fix: fetch cumulative update pages with native fetch to avoid 403s#258
Merged
Conversation
Since @actions/http-client 3.0.1, requests carry a default user agent of `actions/http-client actions_orchestration_id/<id>` (previously no user-agent header was sent at all). The Microsoft download pages scraped by downloadUpdateInstaller reject requests with that user agent with an instant 403, so cumulative updates were silently skipped and SQL Server was installed as plain RTM. Switch the page scrape to the native fetch API with a browser-like user agent. The actual .exe downloads from download.microsoft.com are unaffected and keep using @actions/tool-cache. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
arthurschreiber
force-pushed
the
fix/cu-download-403
branch
from
July 19, 2026 15:47
8b65bcd to
25dfb56
Compare
There was a problem hiding this comment.
Pull request overview
This PR fixes cumulative update (CU) page scraping by switching downloadUpdateInstaller from @actions/http-client to native fetch, avoiding Microsoft download page 403 responses that have prevented CU installation since newer @actions/http-client versions were introduced.
Changes:
- Replaced CU update-page HTTP retrieval with native
fetch(custom UA + HTML accept header) while keeping the actual.exedownload path unchanged. - Updated tests to mock
globalThis.fetchand added coverage for the non-2xx warning/return-empty path. - Removed the now-unused direct
@actions/http-clientdependency from the package manifests.
Reviewed changes
Copilot reviewed 3 out of 6 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
src/utils.ts |
Uses native fetch to scrape CU download pages and logs status via Response.status. |
test/utils.ts |
Switches mocks from HttpClient to globalThis.fetch and adds a rejected-request test. |
package.json |
Removes direct dependency on @actions/http-client. |
package-lock.json |
Updates lockfile to reflect dependency removal. |
dhensby
approved these changes
Jul 19, 2026
Contributor
Author
|
@dhensby You were a bit too quick to merge this 😬 I was about to push some additional changes / cleanup. Let me open a new PR for that. |
Collaborator
|
Sorry! thanks |
|
🎉 This PR is included in version 4.0.1 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Since v3.1.0 (which pulled in
@actions/http-client>= 3.0.1), cumulative update installation has been silently broken: the Microsoft download pages scraped bydownloadUpdateInstallerrespond with an instant 403 and SQL Server gets installed as plain RTM, with only a warning in the logs.The trigger is the request shape of newer
@actions/http-clientversions, which Microsoft's CDN edge rejects from runner IPs. Notably it is not simply the user agent string: a probe from realwindows-2022/windows-2025runners showed that nativefetchrequests succeed with any user agent — includingactions/http-client actions_orchestration_id/...— while an unmodified v4 install job running minutes later still got a 403 from its http-client request. The old http-client 2.2.x request (which sent no user-agent header at all) also passed.Evidence from tediousjs/tedious CI on 2026-07-19 (same runner pool, same day):
setup-sqlserver@v4: 403 on the 2022 CU page in 6 consecutive run attempts between 11:26 and 15:41 UTC (run) → SQL Server 2022 RTM (16.0.1000) → tedious' TDS 8.0 strict-encryption integration test fails against an RTM server bug.setup-sqlserver@v2: successful scrape at 15:09 UTC (run) → CU26 (16.0.4265.3) installed, tests green.Changes
downloadUpdateInstallerscrapes the update page with nativefetch, sending a transparenttediousjs/setup-sqlserveruser agent andaccept: text/htmlheader..exedownloads are unaffected — they keep using@actions/tool-cacheagainstdownload.microsoft.com, which does not reject these requests.@actions/http-clientdependency and rebuiltlib/.fetchinstead of the http-client module; added a test for the non-2xx warning path.Verification
A failed CU download only warns, so a green
runactionjob is not sufficient — check thesql-2022job log forDownloading cumulative update from https://download.microsoft.com/...and(RTM-CU26)in the installed version output. An earlier revision of this PR (browser-like user agent) already passed this check; the current revision only changes the user-agent string, which the probe showed is not load-bearing.🤖 Generated with Claude Code