Skip to content

feat:wildcard repository url#2733

Closed
johnvox wants to merge 1 commit into
tektoncd:mainfrom
johnvox:feat-wildcard-repository-url
Closed

feat:wildcard repository url#2733
johnvox wants to merge 1 commit into
tektoncd:mainfrom
johnvox:feat-wildcard-repository-url

Conversation

@johnvox
Copy link
Copy Markdown

@johnvox johnvox commented May 15, 2026

📝 Description of the Change

This change introduce posibility to match repository over glob or regex pattern making able to setup a single repository cr to handle set of repositories

🔗 Linked GitHub Issue

Fixes #1246

🧪 Testing Strategy

  • Unit tests
  • Integration tests
  • End-to-end tests
  • Manual testing

🤖 AI Assistance

AI assistance can be used for various tasks, such as code generation,
documentation, or testing.

Please indicate whether you have used AI assistance
for this PR and provide details if applicable.

  • I have not used any AI assistance for this PR.
  • I have used AI assistance for this PR.

Important

Slop will be simply rejected, if you are using AI assistance you need to make sure you
understand the code generated and that it meets the project's standards. you
need at least know how to run the code and deploy it (if needed). See
startpaac to make it easy
to deploy and test your code changes.

If the majority of the code in this PR was generated by an AI, please add a Co-authored-by trailer to your commit message.
For example:

Co-authored-by: Claude noreply@anthropic.com

✅ Submitter Checklist

  • 📝 My commit messages are clear, informative, and follow the project's How to write a git commit message guide. The Gitlint linter ensures in CI it's properly validated
  • ✨ I have ensured my commit message prefix (e.g., fix:, feat:) matches the "Type of Change" I selected above.
  • ♽ I have run make test and make lint locally to check for and fix any
    issues. For an efficient workflow, I have considered installing
    pre-commit and running pre-commit install to
    automate these checks.
  • 📖 I have added or updated documentation for any user-facing changes.
  • 🧪 I have added sufficient unit tests for my code changes.
  • 🎁 I have added end-to-end tests where feasible. See README for more details.
  • 🔎 I have addressed any CI test flakiness or provided a clear reason to bypass it.
  • If adding a provider feature, I have filled in the following and updated the provider documentation:
    • GitHub App
    • GitHub Webhook
    • Gitea/Forgejo
    • GitLab
    • Bitbucket Cloud
    • Bitbucket Data Center

@linux-foundation-easycla
Copy link
Copy Markdown

linux-foundation-easycla Bot commented May 15, 2026

CLA Signed
The committers listed above are authorized under a signed CLA.

Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces support for glob and regex patterns when matching and validating repository URLs. The review feedback highlights several critical issues: the regex implementation is vulnerable to ReDoS and uses incorrect substring matching, the validation logic is too permissive because literal strings often compile as valid patterns, and URL normalization needs to be more robust. It is recommended to remove regex support in favor of glob matching, improve normalization using strings.TrimSpace and strings.TrimRight, and refine the GitHub path segment check to only trigger when wildcards are absent.

Comment on lines +97 to +118
// matchTarget checks if a branch matches a target pattern using glob matching.
// Supports both exact string matching and glob patterns.
func matchRepo(repo, target string) (bool, error) {
if target == repo {
return true, nil
}
// Check unix glob match
globPattern, err := glob.Compile(target)
if err != nil {
return false, err
}
if globPattern.Match(repo) {
return true, nil
}
// Check regex match
if reMatch, err := regexp.MatchString(target, repo); err != nil {
return false, err
} else if reMatch {
return true, nil
}
return false, nil
}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The implementation of matchRepo has several critical issues:

  1. Incorrect Matching Logic: regexp.MatchString performs substring matching by default. For repository matching, you should use full-string matching.
  2. Redundancy and Security: The glob library is sufficient and safer. Regular expressions are prone to ReDoS. Per project rules, if regular expressions are used, they must be sanitized at a centralized point, but removing regex entirely in favor of glob is preferred here.
  3. Performance: Compiling patterns inside a loop for every event is inefficient.

I suggest removing the regexp support and sticking to glob for wildcard matching.

// matchRepo checks if a repository URL matches a target pattern using glob matching.
// Supports both exact string matching and glob patterns.
func matchRepo(repo, target string) (bool, error) {
	if target == repo {
		return true, nil
	}
	// Check unix glob match
	globPattern, err := glob.Compile(target)
	if err != nil {
		return false, fmt.Errorf("invalid glob pattern %q: %w", target, err)
	}
	return globPattern.Match(repo), nil
}
References
  1. Sanitize user-provided input for components like regular expressions at a centralized point to avoid redundant sanitization logic.

Comment thread pkg/webhook/validation.go Outdated
Comment thread pkg/webhook/validation.go Outdated
@johnvox johnvox force-pushed the feat-wildcard-repository-url branch 2 times, most recently from 30da1fa to 679d058 Compare May 15, 2026 20:28
@johnvox johnvox force-pushed the feat-wildcard-repository-url branch from 679d058 to b064dc4 Compare May 16, 2026 05:40
@johnvox johnvox closed this May 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Allow wildcard URL matching in repository CR

1 participant