fix: set the correct custom hub catalog type by pratap0007 · Pull Request #2371 · tektoncd/pipelines-as-code

pratap0007 · 2026-01-05T07:17:41Z

📝 Description of the Change

Earlier, the custom hub catalog type was always set to artfacthub.
With this fix, the custom hub catalog URL is validated and correct custom hub
catalog type is set accordingly.

👨🏻‍ Linked Jira

https://issues.redhat.com/browse/SRVKP-9976

🔗 Linked GitHub Issue

Fixes #

🚀 Type of Change

🧪 Testing Strategy

🤖 AI Assistance

I have not used any AI assistance for this PR.
I have used AI assistance for this PR.

If you have used AI assistance, please provide the following details:

Which LLM was used?

Extent of AI Assistance:

Documentation and research only
Unit tests or E2E tests only
Code generation (parts of the code)
Full code generation (most of the PR)
PR description and comments
Commit message(s)

Important

If the majority of the code in this PR was generated by an AI, please add a Co-authored-by trailer to your commit message.
For example:

Co-authored-by: Gemini gemini@google.com
Co-authored-by: ChatGPT noreply@chatgpt.com
Co-authored-by: Claude noreply@anthropic.com
Co-authored-by: Cursor noreply@cursor.com
Co-authored-by: Copilot Copilot@users.noreply.github.com

**💡You can use the script ./hack/add-llm-coauthor.sh to automatically add
these co-author trailers to your commits.

✅ Submitter Checklist

gemini-code-assist · 2026-01-05T07:17:54Z

Summary of Changes

Hello @pratap0007, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the handling of custom hub catalogs by introducing automatic type detection. Previously, custom catalogs without a specified type would default to ArtifactHubType. Now, if a URL is provided, the system will attempt to infer the correct hub type via an API call, making the configuration of custom catalogs more robust and user-friendly by reducing the need for manual type specification.

Highlights

Automatic Hub Type Detection: Implemented logic to automatically detect the hub type for custom catalogs. If a custom catalog's type is not explicitly specified but a URL is provided, the system will now attempt to determine the hub type via an API call.
Enhanced Test Coverage: Added a new test case to validate the automatic hub type detection functionality, ensuring that custom catalogs without an explicit type are correctly identified when a URL is present.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

pipelines-as-code · 2026-01-05T07:18:02Z

🔍 PR Lint Feedback

Note: This automated check helps ensure your PR follows our contribution guidelines.

⚠️ Items that need attention:

🤖 AI attribution

The following commits lack an explicit AI attribution footer:

15f042c fix: set the correct custom hub catalog type

If no AI assistance was used for a commit, you can ignore this warning.
Otherwise add an Assisted-by: or Co-authored-by: footer referencing the AI used.

ℹ️ Next Steps

Review and address the items above
Push new commits to update this PR
This comment will be automatically updated when issues are resolved

🔧 Admin Tools (click to expand)

Automated Issue/Ticket Creation:

/issue-create - Generate a GitHub issue from this PR content using AI
/jira-create - Create a SRVKP Jira ticket from this PR content using AI

⚠️ Important: Always review and edit generated content before finalizing tickets/issues.
The AI-generated content should be used as a starting point and may need adjustments.

These commands are available to maintainers and will post the generated content as PR comments for review.

_{🤖 This feedback was generated automatically by the PR CI system}

gemini-code-assist

Code Review

This pull request introduces a useful feature to auto-detect the hub type for custom catalogs when it's not specified. The implementation looks good, and the tests cover the new logic. I have a couple of suggestions to improve code clarity and test robustness.

First, in pkg/params/settings/default.go, there's an opportunity to simplify the logic for auto-detection by removing some redundant code.

Second, in pkg/params/settings/default_test.go, the new test case could be made more robust and comprehensive by using httptest to cover both success and failure scenarios for the API-based detection, avoiding reliance on external network conditions.

Overall, great work on this enhancement!

pkg/params/settings/default.go

pkg/params/settings/default_test.go

zakisk · 2026-01-16T04:44:10Z

@pratap0007 you should fix go-testing failing test.

pkg/params/settings/default.go

zakisk · 2026-01-20T10:12:59Z

/retest go-testing

zakisk · 2026-01-20T10:13:56Z

/test go-testing

chmouel · 2026-01-23T07:29:10Z

@pratap0007 i am confused about what this commits those 😓 can you explain it a bit for me pleaase?

pratap0007 · 2026-01-27T11:17:08Z

@pratap0007 i am confused about what this commits those 😓 can you explain it a bit for me pleaase?

Hi @chmouel, Currently, we always set the catalog type to artifacthub for custom hub catalog. This commit simply checks the hub catalog URL and assigns the custom hub catalog type, following the same behavior we already done to set the default catalog type in this PR

chmouel · 2026-01-27T13:07:01Z

@pratap0007 sounds good, please amend your commit with better details and update the pr description

chmouel · 2026-01-27T13:47:10Z

please read the pr lint feedback as well

we need this for categorization

chmouel · 2026-01-27T13:48:14Z

it may be useful for you to use cursor/gemini to help producing quality commit and pull request description

pkg/params/settings/default_test.go

pratap0007 · 2026-01-28T03:37:47Z

@chmouel thank you for review, I have updated the PR and could you please take another look?

chmouel · 2026-01-28T15:01:16Z

/gemini review

gemini-code-assist

Code Review

This pull request correctly sets the custom hub catalog type by validating the catalog URL via an API call. The changes are logical and well-tested. I've provided a suggestion for improving performance when detecting types for multiple custom catalogs, and another to enhance debuggability by adding logging to the type detection logic, also noting the use of magic numbers and strings.

gemini-code-assist · 2026-01-28T15:04:00Z

pkg/params/settings/default.go

 				catalogType := config[fmt.Sprintf("%s-type", cPrefix)]
 				if catalogType == "" {
-					catalogType = hubtypes.ArtifactHubType // default to artifact hub if not specified
+					catalogType = getHubCatalogTypeViaAPI(config[fmt.Sprintf("%s-url", cPrefix)], httpClient)


This change introduces a network call inside a loop to determine the catalog type. While this works, it could lead to performance issues if there are multiple custom catalogs configured without an explicit type. The calls to getHubCatalogTypeViaAPI are sequential, and each has a 5-second timeout. With N catalogs, this could delay processing by up to N * 5 seconds.

Consider refactoring to perform these network calls in parallel. You could gather all catalogs that need type detection, launch a goroutine for each detection, and wait for them to complete before storing the results. This would significantly improve performance for configurations with many custom catalogs.

let's hope people don't have more than one

chmouel · 2026-01-28T15:05:55Z

pkg/params/settings/default.go

 				catalogType := config[fmt.Sprintf("%s-type", cPrefix)]
 				if catalogType == "" {
-					catalogType = hubtypes.ArtifactHubType // default to artifact hub if not specified
+					catalogType = getHubCatalogTypeViaAPI(config[fmt.Sprintf("%s-url", cPrefix)], httpClient)


let's hope people don't have more than one

chmouel · 2026-01-28T15:06:55Z

pkg/params/settings/default.go


-func getHubCatalogTypeViaAPI(hubURL string) string {
+func getHubCatalogTypeViaAPI(hubURL string, httpClient *http.Client) string {
+	if httpClient == nil {


just pass http.DefaultClient from the caller on line 17 instead of having this condition here?

but then now that i think about you should use r.Clients.HTTP it has many things for security and timeout handling, which mean you need to refactor it to pass it from the initial call to SyncConfig

zakisk · 2026-01-30T07:13:29Z

/retest

chmouel · 2026-02-12T09:22:16Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces a Server-Side Request Forgery (SSRF) vulnerability due to inadequate validation of the hub URL when automatically detecting the hub catalog type via an API call. Additionally, there's a suggestion to improve the readability and simplify the logic for determining the default hub type.

gemini-code-assist · 2026-02-12T09:24:55Z

pkg/params/settings/default.go

 	}

-	resp, err := http.DefaultClient.Do(req)
+	resp, err := httpClient.Do(req)


The function getHubCatalogTypeViaAPI makes an HTTP GET request to a URL constructed from user-controlled configuration (hub-url or custom catalog URLs) without sufficient validation. An attacker who can modify the Pipelines as Code ConfigMap can specify arbitrary internal URLs, leading to a Server-Side Request Forgery (SSRF) vulnerability. This can be used to probe the internal network from the PAC controller or a user's machine running the tknpac CLI.

To remediate this, implement a strict allow-list for hub URLs or validate that the provided URLs do not point to internal, private, or reserved IP addresses. Additionally, ensure that the URL scheme is restricted to http or https.

chmouel · 2026-02-12T09:39:00Z

i have pushed to this PR a fix for the loop, ptal

chmouel · 2026-02-12T09:40:00Z

please use proper conventional commit in your commit message as well.. we need this to generate release note categorization

Earlier, the custom hub catalog type was always set to artifacthub. With this fix, the custom hub catalog URL is validated and correct custom hub catalog type is set accordingly. Signed-off-by: Shiv Verma <shverma@redhat.com>

pratap0007 · 2026-02-12T10:11:49Z

i have pushed to this PR a fix for the loop, ptal

Thank you, @chmouel!

pipelines-as-code bot added enhancement New feature or request fix plumbing labels Jan 5, 2026

gemini-code-assist bot reviewed Jan 5, 2026

View reviewed changes

pkg/params/settings/default.go Outdated Show resolved Hide resolved

pkg/params/settings/default_test.go Show resolved Hide resolved

pratap0007 force-pushed the fix-customhub-catalog-type branch 2 times, most recently from 862aa60 to bdaa5c0 Compare January 15, 2026 11:12

pratap0007 force-pushed the fix-customhub-catalog-type branch from bdaa5c0 to 0febbe2 Compare January 17, 2026 15:42

zakisk reviewed Jan 19, 2026

View reviewed changes

pkg/params/settings/default.go Outdated Show resolved Hide resolved

zakisk force-pushed the fix-customhub-catalog-type branch 4 times, most recently from 5e01e1b to b49aef8 Compare January 20, 2026 10:09

pratap0007 force-pushed the fix-customhub-catalog-type branch from e90afcb to 3bee27c Compare January 27, 2026 13:29

chmouel reviewed Jan 27, 2026

View reviewed changes

pkg/params/settings/default_test.go Outdated Show resolved Hide resolved

pratap0007 changed the title ~~Auto-detect hub type for custom hub catalogs~~ fix: set the correct custom hub catalog type Jan 27, 2026

pratap0007 force-pushed the fix-customhub-catalog-type branch from 3bee27c to 8c02956 Compare January 27, 2026 18:32

gemini-code-assist bot reviewed Jan 28, 2026

View reviewed changes

chmouel reviewed Jan 28, 2026

View reviewed changes

pratap0007 force-pushed the fix-customhub-catalog-type branch from 8c02956 to 7188aa7 Compare January 29, 2026 16:45

chmouel approved these changes Jan 29, 2026

View reviewed changes

gemini-code-assist bot reviewed Feb 12, 2026

View reviewed changes

chmouel force-pushed the fix-customhub-catalog-type branch from 433ad50 to 44b4dde Compare February 12, 2026 09:38

fix: set the correct custom hub catalog type

15f042c

Earlier, the custom hub catalog type was always set to artifacthub. With this fix, the custom hub catalog URL is validated and correct custom hub catalog type is set accordingly. Signed-off-by: Shiv Verma <shverma@redhat.com>

pratap0007 force-pushed the fix-customhub-catalog-type branch from 44b4dde to 15f042c Compare February 12, 2026 10:10

chmouel merged commit c3e12c3 into tektoncd:main Feb 12, 2026
13 checks passed

Conversation

pratap0007 commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📝 Description of the Change

👨🏻‍ Linked Jira

🔗 Linked GitHub Issue

🚀 Type of Change

🧪 Testing Strategy

🤖 AI Assistance

✅ Submitter Checklist

Uh oh!

gemini-code-assist bot commented Jan 5, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

pipelines-as-code bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 PR Lint Feedback

⚠️ Items that need attention:

🤖 AI attribution

ℹ️ Next Steps

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

zakisk commented Jan 16, 2026

Uh oh!

Uh oh!

zakisk commented Jan 20, 2026

Uh oh!

zakisk commented Jan 20, 2026

Uh oh!

chmouel commented Jan 23, 2026

Uh oh!

pratap0007 commented Jan 27, 2026

Uh oh!

chmouel commented Jan 27, 2026

Uh oh!

chmouel commented Jan 27, 2026

Uh oh!

chmouel commented Jan 27, 2026

Uh oh!

Uh oh!

pratap0007 commented Jan 28, 2026

Uh oh!

chmouel commented Jan 28, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

chmouel Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

chmouel Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

chmouel Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

zakisk commented Jan 30, 2026

Uh oh!

chmouel commented Feb 12, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

chmouel commented Feb 12, 2026

Uh oh!

pratap0007 commented Jan 5, 2026 •

edited

Loading

pipelines-as-code bot commented Jan 5, 2026 •

edited

Loading