fix: Handle non-http(s) URLs in assembleTaskFQDNs by chmouel · Pull Request #2486 · tektoncd/pipelines-as-code

chmouel · 2026-02-17T21:23:04Z

📝 Description of the Change

Added validation to the assembleTaskFQDNs function to ensure that only HTTP(S) URLs are used as a base for resolving relative task URLs. Previously, the function would attempt to resolve relative paths against any URL scheme, including custom catalog references (e.g., foo://python-build-test-tag-bar:1.2), which led to incorrect URL resolution.

The fix adds a case-insensitive check that returns tasks unchanged when the pipeline URL uses a non-HTTP(S) scheme, since relative path resolution is only meaningful for HTTP(S) URLs.

Changes:

Added scheme validation in pkg/resolve/remote.go (assembleTaskFQDNs:36-41)
Added comprehensive unit tests covering hub catalogs, empty URLs, and HTTP(S) URLs with various casings

👨🏻‍ Linked Jira

https://issues.redhat.com/browse/SRVKP-10880

🔗 Linked GitHub Issue

N/A

🚀 Type of Change

🧪 Testing Strategy

🤖 AI Assistance

I have not used any AI assistance for this PR.
I have used AI assistance for this PR.

Which LLM was used?

Extent of AI Assistance:

Documentation and research only
Unit tests or E2E tests only
Code generation (parts of the code)
Full code generation (most of the PR)
PR description and comments
Commit message(s)

✅ Submitter Checklist

gemini-code-assist · 2026-02-17T21:23:22Z

Summary of Changes

Hello @chmouel, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the URL resolution logic by introducing a safeguard that ensures relative task URLs are only processed against HTTP(S) base URLs. This prevents misinterpretation of non-web-based schemes, such as custom catalog references, thereby improving the reliability and correctness of how task URLs are assembled within the system.

Highlights

URL Scheme Validation: Implemented a check within the assembleTaskFQDNs function to ensure that relative task URLs are only resolved when the pipelineURL uses an HTTP or HTTPS scheme. This prevents incorrect resolution for non-standard URL schemes.
Improved Robustness: The change prevents potential issues when dealing with custom catalog references or other non-HTTP(S) URL types, where relative path resolution would be meaningless or lead to errors.
Comprehensive Testing: Added a new set of unit tests for assembleTaskFQDNs covering various scenarios, including HTTP, HTTPS, custom schemes, empty URLs, and case-insensitive scheme matching, to ensure the new logic works as expected.

Changelog

pkg/resolve/remote.go
- Added a check to assembleTaskFQDNs to only resolve relative task URLs if the pipelineURL is HTTP or HTTPS.
- Imported the strings package for case-insensitive URL scheme comparison.
pkg/resolve/remote_test.go
- Added a new test function TestAssembleTaskFQDNs to validate the behavior of URL resolution with various schemes and relative paths.

Activity

The pull request was opened by chmouel to address a bug related to URL resolution (Jira: SRVKP-10880).
The author has indicated that unit tests were added as part of this change.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request correctly addresses an issue where non-http(s) URLs were not handled properly when resolving relative task URLs. The added check in assembleTaskFQDNs prevents incorrect resolution for custom catalog references. The new unit tests in TestAssembleTaskFQDNs are comprehensive and cover various URL schemes and cases. I have one suggestion to refactor the implementation to be more robust and idiomatic by leveraging url.Parse to check the URL scheme, which also simplifies the code by removing an unnecessary import. Additionally, consider defining constants for the URL schemes to improve maintainability.

pkg/resolve/remote.go

Copilot

Pull request overview

This PR updates remote task URL resolution so that assembleTaskFQDNs only uses HTTP(S) pipeline references as the base for resolving relative task references, preventing mis-resolution when the pipeline reference uses a non-standard scheme (e.g., custom hub catalogs).

Changes:

Add an early guard in assembleTaskFQDNs to skip relative task URL assembly unless the pipeline reference is HTTP(S).
Add unit tests covering HTTP(S), mixed-case schemes, empty pipeline URL, and non-HTTP(S) schemes.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`pkg/resolve/remote.go`	Adds HTTP(S)-only gate before attempting to parse/join task URLs.
`pkg/resolve/remote_test.go`	Adds table-driven tests for `assembleTaskFQDNs` covering non-HTTP(S) and mixed-case HTTP(S) inputs.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/resolve/remote.go

pkg/resolve/remote_test.go

Added a check to ensure that only http(s) URLs are used as a base for resolving relative task URLs. This prevents incorrect resolution when dealing with custom catalog references or other non-standard URL schemes. Jira: https://issues.redhat.com/browse/SRVKP-10880 Signed-off-by: Chmouel Boudjnah <chmouel@redhat.com>

Copilot AI review requested due to automatic review settings February 17, 2026 21:23

Copilot started reviewing on behalf of chmouel February 17, 2026 21:23 View session

gemini-code-assist bot reviewed Feb 17, 2026

View reviewed changes

pkg/resolve/remote.go Show resolved Hide resolved

Copilot AI reviewed Feb 17, 2026

View reviewed changes

pkg/resolve/remote.go Show resolved Hide resolved

pkg/resolve/remote_test.go Show resolved Hide resolved

chmouel force-pushed the SRVKP-10880-resolve-relative-task-urls branch from a9e0fb8 to 56355f3 Compare February 17, 2026 21:41

theakshaypant approved these changes Feb 18, 2026

View reviewed changes

chmouel merged commit 4bd6ab8 into tektoncd:main Feb 18, 2026
10 checks passed

chmouel deleted the SRVKP-10880-resolve-relative-task-urls branch February 18, 2026 09:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: Handle non-http(s) URLs in assembleTaskFQDNs#2486

fix: Handle non-http(s) URLs in assembleTaskFQDNs#2486
chmouel merged 1 commit intotektoncd:mainfrom
chmouel:SRVKP-10880-resolve-relative-task-urls

chmouel commented Feb 17, 2026 •

edited

Loading

Uh oh!

gemini-code-assist bot commented Feb 17, 2026 •

edited by chmouel

Loading

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

chmouel commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📝 Description of the Change

👨🏻‍ Linked Jira

🔗 Linked GitHub Issue

🚀 Type of Change

🧪 Testing Strategy

🤖 AI Assistance

✅ Submitter Checklist

Uh oh!

gemini-code-assist bot commented Feb 17, 2026 • edited by chmouel Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

chmouel commented Feb 17, 2026 •

edited

Loading

gemini-code-assist bot commented Feb 17, 2026 •

edited by chmouel

Loading