github / github/vscode-github-actions

Respect the OS certificate store

Open
#39 18 comments 14 reactions 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
660
Forks
213
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
The "GitHub Actions language server" doesn't use Root certificates installed on Windows, so incompatible with an SSL-inspecting firewall.

Most other extensions in VSCode work just fine and are able to access HTTPS endpoints correctly. I presume they use a different API.

**To Reproduce**
1. Be in an enterprise environment with an SSL-inspecting/MITM firewall that uses certificates issued by an internal CA.
2. Open any workflow yml file
3. In the ouptuts:
```
Failure to retrieve username: Os [HttpError]: request to https://api.github.com/user failed, reason: self signed certificate in certificate chain
at c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2783247
at process.processTicksAndRejections (node:internal/process/task_queues:96:5)
at async c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2855206
at async fa.get (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2865045)
at async c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2855141
at async aa (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2855108)
at async c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2858843
at async Object.getContext (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2858799)
at async ni (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2732594)
at async ln (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2757296) {
status: 500,
request: {
method: 'GET',
url: 'https://api.github.com/user',
headers: {
accept: 'application/vnd.github.v3+json',
'user-agent': 'VS Code GitHub Actions (0.25.2) octokit-rest.js/19.0.7 octokit-core.js/4.1.0 Node.js/16.14.2 (win32; x64)',
authorization: 'token [REDACTED]'
},
request: { hook: [Function: bound bound e] }
}
}
```

**Expected behavior**
Certificates trusted by Windows are accepted.

**Extension Version**
`v0.25.2`

**Additional context**
I wonder if it's HSTS?

Contributor guide

Open the contributing guide

Research direction

Start with the HTTPS request to https://api.github.com/user shown in the server-node.js stack trace and reproduce it on Windows with a certificate issued by an internal CA. Trace how the extension handles that request and verify that certificates trusted by Windows are accepted without the self-signed-certificate error.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js, typescript, vscode
Domain
devtools, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.