branchName, repoOwner, repoName, commitMes
127127
core.info(`Cycle check passed: ${emptyCommitCount} empty commit(s) in last ${COMMITS_TO_CHECK} (limit: ${MAX_EMPTY_COMMITS})`);
128128

129129
// Configure git remote with the token for authentication
130-
const remoteUrl = `https://x-access-token:${token}@github.com/${repoOwner}/${repoName}.git`;
130+
const githubServerUrl = process.env.GITHUB_SERVER_URL || "https://github.com";
131+
const serverHostStripped = githubServerUrl.replace(/^https?:\/\//, "");
132+
const remoteUrl = `https://x-access-token:${token}@${serverHostStripped}/${repoOwner}/${repoName}.git`;
131133

132134
// Add a temporary remote with the token
133135
try {

‎actions/setup/js/extra_empty_commit.test.cjs‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,12 @@ describe("extra_empty_commit.cjs", () => {
66
let pushExtraEmptyCommit;
77
let originalEnv;
88
let originalGithubRepo;
9+
let originalGithubServerUrl;
910

1011
beforeEach(() => {
1112
originalEnv = process.env.GH_AW_CI_TRIGGER_TOKEN;
1213
originalGithubRepo = process.env.GITHUB_REPOSITORY;
14+
originalGithubServerUrl = process.env.GITHUB_SERVER_URL;
1315
// Set GITHUB_REPOSITORY to match the default test owner/repo so the
1416
// cross-repo guard doesn't interfere with unrelated tests.
1517
process.env.GITHUB_REPOSITORY = "test-owner/test-repo";
@@ -44,6 +46,11 @@ describe("extra_empty_commit.cjs", () => {
4446
} else {
4547
delete process.env.GITHUB_REPOSITORY;
4648
}
49+
if (originalGithubServerUrl !== undefined) {
50+
process.env.GITHUB_SERVER_URL = originalGithubServerUrl;
51+
} else {
52+
delete process.env.GITHUB_SERVER_URL;
53+
}
4754
delete global.core;
4855
delete global.exec;
4956
vi.clearAllMocks();
@@ -154,6 +161,39 @@ describe("extra_empty_commit.cjs", () => {
154161
expect(removeRemoteCalls.length).toBeGreaterThanOrEqual(1);
155162
});
156163

164+
it("should use github.com by default when GITHUB_SERVER_URL is not set", async () => {
165+
delete process.env.GITHUB_SERVER_URL;
166+
delete require.cache[require.resolve("./extra_empty_commit.cjs")];
167+
({ pushExtraEmptyCommit } = require("./extra_empty_commit.cjs"));
168+
169+
await pushExtraEmptyCommit({
170+
branchName: "feature-branch",
171+
repoOwner: "test-owner",
172+
repoName: "test-repo",
173+
});
174+
175+
const addRemote = mockExec.exec.mock.calls.find(c => c[0] === "git" && c[1] && c[1][0] === "remote" && c[1][1] === "add");
176+
expect(addRemote).toBeDefined();
177+
expect(addRemote[1][3]).toContain("github.com/test-owner/test-repo.git");
178+
});
179+
180+
it("should use GITHUB_SERVER_URL hostname for GitHub Enterprise", async () => {
181+
process.env.GITHUB_SERVER_URL = "https://github.example.com";
182+
delete require.cache[require.resolve("./extra_empty_commit.cjs")];
183+
({ pushExtraEmptyCommit } = require("./extra_empty_commit.cjs"));
184+
185+
await pushExtraEmptyCommit({
186+
branchName: "feature-branch",
187+
repoOwner: "test-owner",
188+
repoName: "test-repo",
189+
});
190+
191+
const addRemote = mockExec.exec.mock.calls.find(c => c[0] === "git" && c[1] && c[1][0] === "remote" && c[1][1] === "add");
192+
expect(addRemote).toBeDefined();
193+
expect(addRemote[1][3]).toContain("github.example.com/test-owner/test-repo.git");
194+
expect(addRemote[1][3]).not.toContain("github.com/test-owner/test-repo.git");
195+
});
196+
157197
it("should use default commit message when none provided", async () => {
158198
await pushExtraEmptyCommit({
159199
branchName: "feature-branch",

‎actions/setup/js/merge_remote_agent_github_folder.cjs‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,8 @@ function sparseCheckoutGithubFolder(owner, repo, ref, tempDir) {
184184
validateGitParameter(repo, "repo");
185185
validateGitParameter(ref, "ref");
186186

187-
const repoUrl = `https://github.com/${owner}/${repo}.git`;
187+
const serverUrl = process.env.GITHUB_SERVER_URL || "https://github.com";
188+
const repoUrl = `${serverUrl}/${owner}/${repo}.git`;
188189

189190
try {
190191
// Initialize git repository

‎actions/setup/js/safe_outputs_handlers.cjs‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,18 @@ function createHandlers(server, appendSafeOutput, config = {}) {
160160

161161
const githubServer = process.env.GITHUB_SERVER_URL || "https://github.com";
162162
const repo = process.env.GITHUB_REPOSITORY || "owner/repo";
163-
const url = `${githubServer.replace("github.com", "raw.githubusercontent.com")}/${repo}/${normalizedBranchName}/${targetFileName}`;
163+
let url;
164+
try {
165+
const serverHostname = new URL(githubServer).hostname;
166+
if (serverHostname === "github.com") {
167+
url = `https://raw.githubusercontent.com/${repo}/${normalizedBranchName}/${targetFileName}`;
168+
} else {
169+
// GitHub Enterprise Server - raw content is served from the same host with /raw/ path
170+
url = `${githubServer}/${repo}/raw/${normalizedBranchName}/${targetFileName}`;
171+
}
172+
} catch {
173+
url = `${githubServer}/${repo}/raw/${normalizedBranchName}/${targetFileName}`;
174+
}
164175

165176
// Create entry for safe outputs
166177
const entry = {

‎actions/setup/js/safe_outputs_handlers.test.cjs‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,38 @@ describe("safe_outputs_handlers", () => {
138138
});
139139

140140
describe("uploadAssetHandler", () => {
141+
it("should generate raw.githubusercontent.com URL for github.com", () => {
142+
process.env.GH_AW_ASSETS_BRANCH = "test-branch";
143+
process.env.GITHUB_SERVER_URL = "https://github.com";
144+
process.env.GITHUB_REPOSITORY = "myorg/myrepo";
145+
146+
const testFile = path.join(testWorkspaceDir, "test.png");
147+
fs.writeFileSync(testFile, "test content");
148+
149+
handlers.uploadAssetHandler({ path: testFile });
150+
151+
const entry = mockAppendSafeOutput.mock.calls[0][0];
152+
expect(entry.url).toContain("raw.githubusercontent.com");
153+
expect(entry.url).toContain("myorg/myrepo");
154+
});
155+
156+
it("should generate enterprise URL for GitHub Enterprise Server", () => {
157+
process.env.GH_AW_ASSETS_BRANCH = "test-branch";
158+
process.env.GITHUB_SERVER_URL = "https://github.example.com";
159+
process.env.GITHUB_REPOSITORY = "myorg/myrepo";
160+
161+
const testFile = path.join(testWorkspaceDir, "test2.png");
162+
fs.writeFileSync(testFile, "test content");
163+
164+
handlers = createHandlers(mockServer, mockAppendSafeOutput);
165+
handlers.uploadAssetHandler({ path: testFile });
166+
167+
const entry = mockAppendSafeOutput.mock.calls[0][0];
168+
expect(entry.url).toContain("github.example.com");
169+
expect(entry.url).toContain("/raw/");
170+
expect(entry.url).not.toContain("raw.githubusercontent.com");
171+
});
172+
141173
it("should validate and process valid asset upload", () => {
142174
process.env.GH_AW_ASSETS_BRANCH = "test-branch";
143175

‎actions/setup/js/validate_secrets.cjs‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,8 @@ async function testGitHubRESTAPI(token, owner, repo) {
9797
}
9898

9999
try {
100-
const result = await makeRequest("api.github.com", `/repos/${owner}/${repo}`, {
100+
const apiUrl = new URL(process.env.GITHUB_API_URL || "https://api.github.com");
101+
const result = await makeRequest(apiUrl.hostname, `${apiUrl.pathname.replace(/\/$/, "")}/repos/${owner}/${repo}`, {
101102
"User-Agent": "gh-aw-secret-validation",
102103
Authorization: `Bearer ${token}`,
103104
Accept: "application/vnd.github+json",
@@ -159,9 +160,10 @@ async function testGitHubGraphQLAPI(token, owner, repo) {
159160
try {
160161
const result = await new Promise((resolve, reject) => {
161162
const postData = JSON.stringify({ query });
163+
const graphqlUrl = new URL(process.env.GITHUB_GRAPHQL_URL || "https://api.github.com/graphql");
162164
const options = {
163-
hostname: "api.github.com",
164-
path: "/graphql",
165+
hostname: graphqlUrl.hostname,
166+
path: graphqlUrl.pathname,
165167
method: "POST",
166168
headers: {
167169
"User-Agent": "gh-aw-secret-validation",
@@ -564,7 +566,7 @@ function generateMarkdownReport(results) {
564566
report += `> - [\`${secret}\`](${docsLink})\n`;
565567
});
566568
report += `>\n`;
567-
report += `> Configure these secrets in [repository settings](https://github.com/${repository}/settings/secrets/actions) if needed.\n\n`;
569+
report += `> Configure these secrets in [repository settings](${process.env.GITHUB_SERVER_URL || "https://github.com"}/${repository}/settings/secrets/actions) if needed.\n\n`;
568570
}
569571
}
570572

0 commit comments

Comments
 (0)