feat: add upstream proxy configuration for outbound requests by Andreybest · Pull Request #1458 · finos/git-proxy

Andreybest · 2026-03-16T03:17:50Z

Resolves #759.

Adds upstream proxy support. Uses values from both configuration file in upstreamProxy fields or environment variables (HTTPS_PROXY/HTTP_PROXY, NO_PROXY)

netlify · 2026-03-16T03:17:55Z

✅ Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Name	Link
🔨 Latest commit	`9cc79cc`
🔍 Latest deploy log	https://app.netlify.com/projects/endearing-brigadeiros-63f9d0/deploys/6a0db66138ebbb00072a4959

linux-foundation-easycla · 2026-03-16T03:17:57Z

The committers listed above are authorized under a signed CLA.

✅ login: Andreybest / name: Andrew (45624bf)
✅ login: Andreybest / name: Andrii Kotliar (548e84c, 7534cf3, 790aa6c, 9336511, b0a4b43, be51974)
✅ login: coopernetes / name: Thomas Cooper (45624bf)
✅ login: jescalada / name: Juan Escalada (9af1d69)
✅ login: kriswest / name: Kris West (84b5b27, b7fa2b3)

codecov · 2026-03-16T03:20:34Z

Codecov Report

❌ Patch coverage is 81.44330% with 18 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.10%. Comparing base (c1d48ef) to head (9cc79cc).

Files with missing lines	Patch %	Lines
src/proxy/routes/index.ts	81.11%	17 Missing ⚠️
src/config/index.ts	85.71%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1458      +/-   ##
==========================================
- Coverage   90.25%   90.10%   -0.16%     
==========================================
  Files          69       69              
  Lines        5561     5657      +96     
  Branches      958      990      +32     
==========================================
+ Hits         5019     5097      +78     
- Misses        523      541      +18     
  Partials       19       19

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

jescalada

@Andreybest Thanks for the contribution! 🚀

I left some comments for code refactoring. It'd be very helpful if you could upload images or a video demonstrating that this feature works as intended.

@coopernetes Wondering if this implements your original requirements (#759) and works on your end 🤔

dcoric

Thanks for tackling #759. I've left a few comments focused on correctness and robustness, especially around NO_PROXY pattern handling which is important to get right for the target use case. The main items are the missing */leading-dot NO_PROXY support and proxy URL validation.

Andreybest · 2026-03-25T21:03:19Z

Thanks for the reviews @jescalada and @dcoric!
Made changes and left comments for your comments. Please recheck :)

Andreybest · 2026-03-25T21:05:20Z

@jescalada
Here is the video on how the proxy works:

Screen.Recording.2026-03-25.at.21.35.35_no_audio.mov

Co-authored-by: Thomas Cooper <57812123+coopernetes@users.noreply.github.com> Signed-off-by: Andrew <andrey255@live.com>

jescalada

LGTM after fixing Denis' comment about validating/error handling the HttpsProxyAgent creation.

@coopernetes Does everything work as you expected? 🤔

coopernetes

LGTM. The only rub is the lack of direct authentication support in the proxy agent. Many client and server libraries do not implement auth directly so it's fine to leave it out for now. Worth making a follow up issue to add HTTP Basic and NTLM (Windows) auth support which are the two most common methods (at least that I'm aware of).

kriswest · 2026-04-21T12:41:02Z

Worth making a follow up issue to add HTTP Basic and NTLM (Windows) auth support which are the two most common methods (at least that I'm aware of).

I'd suggest making that HTTP Basic, NTLM and Negotiate (the negotiate protocol is used to detect support for NTLM or Kerberos auth and then kick off which ever is supported).

…false'

Andreybest · 2026-04-21T23:06:46Z

@dcoric Thank you again for the review! Can you please check again? :)

kriswest · 2026-05-13T14:32:20Z

@Andreybest could you run teh schema doc generation - you did typescript types gen but not but not config schema docs generation. See https://github.com/finos/git-proxy/blob/main/CONTRIBUTING.md#configuration-schema

Very keen to merge this as it will unblock some testing for us on windows machines. We'll report back with testing in a bit.

kriswest · 2026-05-13T14:42:23Z

@Andreybest could you run teh schema doc generation - you did typescript types gen but not but not config schema docs generation. See https://github.com/finos/git-proxy/blob/main/CONTRIBUTING.md#configuration-schema

@goldensyntax can probably PR into your branch for this...

goldensyntax · 2026-05-13T15:11:10Z

@Andreybest could you run teh schema doc generation - you did typescript types gen but not but not config schema docs generation. See https://github.com/finos/git-proxy/blob/main/CONTRIBUTING.md#configuration-schema

@goldensyntax can probably PR into your branch for this...

Done that with:
Andreybest#1

Andreybest · 2026-05-13T18:00:17Z

@Andreybest could you run teh schema doc generation - you did typescript types gen but not but not config schema docs generation. See https://github.com/finos/git-proxy/blob/main/CONTRIBUTING.md#configuration-schema

Very keen to merge this as it will unblock some testing for us on windows machines. We'll report back with testing in a bit.

Merged @goldensyntax PR
Would be happy to see it in main too :)

Can we merge now?

kriswest

LGTM

kriswest · 2026-05-13T18:52:57Z

@jescalada will need to approve and merge due to previously requested change.

re-vlad

While the code supports upstreamProxy config, the user-facing doc does not mention this new feature. New users (especially in corporate environments) will not know how to enable it. Please add a configuration example under the "configuration" section in readme.md:

"upstreamProxy": {
  "enabled": true,
  "url": "http://proxy.corp.local:8080",
  "noProxy": [
    "localhost",
    "127.0.0.1",
    "github.com"
  ]
}```

re-vlad · 2026-05-14T14:34:28Z

Adds upstream proxy support. Uses values from both configuration file in upstreamProxy fields and environment variables (HTTPS_PROXY/HTTP_PROXY, NO_PROXY)

I'd say 'both configuration file in upstreamProxy fields OR environment variables' (according to the src/proxy/routes/index.ts, lines 237–238 const proxyUrl = url || getEnvProxyUrl();)

Andreybest · 2026-05-18T02:22:31Z

Thank you for the review @re-vlad!

This is already described in website/docs/architecture/architecture.md
Changed PR description as you suggested

kriswest

We should be able to complete a retest of this tomorrow, which we'd like to do before this merges.

jescalada

@Andreybest LGTM 👍🏼

Do you mind adding an issue for direct authentication support (HTTP Basic, NTLM and Negotiate) as mentioned earlier and referencing to this PR?

kriswest

Retest completed here and all looks good to us too.

We may need to have a chat about the authentication spec - but we're able to auth with proxy credentials added to the URL currently.

kriswest · 2026-05-20T13:49:54Z

One CLI test failed on windows - re-running that as I'm not convinced it was specific to this PR

Andreybest · 2026-05-20T16:15:03Z

Retest completed here and all looks good to us too.

We may need to have a chat about the authentication spec - but we're able to auth with proxy credentials added to the URL currently.

Glad to hear that!

On auth issue - raised #1541. @kriswest @jescalada

feat: add upstream proxy configuration for outbound requests

be51974

Andreybest requested a review from a team as a code owner March 16, 2026 03:17

Andreybest requested a review from kriswest March 16, 2026 03:17

github-actions Bot added the feature label Mar 16, 2026

jescalada requested changes Mar 17, 2026

View reviewed changes

dcoric suggested changes Mar 22, 2026

View reviewed changes

Comment thread src/proxy/routes/index.ts

Comment thread src/proxy/routes/index.ts Outdated

Comment thread website/docs/architecture/architecture.md

Comment thread src/proxy/routes/index.ts

Andreybest added 2 commits March 23, 2026 14:47

Merge branch 'main' into 759-upstream-proxy

b0a4b43

fix: changes for review

548e84c

github-advanced-security AI found potential problems Mar 25, 2026

View reviewed changes

Comment thread src/config/index.ts Fixed

fix: improve regular expression for redactions

9336511

coopernetes reviewed Mar 26, 2026

View reviewed changes

Comment thread proxy.config.json Outdated

Update proxy.config.json

45624bf

Co-authored-by: Thomas Cooper <57812123+coopernetes@users.noreply.github.com> Signed-off-by: Andrew <andrey255@live.com>

jescalada reviewed Apr 8, 2026

View reviewed changes

Comment thread src/proxy/routes/index.ts

Comment thread src/proxy/routes/index.ts Outdated

Comment thread src/proxy/routes/index.ts

jescalada and others added 2 commits April 8, 2026 12:28

Merge branch 'main' into 759-upstream-proxy

9af1d69

feat: validate upstream proxy URL before creating proxy agent

7534cf3

kriswest mentioned this pull request Apr 20, 2026

20th April 2026 - GitProxy Meeting Minutes #1506

Closed

66 tasks

Merge branch 'main' into 759-upstream-proxy

84b5b27

kriswest requested review from coopernetes, dcoric and jescalada April 20, 2026 15:33

dcoric reviewed Apr 20, 2026

View reviewed changes

Comment thread src/proxy/routes/index.ts Outdated

dcoric reviewed Apr 20, 2026

View reviewed changes

Comment thread src/proxy/routes/index.ts Outdated

coopernetes reviewed Apr 21, 2026

View reviewed changes

Merge branch 'main' into 759-upstream-proxy

b7fa2b3

fix: add check for protocol and hostname and treat unset enabled as '…

790aa6c

…false'

Andreybest requested a review from dcoric April 21, 2026 23:06

Merge branch 'main' into 759-upstream-proxy

dfd006c

docs: generate schema docs for upstreamProxy (#1)

dfde323

Merge branch 'main' into 759-upstream-proxy

bdb139e

kriswest approved these changes May 13, 2026

View reviewed changes

re-vlad reviewed May 14, 2026

View reviewed changes

kriswest and others added 2 commits May 15, 2026 10:43

Merge branch 'main' into 759-upstream-proxy

c7217af

Merge branch 'main' into 759-upstream-proxy

d5a6b28

Andreybest requested a review from re-vlad May 18, 2026 02:22

vzateychuk approved these changes May 18, 2026

View reviewed changes

re-vlad approved these changes May 18, 2026

View reviewed changes

re-vlad requested a review from vzateychuk May 18, 2026 09:35

kriswest reviewed May 18, 2026

View reviewed changes

jescalada approved these changes May 20, 2026

View reviewed changes

Merge branch 'main' into 759-upstream-proxy

9cc79cc

kriswest approved these changes May 20, 2026

View reviewed changes

Andreybest mentioned this pull request May 20, 2026

Add direct authentication support for the upstream proxy agent (HTTP Basic, NTLM, Negotiate) #1541

Open

kriswest merged commit 82031e9 into finos:main May 20, 2026
31 of 33 checks passed

Conversation

Andreybest commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Uh oh!

linux-foundation-easycla Bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

jescalada left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dcoric left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Andreybest commented Mar 25, 2026

Uh oh!

Andreybest commented Mar 25, 2026

Uh oh!

Uh oh!

jescalada left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coopernetes left a comment

Choose a reason for hiding this comment

Uh oh!

kriswest commented Apr 21, 2026

Uh oh!

Andreybest commented Apr 21, 2026

Uh oh!

kriswest commented May 13, 2026

Uh oh!

kriswest commented May 13, 2026

Uh oh!

goldensyntax commented May 13, 2026

Uh oh!

Andreybest commented May 13, 2026

Uh oh!

kriswest left a comment

Choose a reason for hiding this comment

Uh oh!

kriswest commented May 13, 2026

Uh oh!

re-vlad left a comment

Choose a reason for hiding this comment

Uh oh!

re-vlad commented May 14, 2026

Uh oh!

Andreybest commented May 18, 2026

Uh oh!

kriswest left a comment

Choose a reason for hiding this comment

Uh oh!

jescalada left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Andreybest commented Mar 16, 2026 •

edited

Loading

netlify Bot commented Mar 16, 2026 •

edited

Loading

linux-foundation-easycla Bot commented Mar 16, 2026 •

edited

Loading

codecov Bot commented Mar 16, 2026 •

edited

Loading

jescalada left a comment •

edited

Loading