Merge pull request #1516 from aibaars/auth-parameter

Supply authorization parameter to toolcache.downloadTool()

CHANGELOG.md

@@ -1,5 +1,9 @@
 # CodeQL Action Changelog
 
+## [UNRELEASED]
+
+No user facing changes.
+
 ## 2.2.1 - 27 Jan 2023
 
 No user facing changes.

lib/setup-codeql.js

@@ -411,12 +411,13 @@ async function downloadCodeQL(codeqlURL, maybeCliVersion, apiDetails, variant, t
     // from the same GitHub instance the Action is running on.
     // This avoids leaking Enterprise tokens to dotcom.
     // We also don't want to send an authorization header if there's already a token provided in the URL.
+    let authorization = undefined;
     if (searchParams.has("token")) {
         logger.debug("CodeQL tools URL contains an authorization token.");
     }
     else if (codeqlURL.startsWith(`${apiDetails.url}/`)) {
         logger.debug("Providing an authorization token to download CodeQL tools.");
-        headers.authorization = `token ${apiDetails.auth}`;
+        authorization = `token ${apiDetails.auth}`;
     }
     else {
         logger.debug("Downloading CodeQL tools without an authorization token.");
@@ -425,7 +426,7 @@ async function downloadCodeQL(codeqlURL, maybeCliVersion, apiDetails, variant, t
     const dest = path.join(tempDir, (0, uuid_1.v4)());
     const finalHeaders = Object.assign({ "User-Agent": "CodeQL Action" }, headers);
     const toolsDownloadStart = perf_hooks_1.performance.now();
-    const codeqlPath = await toolcache.downloadTool(codeqlURL, dest, undefined, finalHeaders);
+    const codeqlPath = await toolcache.downloadTool(codeqlURL, dest, authorization, finalHeaders);
     const toolsDownloadDurationMs = Math.round(perf_hooks_1.performance.now() - toolsDownloadStart);
     logger.debug(`CodeQL bundle download to ${codeqlPath} complete.`);
     const codeqlExtracted = await toolcache.extractTar(codeqlPath);

node_modules/.package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "2.2.1",
+      "version": "2.2.2",
       "license": "MIT",
       "dependencies": {
         "@actions/artifact": "^1.1.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "private": true,
   "description": "CodeQL action",
   "scripts": {

src/setup-codeql.ts

@@ -543,11 +543,12 @@ export async function downloadCodeQL(
   // from the same GitHub instance the Action is running on.
   // This avoids leaking Enterprise tokens to dotcom.
   // We also don't want to send an authorization header if there's already a token provided in the URL.
+  let authorization: string | undefined = undefined;
   if (searchParams.has("token")) {
     logger.debug("CodeQL tools URL contains an authorization token.");
   } else if (codeqlURL.startsWith(`${apiDetails.url}/`)) {
     logger.debug("Providing an authorization token to download CodeQL tools.");
-    headers.authorization = `token ${apiDetails.auth}`;
+    authorization = `token ${apiDetails.auth}`;
   } else {
     logger.debug("Downloading CodeQL tools without an authorization token.");
   }
@@ -565,7 +566,7 @@ export async function downloadCodeQL(
   const codeqlPath = await toolcache.downloadTool(
     codeqlURL,
     dest,
-    undefined,
+    authorization,
     finalHeaders
   );
   const toolsDownloadDurationMs = Math.round(