support http proxy for artifact upload

Add specific messages for network-specific node error codes

packages/artifact/__tests__/artifact-http-client.test.ts

@@ -7,6 +7,12 @@ import {noopLogs} from './common'
 
 jest.mock('@actions/http-client')
 
+const clientOptions = {
+  maxAttempts: 5,
+  retryIntervalMs: 1,
+  retryMultiplier: 1.5
+}
+
 describe('artifact-http-client', () => {
   beforeAll(() => {
     noopLogs()
@@ -94,11 +100,7 @@ describe('artifact-http-client', () => {
       }
     })
 
-    const client = internalArtifactTwirpClient({
-      maxAttempts: 5,
-      retryIntervalMs: 1,
-      retryMultiplier: 1.5
-    })
+    const client = internalArtifactTwirpClient(clientOptions)
     const artifact = await client.CreateArtifact({
       workflowRunBackendId: '1234',
       workflowJobRunBackendId: '5678',
@@ -133,11 +135,7 @@ describe('artifact-http-client', () => {
         post: mockPost
       }
     })
-    const client = internalArtifactTwirpClient({
-      maxAttempts: 5,
-      retryIntervalMs: 1,
-      retryMultiplier: 1.5
-    })
+    const client = internalArtifactTwirpClient(clientOptions)
     await expect(async () => {
       await client.CreateArtifact({
         workflowRunBackendId: '1234',
@@ -172,11 +170,7 @@ describe('artifact-http-client', () => {
         post: mockPost
       }
     })
-    const client = internalArtifactTwirpClient({
-      maxAttempts: 5,
-      retryIntervalMs: 1,
-      retryMultiplier: 1.5
-    })
+    const client = internalArtifactTwirpClient(clientOptions)
     await expect(async () => {
       await client.CreateArtifact({
         workflowRunBackendId: '1234',
@@ -214,11 +208,7 @@ describe('artifact-http-client', () => {
         post: mockPost
       }
     })
-    const client = internalArtifactTwirpClient({
-      maxAttempts: 5,
-      retryIntervalMs: 1,
-      retryMultiplier: 1.5
-    })
+    const client = internalArtifactTwirpClient(clientOptions)
     await expect(async () => {
       await client.CreateArtifact({
         workflowRunBackendId: '1234',
@@ -238,4 +228,39 @@ describe('artifact-http-client', () => {
     expect(mockHttpClient).toHaveBeenCalledTimes(1)
     expect(mockPost).toHaveBeenCalledTimes(1)
   })
+
+  it('should properly describe a network failure', async () => {
+    class FakeNodeError extends Error {
+      code: string
+      constructor(code: string) {
+        super()
+        this.code = code
+      }
+    }
+
+    const mockPost = jest.fn(() => {
+      throw new FakeNodeError('ENOTFOUND')
+    })
+
+    const mockHttpClient = (
+      HttpClient as unknown as jest.Mock
+    ).mockImplementation(() => {
+      return {
+        post: mockPost
+      }
+    })
+    const client = internalArtifactTwirpClient()
+    await expect(async () => {
+      await client.CreateArtifact({
+        workflowRunBackendId: '1234',
+        workflowJobRunBackendId: '5678',
+        name: 'artifact',
+        version: 4
+      })
+    }).rejects.toThrowError(
+      'Failed to CreateArtifact: Unable to make request: ENOTFOUND\nIf you are using self-hosted runners, please make sure your runner has access to all GitHub endpoints: https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#communication-between-self-hosted-runners-and-github'
+    )
+    expect(mockHttpClient).toHaveBeenCalledTimes(1)
+    expect(mockPost).toHaveBeenCalledTimes(1)
+  })
 })

packages/artifact/__tests__/upload-artifact.test.ts

@@ -352,3 +352,46 @@ describe('upload-artifact', () => {
     expect(uploadResp).rejects.toThrow()
   })
 })
+
+describe('getBlobClientOptions', () => {
+  afterEach(() => {
+    delete process.env['HTTPS_PROXY']
+    delete process.env['HTTP_PROXY']
+    delete process.env['NO_PROXY']
+    jest.restoreAllMocks()
+  })
+
+  it('should not use proxy settings if not specified', () => {
+    const opts = blobUpload.getBlobClientOptions('https://blob-storage.local')
+    expect(opts.proxyOptions).toBeUndefined()
+  })
+
+  it('should use https proxy settings from environment', () => {
+    process.env['HTTPS_PROXY'] = 'https://foo:bar@my-proxy.local'
+    const opts = blobUpload.getBlobClientOptions('https://blob-storage.local')
+    expect(opts.proxyOptions).toEqual({
+      host: 'my-proxy.local',
+      port: 443,
+      username: 'foo',
+      password: 'bar'
+    })
+  })
+
+  it('should use http proxy settings from environment', () => {
+    process.env['HTTP_PROXY'] = 'http://foo:bar@my-proxy.local:1234'
+    const opts = blobUpload.getBlobClientOptions('http://blob-storage.local')
+    expect(opts.proxyOptions).toEqual({
+      host: 'my-proxy.local',
+      port: 1234,
+      username: 'foo',
+      password: 'bar'
+    })
+  })
+
+  it('should respect NO_PROXY', () => {
+    process.env['HTTPS_PROXY'] = 'https://foo:bar@my-proxy.local'
+    process.env['NO_PROXY'] = 'no-proxy-me.local'
+    const opts = blobUpload.getBlobClientOptions('https://no-proxy-me.local')
+    expect(opts.proxyOptions).toBeUndefined()
+  })
+})

packages/artifact/src/internal/shared/artifact-twirp-client.ts

@@ -4,6 +4,7 @@ import {info, debug} from '@actions/core'
 import {ArtifactServiceClientJSON} from '../../generated'
 import {getResultsServiceUrl, getRuntimeToken} from './config'
 import {getUserAgentString} from './user-agent'
+import {NetworkError} from './errors'
 
 // The twirp http client must implement this interface
 interface Rpc {
@@ -96,6 +97,9 @@ class ArtifactHttpClient implements Rpc {
       } catch (error) {
         isRetryable = true
         errorMessage = error.message
+        if (NetworkError.isNetworkErrorCode(error?.code)) {
+          throw new NetworkError(error?.code)
+        }
       }
 
       if (!isRetryable) {

packages/artifact/src/internal/shared/errors.ts

@@ -35,3 +35,25 @@ export class GHESNotSupportedError extends Error {
     this.name = 'GHESNotSupportedError'
   }
 }
+
+export class NetworkError extends Error {
+  code: string
+
+  constructor(code: string) {
+    const message = `Unable to make request: ${code}\nIf you are using self-hosted runners, please make sure your runner has access to all GitHub endpoints: https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#communication-between-self-hosted-runners-and-github`
+    super(message)
+    this.code = code
+    this.name = 'NetworkError'
+  }
+
+  static isNetworkErrorCode = (code?: string): boolean => {
+    if (!code) return false
+    return [
+      'ECONNRESET',
+      'ENOTFOUND',
+      'ETIMEDOUT',
+      'ECONNREFUSED',
+      'EHOSTUNREACH'
+    ].includes(code)
+  }
+}

packages/artifact/src/internal/upload/blob-upload.ts

@@ -1,10 +1,18 @@
-import {BlobClient, BlockBlobUploadStreamOptions} from '@azure/storage-blob'
+import {
+  AnonymousCredential,
+  BlobClient,
+  BlockBlobUploadStreamOptions,
+  StoragePipelineOptions
+} from '@azure/storage-blob'
 import {TransferProgressEvent} from '@azure/core-http'
 import {ZipUploadStream} from './zip'
 import {getUploadChunkSize, getConcurrency} from '../shared/config'
+import {getProxyUrl} from '@actions/http-client'
 import * as core from '@actions/core'
 import * as crypto from 'crypto'
 import * as stream from 'stream'
+import {NetworkError} from '../shared/errors'
+import {getUserAgentString} from '../shared/user-agent'
 
 export interface BlobUploadResponse {
   /**
@@ -26,7 +34,12 @@ export async function uploadZipToBlobStorage(
 
   const maxConcurrency = getConcurrency()
   const bufferSize = getUploadChunkSize()
-  const blobClient = new BlobClient(authenticatedUploadURL)
+
+  const blobClient = new BlobClient(
+    authenticatedUploadURL,
+    new AnonymousCredential(),
+    getBlobClientOptions(authenticatedUploadURL)
+  )
   const blockBlobClient = blobClient.getBlockBlobClient()
 
   core.debug(
@@ -52,12 +65,20 @@ export async function uploadZipToBlobStorage(
 
   core.info('Beginning upload of artifact content to blob storage')
 
-  await blockBlobClient.uploadStream(
-    uploadStream,
-    bufferSize,
-    maxConcurrency,
-    options
-  )
+  try {
+    await blockBlobClient.uploadStream(
+      uploadStream,
+      bufferSize,
+      maxConcurrency,
+      options
+    )
+  } catch (error) {
+    if (NetworkError.isNetworkErrorCode(error?.code)) {
+      throw new NetworkError(error?.code)
+    }
+
+    throw error
+  }
 
   core.info('Finished uploading artifact content to blob storage!')
 
@@ -76,3 +97,37 @@ export async function uploadZipToBlobStorage(
     sha256Hash
   }
 }
+
+export function getBlobClientOptions(sasURL: string): StoragePipelineOptions {
+  const options: StoragePipelineOptions = {
+    userAgentOptions: {
+      userAgentPrefix: getUserAgentString()
+    }
+  }
+
+  const proxyUrl = getProxyUrl(sasURL)
+  if (proxyUrl !== '') {
+    const {
+      port: portString,
+      hostname: host,
+      username,
+      password,
+      protocol
+    } = new URL(proxyUrl)
+    core.debug(`Using proxy server for blob storage upload, host: ${host}`)
+
+    let port = protocol === 'https:' ? 443 : 80
+    if (portString !== '') {
+      port = parseInt(portString)
+    }
+
+    options.proxyOptions = {
+      host,
+      port,
+      username,
+      password
+    }
+  }
+
+  return options
+}