fix: fetch cumulative update pages with native fetch to avoid 403s

Since @actions/http-client 3.0.1, requests carry a default user agent of
`actions/http-client actions_orchestration_id/<id>` (previously no
user-agent header was sent at all). The Microsoft download pages scraped
by downloadUpdateInstaller reject requests with that user agent with an
instant 403, so cumulative updates were silently skipped and SQL Server
was installed as plain RTM.

Switch the page scrape to the native fetch API with a browser-like user
agent. The actual .exe downloads from download.microsoft.com are
unaffected and keep using @actions/tool-cache.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: arthurschreiber

lib/main/index.js

@@ -54,7 +54,6 @@
     "@actions/core": "^3.0.1",
     "@actions/exec": "^3.0.0",
     "@actions/glob": "^0.7.0",
-    "@actions/http-client": "^4.0.1",
     "@actions/io": "^3.0.2",
     "@actions/tool-cache": "^4.0.0"
   }

lib/main/index.js.map

@@ -3,7 +3,6 @@ import { readdir } from 'node:fs/promises';
 import * as core from '@actions/core';
 import * as exec from '@actions/exec';
 import * as glob from '@actions/glob';
-import { HttpClient } from '@actions/http-client';
 import * as io from '@actions/io';
 import * as tc from '@actions/tool-cache';
 import { generateFileHash } from './crypto.ts';
@@ -240,10 +239,17 @@ export async function downloadUpdateInstaller(config: VersionConfig): Promise<st
     // resolve download url
     let downloadLink: string | null = null;
     if (!config.updateUrl.endsWith('.exe')) {
-        const client = new HttpClient();
-        const res = await client.get(config.updateUrl);
-        if (res.message.statusCode && res.message.statusCode >= 200 && res.message.statusCode < 300) {
-            const body = await res.readBody();
+        // Use native fetch with a browser-like user agent - @actions/http-client >= 3.0.1
+        // appends "actions_orchestration_id/..." to the user agent, which the
+        // download page rejects with a 403.
+        const res = await fetch(config.updateUrl, {
+            headers: {
+                'accept': 'text/html,application/xhtml+xml',
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36',
+            },
+        });
+        if (res.ok) {
+            const body = await res.text();
             const [, link] = body.match(/\s+href\s*=\s*["'](https:\/\/download\.microsoft\.com\/.*\.exe)['"]/) ?? [];
             if (link) {
                 downloadLink = link;
@@ -254,7 +260,7 @@ export async function downloadUpdateInstaller(config: VersionConfig): Promise<st
         }
         if (!downloadLink) {
             core.warning('Unable to download cumulative updates');
-            core.info(`Response code: ${res.message.statusCode}`);
+            core.info(`Response code: ${res.status}`);
             return '';
         }
     }

package-lock.json

@@ -27,15 +27,13 @@ const io = { mv: mock.fn(async () => {}) };
 const globCreate = mock.fn(async () => ({ glob: async () => [] as string[] }));
 const glob = { create: globCreate };
 
-const httpGet = mock.fn(async () => httpResponse);
-const httpResponse = {
-    message: { statusCode: 200 },
-    readBody: mock.fn(async () => ''),
+const fetchResponse = {
+    ok: true,
+    status: 200,
+    text: mock.fn(async () => ''),
 };
-class HttpClient {
-    get = httpGet;
-}
-const http = { HttpClient };
+const fetchMock = mock.fn(async () => fetchResponse);
+globalThis.fetch = fetchMock as unknown as typeof fetch;
 
 const readdir = mock.fn(async () => [] as string[]);
 const generateFileHash = mock.fn(async () => randomBytes(32));
@@ -45,7 +43,6 @@ mock.module('@actions/exec', { namedExports: exec });
 mock.module('@actions/tool-cache', { namedExports: tc });
 mock.module('@actions/io', { namedExports: io });
 mock.module('@actions/glob', { namedExports: glob });
-mock.module('@actions/http-client', { namedExports: http });
 mock.module('node:fs/promises', { namedExports: { readdir } });
 mock.module('../src/crypto.ts', { namedExports: { generateFileHash } });
 
@@ -58,7 +55,7 @@ function resetAll() {
         core.startGroup, core.endGroup, core.isDebug, core.platform.getDetails,
         exec.exec,
         tc.downloadTool, tc.cacheFile, tc.cacheDir,
-        io.mv, globCreate, httpGet, httpResponse.readBody,
+        io.mv, globCreate, fetchMock, fetchResponse.text,
         readdir, generateFileHash,
     ];
     for (const fn of fns) fn.mock.resetCalls();
@@ -72,9 +69,10 @@ function resetAll() {
     tc.cacheDir.mock.mockImplementation(async () => `C:/tools/${randomUUID()}`);
     io.mv.mock.mockImplementation(async () => {});
     globCreate.mock.mockImplementation(async () => ({ glob: async () => [] }));
-    httpResponse.message = { statusCode: 200 };
-    httpResponse.readBody.mock.mockImplementation(async () => '');
-    httpGet.mock.mockImplementation(async () => httpResponse);
+    fetchResponse.ok = true;
+    fetchResponse.status = 200;
+    fetchResponse.text.mock.mockImplementation(async () => '');
+    fetchMock.mock.mockImplementation(async () => fetchResponse);
     readdir.mock.mockImplementation(async () => []);
     generateFileHash.mock.mockImplementation(async () => randomBytes(32));
 }
@@ -312,8 +310,9 @@ describe('utils', () => {
     });
     describe('.downloadUpdateInstaller()', () => {
         beforeEach(() => {
-            httpResponse.message = { statusCode: 200 };
-            httpResponse.readBody.mock.mockImplementation(async () => '<a href="https://download.microsoft.com/update.exe">');
+            fetchResponse.ok = true;
+            fetchResponse.status = 200;
+            fetchResponse.text.mock.mockImplementation(async () => '<a href="https://download.microsoft.com/update.exe">');
         });
         it('returns a path to an exe', async () => {
             const res = await utils.downloadUpdateInstaller({
@@ -349,17 +348,30 @@ describe('utils', () => {
                 updateUrl: 'https://example.com/sqlupdate.exe',
             });
             assert.match(res, /^C:\/tools\/[a-f0-9-]*\/sqlupdate\.exe$/);
-            assert.equal(httpGet.mock.callCount(), 0);
+            assert.equal(fetchMock.mock.callCount(), 0);
         });
         it('returns empty string if URL is not resolved', async () => {
-            httpResponse.readBody.mock.mockImplementation(async () => '<a href="https://example.com/update.exe">');
+            fetchResponse.text.mock.mockImplementation(async () => '<a href="https://example.com/update.exe">');
             const res = await utils.downloadUpdateInstaller({
                 exeUrl: 'https://example.com/installer.exe',
                 version: '2022',
                 updateUrl: 'https://example.com/sqlupdate.html',
             });
             assert.equal(res, '');
-            assert.equal(httpGet.mock.callCount(), 1);
+            assert.equal(fetchMock.mock.callCount(), 1);
+        });
+        it('returns empty string if the update page request is rejected', async () => {
+            fetchResponse.ok = false;
+            fetchResponse.status = 403;
+            const res = await utils.downloadUpdateInstaller({
+                exeUrl: 'https://example.com/installer.exe',
+                version: '2022',
+                updateUrl: 'https://example.com/sqlupdate.html',
+            });
+            assert.equal(res, '');
+            const calls = core.info.mock.calls.filter((c) => String(c.arguments[0]).startsWith('Response code'));
+            assert.equal(calls.length, 1);
+            assert.equal(String(calls[0].arguments[0]), 'Response code: 403');
         });
     });
     describe('.gatherSummaryFiles()', () => {