fix(github): validate repo URL path for scoping by theakshaypant · Pull Request #2514 · tektoncd/pipelines-as-code

theakshaypant · 2026-02-27T10:23:17Z

📝 Description of the Change

Reject Repository CRs with malformed GitHub URLs that include extra
path segments (e.g., https://github.com/org/repo/extra). These URLs
previously passed admission and were truncated during token scoping,
allowing bypass of namespace guards.

Add GitHub Enterprise detection to accurately validate repository
URLs. Detects GHE via Server header and /api/v3/meta endpoint,
then enforces org/repo format without additional path segments.
This prevents malformed URLs during admission and token scoping.

👨🏻‍ Linked Jira

Jira: https://issues.redhat.com/browse/SRVKP-10943

🔗 Linked GitHub Issue

Fixes #2395

🚀 Type of Change

🧪 Testing Strategy

🤖 AI Assistance

I have not used any AI assistance for this PR.
I have used AI assistance for this PR.

If you have used AI assistance, please provide the following details:

Which LLM was used?

Extent of AI Assistance:

Documentation and research only
Unit tests or E2E tests only
Code generation (parts of the code)
Full code generation (most of the PR)
PR description and comments
Commit message(s)

Important

If the majority of the code in this PR was generated by an AI, please add a Co-authored-by trailer to your commit message.
For example:

Co-authored-by: Gemini gemini@google.com
Co-authored-by: ChatGPT noreply@chatgpt.com
Co-authored-by: Claude noreply@anthropic.com
Co-authored-by: Cursor noreply@cursor.com
Co-authored-by: Copilot Copilot@users.noreply.github.com

**💡You can use the script ./hack/add-llm-coauthor.sh to automatically add
these co-author trailers to your commits.

✅ Submitter Checklist

gemini-code-assist · 2026-02-27T10:23:31Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces enhanced validation for repository URLs, specifically targeting GitHub repositories. The primary goal is to enforce a consistent org/repo URL structure for GitHub, which is crucial for correct token scoping and webhook processing. This change ensures that only valid GitHub repository URLs are accepted, while maintaining flexibility for other Git providers that may utilize subgroups in their URL paths.

Highlights

Strict GitHub URL Validation: Implemented strict validation for GitHub repository URLs to ensure they adhere to the org/repo format, disallowing additional path segments (subgroups). This validation is applied during webhook admission and GitHub token scoping.
Provider Type Detection: The system now automatically detects github.com as a GitHub provider for validation purposes. For other hosts, strict validation is only applied if the git_provider.type is explicitly set to "github", allowing other providers like GitLab or Bitbucket to use subgroups.
Refactored Validation Logic: The core URL validation logic has been refactored into a dedicated function, validateRepositoryURL, improving modularity and testability.

Changelog

pkg/provider/github/scope.go
- Enforced that GitHub repository URLs must have exactly two path segments (org/repo) during token scoping.
pkg/test/repository/repository.go
- Introduced GitProviderType field to RepoTestcreationOpts for testing different Git provider types.
- Updated NewRepo function to set the GitProvider.Type based on the new option.
pkg/webhook/validation.go
- Refactored URL validation logic into a new validateRepositoryURL function.
- Implemented strict GitHub URL validation, ensuring org/repo format and auto-detecting github.com.
- Applied strict validation only when the provider is explicitly GitHub or github.com is detected.
pkg/webhook/validation_test.go
- Added comprehensive unit tests for validateRepositoryURL covering various GitHub and non-GitHub URL scenarios, including subgroups.

Activity

Unit tests have been added to cover the new validation logic.
Manual testing is planned (TODO) for this feature.
AI assistance (Claude) was used for generating commit messages.
This PR addresses Jira ticket SRVKP-10943 and fixes GitHub issue Validate Repository URL path for token scoping #2395.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

pipelines-as-code · 2026-02-27T10:23:39Z

🔍 PR Lint Feedback

Note: This automated check helps ensure your PR follows our contribution guidelines.

⚠️ Items that need attention:

🤖 AI attribution

The following commits lack an explicit AI attribution footer:

3aceb05 fix(github): detect GHE instances for URL validation

If no AI assistance was used for a commit, you can ignore this warning.
Otherwise add an Assisted-by: or Co-authored-by: footer referencing the AI used.

ℹ️ Next Steps

Review and address the items above
Push new commits to update this PR
This comment will be automatically updated when issues are resolved

🔧 Admin Tools (click to expand)

Automated Issue/Ticket Creation:

/issue-create - Generate a GitHub issue from this PR content using AI
/jira-create - Create a SRVKP Jira ticket from this PR content using AI

⚠️ Important: Always review and edit generated content before finalizing tickets/issues.
The AI-generated content should be used as a starting point and may need adjustments.

These commands are available to maintainers and will post the generated content as PR comments for review.

_{🤖 This feedback was generated automatically by the PR CI system}

gemini-code-assist

Code Review

This pull request introduces validation for GitHub repository URLs to ensure they follow the org/repo format, applied in the admission webhook and during GitHub token scoping. While the webhook validation is well-designed, the implementation in pkg/provider/github/scope.go is overly strict, leading to a Denial of Service (DoS) vulnerability. This allows a single malformed or non-GitHub repository to break CI/CD pipelines for all GitHub repositories in a shared namespace. To prevent regressions in multi-Git provider environments and mitigate the DoS risk, it is recommended to modify the logic to skip non-conforming repositories during the scoping process instead of returning a terminal error.

pkg/provider/github/scope.go

pkg/webhook/validation.go

pkg/webhook/validation_test.go

pkg/webhook/validation.go

linux-foundation-easycla · 2026-03-12T12:54:55Z

The committers listed above are authorized under a signed CLA.

✅ login: theakshaypant / name: Akshay Pant (3aceb05)

pkg/pipelinerunmetrics/metrics.go

zakisk · 2026-03-13T09:58:12Z

/gemini review

pkg/webhook/validation.go

Reject Repository CRs with malformed GitHub URLs that include extra path segments (e.g., https://github.com/org/repo/extra). These URLs previously passed admission and were truncated during token scoping, allowing bypass of namespace guards. Add GitHub Enterprise detection to accurately validate repository URLs. Detects GHE via Server header and /api/v3/meta endpoint, then enforces org/repo format without additional path segments. This prevents malformed URLs during admission and token scoping. Fixes: tektoncd#2395 Jira: https://issues.redhat.com/browse/SRVKP-10943 Signed-off-by: Akshay Pant <akpant@redhat.com>

zakisk · 2026-03-16T12:49:23Z

/lgtm

pipelines-as-code

Congrats @theakshaypant your PR Has been approved 🎉

✅ Pull Request Approved

Approval Status:

Required Approvals: 1
Current Approvals: 1

👥 Reviewers Who Approved:

Reviewer	Permission Level	Approval Status
@zakisk	`write`	✅

📝 Next Steps

Ensure all required checks pass
Comply with branch protection rules
Request a maintainer to merge using the /merge command (or merge it
directly if you have repository permission).

Automated by the PAC Boussole 🧭

pipelines-as-code bot added feature New feature or request github testing labels Feb 27, 2026

gemini-code-assist bot reviewed Feb 27, 2026

View reviewed changes

pkg/provider/github/scope.go Outdated Show resolved Hide resolved

theakshaypant force-pushed the SRVKP-10943-validate-repo-url branch from ee6f8bd to 7c6069c Compare February 27, 2026 11:12

theakshaypant commented Feb 27, 2026

View reviewed changes

pkg/webhook/validation.go Outdated Show resolved Hide resolved

pkg/webhook/validation_test.go Outdated Show resolved Hide resolved

theakshaypant changed the title ~~feat(validation): add GitHub URL validation~~ fix(githhub): validate repo URL path for scoping Mar 10, 2026

theakshaypant changed the title ~~fix(githhub): validate repo URL path for scoping~~ fix(github): validate repo URL path for scoping Mar 10, 2026

theakshaypant force-pushed the SRVKP-10943-validate-repo-url branch 4 times, most recently from 54d2be1 to 15b4238 Compare March 11, 2026 08:53

zakisk reviewed Mar 11, 2026

View reviewed changes

pkg/webhook/validation.go Show resolved Hide resolved

zakisk reviewed Mar 11, 2026

View reviewed changes

pkg/webhook/validation.go Outdated Show resolved Hide resolved

theakshaypant marked this pull request as ready for review March 11, 2026 10:44

theakshaypant force-pushed the SRVKP-10943-validate-repo-url branch 3 times, most recently from f36aa55 to 4563b52 Compare March 12, 2026 12:54

theakshaypant force-pushed the SRVKP-10943-validate-repo-url branch from 4563b52 to 2be49fd Compare March 12, 2026 13:14

theakshaypant commented Mar 12, 2026

View reviewed changes

pkg/pipelinerunmetrics/metrics.go Show resolved Hide resolved

theakshaypant closed this Mar 12, 2026

theakshaypant reopened this Mar 12, 2026

theakshaypant closed this Mar 12, 2026

theakshaypant reopened this Mar 12, 2026

theakshaypant closed this Mar 12, 2026

theakshaypant reopened this Mar 12, 2026

theakshaypant force-pushed the SRVKP-10943-validate-repo-url branch from 2be49fd to 1c6db5f Compare March 12, 2026 15:16

zakisk reviewed Mar 13, 2026

View reviewed changes

pkg/webhook/validation.go Outdated Show resolved Hide resolved

theakshaypant force-pushed the SRVKP-10943-validate-repo-url branch from ee25de6 to 3aceb05 Compare March 16, 2026 09:40

pipelines-as-code bot approved these changes Mar 16, 2026

View reviewed changes

zakisk merged commit de692ba into tektoncd:main Mar 16, 2026
15 checks passed

theakshaypant deleted the SRVKP-10943-validate-repo-url branch March 16, 2026 13:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(github): validate repo URL path for scoping#2514

fix(github): validate repo URL path for scoping#2514
zakisk merged 1 commit intotektoncd:mainfrom
theakshaypant:SRVKP-10943-validate-repo-url

theakshaypant commented Feb 27, 2026 •

edited

Loading

Uh oh!

gemini-code-assist bot commented Feb 27, 2026

Uh oh!

pipelines-as-code bot commented Feb 27, 2026 •

edited

Loading

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

linux-foundation-easycla bot commented Mar 12, 2026 •

edited

Loading

Uh oh!

Uh oh!

zakisk commented Mar 13, 2026

Uh oh!

Uh oh!

zakisk commented Mar 16, 2026

Uh oh!

pipelines-as-code bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

theakshaypant commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📝 Description of the Change

👨🏻‍ Linked Jira

🔗 Linked GitHub Issue

🚀 Type of Change

🧪 Testing Strategy

🤖 AI Assistance

✅ Submitter Checklist

Uh oh!

gemini-code-assist bot commented Feb 27, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

pipelines-as-code bot commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 PR Lint Feedback

⚠️ Items that need attention:

🤖 AI attribution

ℹ️ Next Steps

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

linux-foundation-easycla bot commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

zakisk commented Mar 13, 2026

Uh oh!

Uh oh!

zakisk commented Mar 16, 2026

Uh oh!

pipelines-as-code bot left a comment

Choose a reason for hiding this comment

✅ Pull Request Approved

👥 Reviewers Who Approved:

📝 Next Steps

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

theakshaypant commented Feb 27, 2026 •

edited

Loading

pipelines-as-code bot commented Feb 27, 2026 •

edited

Loading

linux-foundation-easycla bot commented Mar 12, 2026 •

edited

Loading