Enable AL-Go for GitHub on GitHub Enterprise Cloud with data residency

.github/workflows/CI.yaml

@@ -36,6 +36,14 @@ jobs:
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
+      - name: Verify AL-Go runs on github.com
+        run: |
+          $serverHost = ([Uri]$env:GITHUB_SERVER_URL).Host
+          if ($serverHost -ne 'github.com') {
+            Write-Host "::error::AL-Go for GitHub itself must run on github.com (detected host '$serverHost'). Developing/running the AL-Go repository on GitHub Enterprise (GHE) is not supported. Note that repositories using AL-Go for GitHub are supported on GHE - this restriction only applies to the AL-Go for GitHub repository itself."
+            exit 1
+          }
+
       - name: Run AL-Go Actions Tests (${{ matrix.psVersion }})
         run: |
           . (Join-Path "." "Tests/runtests.ps1") -Path "Tests"

Actions/AL-Go-Helper.ps1

@@ -931,10 +931,10 @@ function CheckAppDependencyProbingPaths {
                 throw "The Setting AppDependencyProbingPaths needs to contain a repo property, pointing to the repository on which your project have a dependency"
             }
             if ($dependency.Repo -eq ".") {
-                $dependency.Repo = "https://github.com/$repository"
+                $dependency.Repo = "$($ENV:GITHUB_SERVER_URL)/$repository"
             }
             elseif ($dependency.Repo -notlike "https://*") {
-                $dependency.Repo = "https://github.com/$($dependency.Repo)"
+                $dependency.Repo = "$($ENV:GITHUB_SERVER_URL)/$($dependency.Repo)"
             }
             if (-not ($dependency.PsObject.Properties.name -eq "Version")) {
                 $dependency | Add-Member -name "Version" -MemberType NoteProperty -Value "latest"
@@ -988,7 +988,7 @@ function CheckAppDependencyProbingPaths {
             }
 
             if ($dependency.release_status -eq "include") {
-                if ($dependency.Repo -ne "https://github.com/$repository") {
+                if ($dependency.Repo -ne "$($ENV:GITHUB_SERVER_URL)/$repository") {
                     OutputWarning "Dependencies with release_status 'include' must be to other projects in the same repository."
                 }
                 else {
@@ -1661,7 +1661,7 @@ function CreateDevEnv {
                         New-Object -Type PSObject -Property $_
                     }
                 })
-            GetDependencies -probingPathsJson $settings.appDependencyProbingPaths -saveToPath $dependenciesFolder -api_url 'https://api.github.com' | ForEach-Object {
+            GetDependencies -probingPathsJson $settings.appDependencyProbingPaths -saveToPath $dependenciesFolder -api_url $ENV:GITHUB_API_URL | ForEach-Object {
                 if ($_.startswith('(')) {
                     $installTestApps += $_
                 }

Actions/CheckForUpdates/CheckForUpdates.HelperFunctions.ps1

@@ -21,19 +21,43 @@ function DownloadTemplateRepository {
         [bool] $downloadLatest
     )
 
+    # Construct API URL
+    if ($templateUrl -like 'https://github.com/*') {
+        # templateUrl is github.com - use the github.com API URL
+        $apiUrl = $templateUrl.Split('@')[0] -replace "^($([regex]::Escape('https://github.com') -replace '/', '\/'))/(.*)$", "https://api.github.com/repos/`$2"
+    }
+    else {
+        # templateUrl is not github.com (e.g. github enterprise) - use the GITHUB_SERVER_URL and GITHUB_API_URL environment variables
+        $apiUrl = $templateUrl.Split('@')[0] -replace "^($([regex]::Escape($env:GITHUB_SERVER_URL) -replace '/', '\/'))/(.*)$", "$ENV:GITHUB_API_URL/repos/`$2"
+    }
+
+    Write-Host "TemplateUrl: $templateUrl"
+    Write-Host "ApiUrl: $apiUrl"
+    Write-Host "TemplateSha: $($templateSha.Value)"
+    Write-Host "DownloadLatest: $downloadLatest"
+
     $templateRepositoryUrl = $templateUrl.Split('@')[0]
     $templateRepository = $templateRepositoryUrl.Split('/')[-2..-1] -join '/'
 
     # Use Authenticated API request if possible to avoid the 60 API calls per hour limit
-    OutputDebug -message "Getting template repository ($templateRepository) with GITHUB_TOKEN"
-    $headers = GetHeaders -token $env:GITHUB_TOKEN -repository $templateRepository
+    if ($templateUrl -like "$env:GITHUB_SERVER_URL/*") {
+        # Use authenticated request if the templateUrl is on the same GitHub server as the current repository
+        Write-Host "Getting template repository ($templateRepository) with GITHUB_TOKEN"
+        $headers = GetHeaders -token $env:GITHUB_TOKEN -repository $templateRepository
+    }
+    else {
+        # Use unauthenticated request if the templateUrl is on a different GitHub server
+        Write-Host "Getting template repository ($templateRepository) anonymously"
+        $headers = GetHeaders -repository $templateRepository
+    }
     try {
+        # This ONLY fails if the template repository is private/internal and the GITHUB_TOKEN does not have access to it
         $response = Invoke-WebRequest -UseBasicParsing -Headers $headers -Method Head -Uri $templateRepositoryUrl
         OutputDebug -message ($response | Format-List | Out-String)
     }
     catch {
         # Ignore error
-        OutputDebug -message "Error getting template repository with GITHUB_TOKEN:"
+        OutputDebug -message "Error getting template repository:"
         OutputDebug -message $_
         $response = $null
     }
@@ -44,13 +68,6 @@ function DownloadTemplateRepository {
         $headers = GetHeaders -token $token -repository $templateRepository
     }
 
-    # Construct API URL
-    $apiUrl = $templateUrl.Split('@')[0] -replace "^(https:\/\/github\.com\/)(.*)$", "$ENV:GITHUB_API_URL/repos/`$2"
-
-    Write-Host "TemplateUrl: $templateUrl"
-    Write-Host "TemplateSha: $($templateSha.Value)"
-    Write-Host "DownloadLatest: $downloadLatest"
-
     if ($downloadLatest) {
         # Get latest commit SHA from the template repository
         $templateSha.Value = GetLatestTemplateSha -headers $headers -apiUrl $apiUrl -templateUrl $templateUrl
@@ -78,7 +95,10 @@ function GetLatestTemplateSha {
     $branch = $templateUrl.Split('@')[1]
     Write-Host "Get latest SHA for $templateUrl"
     try {
-        $branchInfo = (InvokeWebRequest -Headers $headers -Uri "$apiUrl/branches/$branch").Content | ConvertFrom-Json
+        $url = "$apiUrl/branches/$branch"
+        Write-Host "Api URL: $url"
+        $result = Invoke-WebRequest -UseBasicParsing -Headers $headers -Uri $url
+        $branchInfo = $result.Content | ConvertFrom-Json
     } catch {
         throw "Failed to update AL-Go System Files. Could not get the latest SHA from template ($templateUrl). (Error was $($_.Exception.Message))"
     }

Actions/CheckForUpdates/CheckForUpdates.ps1

@@ -239,7 +239,7 @@ else {
         # Get Token with permissions to modify workflows in this repository
         $repoWriteToken = GetAccessToken -token $token -permissions @{"actions"="read";"contents"="write";"pull_requests"="write";"workflows"="write"}
         $env:GH_TOKEN = $repoWriteToken
-
+        $env:GH_HOST = ([Uri]$env:GITHUB_SERVER_URL).Host
         $existingPullRequest = (gh api --paginate "/repos/$env:GITHUB_REPOSITORY/pulls?base=$updateBranch" -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" | ConvertFrom-Json) | Where-Object { $_.title -eq $commitMessage } | Select-Object -First 1
         if ($existingPullRequest) {
             OutputWarning "Pull request already exists for $($commitMessage): $($existingPullRequest.html_url)."

Actions/Deploy/Deploy.psm1

@@ -22,7 +22,7 @@ function GetHeadRefFromPRId {
 
     $headers = GetHeaders -token $token
 
-    $pullsURI = "https://api.github.com/repos/$repository/pulls/$prId"
+    $pullsURI = "$($ENV:GITHUB_API_URL)/repos/$repository/pulls/$prId"
     Write-Host "- $pullsURI"
     $pr = (InvokeWebRequest -Headers $headers -Uri $pullsURI).Content | ConvertFrom-Json
 

Actions/DetermineProjectsToBuild/DetermineProjectsToBuild.Action.ps1

@@ -88,7 +88,7 @@ Trace-Information -Message "Incremental builds (projects)" -AdditionalData $addi
 
 # Add annotation for last known good build
 if ($baselineWorkflowRunId) {
-    Write-Host "::notice::Last known good build: https://github.com/$($env:GITHUB_REPOSITORY)/actions/runs/$baselineWorkflowRunId"
+    Write-Host "::notice::Last known good build: $($env:GITHUB_SERVER_URL)/$($env:GITHUB_REPOSITORY)/actions/runs/$baselineWorkflowRunId"
 }
 
 # Set output variables

Actions/GetArtifactsForDeployment/GetArtifactsForDeployment.ps1

@@ -79,7 +79,7 @@ elseif ($artifactsVersion -like "PR_*") {
     }
     $latestPRBuildId, $lastKnownGoodBuildId = FindLatestPRRun -repository $ENV:GITHUB_REPOSITORY -commitSha $prLatestCommitSha -token $token
     if ($latestPRBuildId -eq 0) {
-        $prLink = "https://github.com/$($ENV:GITHUB_REPOSITORY)/pull/$prId"
+        $prLink = "$($ENV:GITHUB_SERVER_URL)/$($ENV:GITHUB_REPOSITORY)/pull/$prId"
         throw "Latest PR build for PR $prId not found, not completed or not successful - Please re-run this workflow when you have a successful build on PR_$prId ($prLink)"
     }
 
@@ -102,7 +102,7 @@ elseif ($artifactsVersion -like "PR_*") {
     }
 
     if ($expiredArtifacts) {
-        $prBuildLink = "https://github.com/$($ENV:GITHUB_REPOSITORY)/actions/runs/$latestPRBuildId"
+        $prBuildLink = "$($ENV:GITHUB_SERVER_URL)/$($ENV:GITHUB_REPOSITORY)/actions/runs/$latestPRBuildId"
         $shortLivedRetentionSettingLink = "https://aka.ms/algosettings#shortLivedArtifactsRetentionDays"
         throw "Build artifacts are expired, please re-run the pull request build ($prBuildLink). Note that you can control the retention days of short-lived artifacts using the AL-Go setting ShortLivedArtifactsRetentionDays. See $shortLivedRetentionSettingLink"
     }

Actions/GetArtifactsForDeployment/GetArtifactsForDeployment.psm1

@@ -25,7 +25,7 @@ function FindPRRunAnnotationForIncrementalBuilds {
 
     Write-Host "Finding PR run annotation for incremental builds in repository $repository"
 
-    $checkRunsURI = "https://api.github.com/repos/$repository/check-suites/$checkSuiteId/check-runs"
+    $checkRunsURI = "$($ENV:GITHUB_API_URL)/repos/$repository/check-suites/$checkSuiteId/check-runs"
     Write-Host "- $checkRunsURI"
 
     $checkRuns = (InvokeWebRequest -Headers $headers -Uri $checkRunsURI).Content | ConvertFrom-Json
@@ -47,7 +47,7 @@ function FindPRRunAnnotationForIncrementalBuilds {
         $annotations = (InvokeWebRequest -Headers $headers -Uri $annotationsURI).Content | ConvertFrom-Json
         if($annotations -and $annotations.count -gt 0) {
             foreach($annotation in $annotations) {
-                if($annotation.message -match "Last known good build: https://github.com/$repository/actions/runs/([0-9]{1,11})") {
+                if($annotation.message -match "Last known good build: $($ENV:GITHUB_SERVER_URL)/$repository/actions/runs/([0-9]{1,11})") {
                     Write-Host "Found PR run annotation message: $($annotation.message)"
                     $lastKnownGoodBuildId = $matches[1]
                     break
@@ -92,7 +92,7 @@ function FindLatestPRRun {
 
     while($true) {
         # Get all workflow runs for the given commit sha
-        $runsURI = "https://api.github.com/repos/$repository/actions/runs?per_page=$per_page&page=$page&head_sha=$commitSha"
+        $runsURI = "$($ENV:GITHUB_API_URL)/repos/$repository/actions/runs?per_page=$per_page&page=$page&head_sha=$commitSha"
         Write-Host "- $runsURI"
         $workflowRuns = (InvokeWebRequest -Headers $headers -Uri $runsURI).Content | ConvertFrom-Json
 
@@ -305,7 +305,7 @@ function GetLatestCommitShaFromPRId {
 
     $headers = GetHeaders -token $token
 
-    $pullsURI = "https://api.github.com/repos/$repository/pulls/$prId"
+    $pullsURI = "$($ENV:GITHUB_API_URL)/repos/$repository/pulls/$prId"
     Write-Host "- $pullsURI"
     $pr = (InvokeWebRequest -Headers $headers -Uri $pullsURI).Content | ConvertFrom-Json
 
@@ -334,7 +334,7 @@ function GetHeadRefFromRunId {
 
     $headers = GetHeaders -token $token
 
-    $runsURI = "https://api.github.com/repos/$repository/actions/runs/$runId"
+    $runsURI = "$($ENV:GITHUB_API_URL)/repos/$repository/actions/runs/$runId"
     Write-Host "- $runsURI"
 
     $run = (InvokeWebRequest -Headers $headers -Uri $runsURI).Content | ConvertFrom-Json

Actions/Github-Helper.psm1

@@ -749,7 +749,7 @@ function WaitForRateLimit {
         [switch] $displayStatus
     )
 
-    $rate = ((InvokeWebRequest -Headers $headers -Uri "https://api.github.com/rate_limit").Content | ConvertFrom-Json).rate
+    $rate = ((InvokeWebRequest -Headers $headers -Uri "$ENV:GITHUB_API_URL/rate_limit").Content | ConvertFrom-Json).rate
     $percentRemaining = [int]($rate.remaining*100/$rate.limit)
     if ($displayStatus) {
         Write-Host "$($rate.remaining) API calls remaining out of $($rate.limit) ($percentRemaining%)"
@@ -958,7 +958,7 @@ function CheckBuildJobsInWorkflowRun {
     $anySuccessful = $false
 
     while($true) {
-        $jobsURI = "https://api.github.com/repos/$repository/actions/runs/$workflowRunId/jobs?per_page=$per_page&page=$page"
+        $jobsURI = "$ENV:GITHUB_API_URL/repos/$repository/actions/runs/$workflowRunId/jobs?per_page=$per_page&page=$page"
         Write-Host "- $jobsURI"
         $workflowJobs = (InvokeWebRequest -Headers $headers -Uri $jobsURI).Content | ConvertFrom-Json
 
@@ -1014,7 +1014,7 @@ function FindLatestSuccessfulCICDRun {
 
     # Get the latest CICD workflow run
     while($true) {
-        $runsURI = "https://api.github.com/repos/$repository/actions/runs?per_page=$per_page&page=$page&exclude_pull_requests=true&status=completed&branch=$branch&created=>$expired"
+        $runsURI = "$ENV:GITHUB_API_URL/repos/$repository/actions/runs?per_page=$per_page&page=$page&exclude_pull_requests=true&status=completed&branch=$branch&created=>$expired"
         Write-Host "- $runsURI"
         $workflowRuns = (InvokeWebRequest -Headers $headers -Uri $runsURI).Content | ConvertFrom-Json
 

Actions/PullRequestStatusCheck/PullRequestStatusCheck.ps1

@@ -32,6 +32,7 @@ function PullRequestStatusCheck()
     Write-Host "Checking PR Build status for run $RunId in repository $Repository"
 
     $workflowJobs = Invoke-CommandWithRetry -RetryCount 5 -FirstDelay 5 -MaxWaitBetweenRetries 60 -ScriptBlock {
+        $env:GH_HOST = ([Uri]$env:GITHUB_SERVER_URL).Host
         $jobsJson = gh api "/repos/$Repository/actions/runs/$RunId/jobs?per_page=50" --paginate --slurp -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28"
         if ($LASTEXITCODE) {
             throw "Failed to get jobs for run $RunId in repository $Repository (gh exit code $LASTEXITCODE)."

Actions/VerifyPRChanges/VerifyPRChanges.ps1

@@ -33,7 +33,7 @@ function ValidatePullRequest
     [hashtable] $Headers,
     [int] $MaxAllowedChangedFiles = 3000
 ) {
-    $url = "https://api.github.com/repos/$($prBaseRepository)/pulls/$pullRequestId"
+    $url = "$($ENV:GITHUB_API_URL)/repos/$($prBaseRepository)/pulls/$pullRequestId"
     $pullRequestDetails = (Invoke-WebRequest -UseBasicParsing -Headers $Headers -Uri $url).Content | ConvertFrom-Json
 
     # List Pull Request files has a max of 3000 files. https://docs.github.com/en/rest/pulls/pulls?apiVersion=2022-11-28#list-pull-requests-files
@@ -53,7 +53,7 @@ function ValidatePullRequestFiles
     $hasMoreData = $true
     Write-Host "Files Changed:"
     while ($hasMoreData) {
-        $url = "https://api.github.com/repos/$($prBaseRepository)/pulls/$pullRequestId/files?per_page=$resultsPerPage&page=$pageNumber"
+        $url = "$($ENV:GITHUB_API_URL)/repos/$($prBaseRepository)/pulls/$pullRequestId/files?per_page=$resultsPerPage&page=$pageNumber"
         $changedFiles = (Invoke-WebRequest -UseBasicParsing -Headers $headers -Uri $url).Content | ConvertFrom-Json
 
         # Finish check if there are no more files to be validated

Actions/WorkflowPostProcess/WorkflowPostProcess.ps1

@@ -25,7 +25,8 @@ function GetWorkflowConclusion($JobContext) {
     }
 
     # Check the conclusion for the past jobs in the workflow
-    $workflowJobs = gh api /repos/$ENV:GITHUB_REPOSITORY/actions/runs/$ENV:GITHUB_RUN_ID/jobs --paginate -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" | ConvertFrom-Json
+    $env:GH_HOST = ([Uri]$env:GITHUB_SERVER_URL).Host
+    $workflowJobs = gh api --paginate /repos/$ENV:GITHUB_REPOSITORY/actions/runs/$ENV:GITHUB_RUN_ID/jobs -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" | ConvertFrom-Json
     if ($null -ne $workflowJobs) {
         $failedJobs = $workflowJobs.jobs | Where-Object { $_.conclusion -eq "failure" }
         if ($null -ne $failedJobs) {

README.md

@@ -43,6 +43,7 @@ Try out the [AL-Go workshop](https://aka.ms/algoworkshop) for an in-depth worksh
 1. [Connect your GitHub repository to Power Platform](Scenarios/SetupPowerPlatform.md)
 1. [How to set up Service Principal for Power Platform](Scenarios/SetupServicePrincipalForPowerPlatform.md)
 1. [Try one of the Business Central and Power Platform samples](Scenarios/TryPowerPlatformSamples.md)
+1. [Using AL-Go for GitHub on GitHub Enterprise (GHE)](Scenarios/UsingGitHubEnterprise.md)
 1. [Customizing AL-Go for GitHub](Scenarios/CustomizingALGoForGitHub.md)
 
 ## Migration scenarios

RELEASENOTES.md

@@ -1,3 +1,7 @@
+### GitHub Enterprise host compatibility fixes
+
+Several actions no longer assume the public `github.com`/`api.github.com` hosts, so they work on GitHub Enterprise (including `ghe.com`) organizations. REST calls now use `$ENV:GITHUB_API_URL` instead of a hardcoded `https://api.github.com` (Deploy, GetArtifactsForDeployment, VerifyPRChanges and app dependency probing), app dependency repositories default to `$ENV:GITHUB_SERVER_URL` instead of `https://github.com`, and the WorkflowPostProcess `gh api` call now sets `GH_HOST` so relative API calls target the correct host. Note that repositories using AL-Go for GitHub are supported on GHE, but the AL-Go for GitHub repository itself is not (it must run on github.com).
+
 ## v9.1
 
 ### Resilient Pull Request Status Check for large builds