Skip to content

fix: harden SQL Server 2025 installer downloads - #296

Merged
dhensby merged 2 commits into
tediousjs:masterfrom
cheenamalhotra:dev/cheena/potential-meme
Oct 9, 2026
Merged

dhensby merged 2 commits into
tediousjs:masterfrom
cheenamalhotra:dev/cheena/potential-meme

Conversation

@cheenamalhotra

@cheenamalhotra cheenamalhotra commented Oct 6, 2026 •

Copy link
Copy Markdown
Contributor

Documents and improves SQL Server 2025 install support.

Changes

  • SSEI bootstrapper now downloads media into its own temp folder, so other .exe files in the download dir can't be picked by mistake.
  • Quote /MediaPath so paths with spaces work.
  • Fail clearly if the bootstrapper produces no installer or more than one.
  • Add sql-2025 to the CI runaction matrix.
  • List supported versions in action.yml input and add a SQL 2025 section to README.
  • Add tests for 2025 version aliases, caching, path quoting and error cases.

Testing

  • npm run test: 92 passing
  • npm run lint, npm run build: clean

cc @arthurschreiber @saurabh500 @David-Engel

@cheenamalhotra
cheenamalhotra marked this pull request as ready for review October 6, 2026 05:45
@dhensby
dhensby requested a balanced review from Copilot October 6, 2026 09:47

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

The implementation is focused and well tested, with only a non-blocking import-order issue.

Review effort: Balanced
Findings: 1 Low severity

Open (1)
What changed in this PR

Hardens SQL Server 2025 media downloads and documents/tests the supported workflow.

Changes:

  • Isolates SSEI downloads, quotes paths, and validates installer output.
  • Adds SQL Server 2025 documentation and CI coverage.
  • Expands tests for aliases, caching, paths, and failures.
File Description
src/​utils.ts Hardens SSEI media handling.
test/​utils.ts Tests download behavior and errors.
test/​install.ts Tests cached SSEI media.
action.yml Documents supported versions.
README.md Adds SQL Server 2025 guidance.
.github/​workflows/​release.yml Adds SQL 2025 integration coverage.
.github/​copilot-instructions.md Documents isolated media handling.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread src/utils.ts

@dhensby dhensby left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @cheenamalhotra, this looks good.

Downloading the SSEI media into its own temp directory and requiring exactly one installer is sensible hardening. CI also confirms the bootstrapper accepts the quoted /MediaPath on a real runner: the windows-2025/sql-2025 job ran with /MediaPath="D:\a\_temp\sqlserver-media-3KLYYW" and got a single SQLServer2025-STDDEV-x64-ENU.exe. Adding sql-2025 to the matrix also restores our existing convention of testing sql-latest alongside each explicit version, which got missed when 2025 support was added.

I've left a couple of small docs nits inline. There are also two suggestions for bringing the rest of the code in line with what you've done here: quoting the other install paths, and isolating the box installer's extraction in the same way. Either can be done here or in a follow-up, whichever you prefer.

Heads-up: this conflicts with #295 (README, the node:fs/promises import in src/utils.ts, the module mocks in test/utils.ts, and lib/). Whichever PR lands second will need a rebase and a fresh npm run build.

Comment thread README.md Outdated
Comment thread .github/copilot-instructions.md Outdated
Comment thread src/utils.ts
Comment thread src/utils.ts
@cheenamalhotra
cheenamalhotra requested a review from dhensby October 9, 2026 03:57
cheenamalhotra and others added 2 commits October 9, 2026 01:29
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Box and SSEI installers now share a helper that extracts into a
separate temp directory before caching. Quote /UpdateSource and the
MSI path so paths with spaces work. Apply review docs wording.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@cheenamalhotra
cheenamalhotra force-pushed the dev/cheena/potential-meme branch from 308f732 to 0b1a8dd Compare October 9, 2026 08:30
@dhensby
dhensby merged commit 80e73ab into tediousjs:master Oct 9, 2026
18 checks passed
@dhensby

dhensby commented Oct 9, 2026

Copy link
Copy Markdown
Collaborator

Thanks for your work on these two PRs :)

@github-actions

github-actions Bot commented Oct 9, 2026

Copy link
Copy Markdown

🎉 This PR is included in version 4.0.3 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants