github / github/vscode-github-actions
Respect the OS certificate store
- Dominant language
- TypeScript
- Stars
- 660
- Forks
- 213
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
The "GitHub Actions language server" doesn't use Root certificates installed on Windows, so incompatible with an SSL-inspecting firewall.
Most other extensions in VSCode work just fine and are able to access HTTPS endpoints correctly. I presume they use a different API.
**To Reproduce**
1. Be in an enterprise environment with an SSL-inspecting/MITM firewall that uses certificates issued by an internal CA.
2. Open any workflow yml file
3. In the ouptuts:
```
Failure to retrieve username: Os [HttpError]: request to https://api.github.com/user failed, reason: self signed certificate in certificate chain
at c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2783247
at process.processTicksAndRejections (node:internal/process/task_queues:96:5)
at async c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2855206
at async fa.get (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2865045)
at async c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2855141
at async aa (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2855108)
at async c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2858843
at async Object.getContext (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2858799)
at async ni (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2732594)
at async ln (c:\Users\***\.vscode\extensions\github.vscode-github-actions-0.25.2\dist\server-node.js:2:2757296) {
status: 500,
request: {
method: 'GET',
url: 'https://api.github.com/user',
headers: {
accept: 'application/vnd.github.v3+json',
'user-agent': 'VS Code GitHub Actions (0.25.2) octokit-rest.js/19.0.7 octokit-core.js/4.1.0 Node.js/16.14.2 (win32; x64)',
authorization: 'token [REDACTED]'
},
request: { hook: [Function: bound bound e] }
}
}
```
**Expected behavior**
Certificates trusted by Windows are accepted.
**Extension Version**
`v0.25.2`
**Additional context**
I wonder if it's HSTS?
Contributor guide
Research direction
Start with the HTTPS request to https://api.github.com/user shown in the server-node.js stack trace and reproduce it on Windows with a certificate issued by an internal CA. Trace how the extension handles that request and verify that certificates trusted by Windows are accepted without the self-signed-certificate error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, typescript, vscode
- Domain
- devtools, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100