Skip to content

feat(repo-info): capture VCS namespace hierarchy (Azure full paths, finer providers, namespace_path) #1021

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
FayeSGW merged 3 commits into from
Jul 16, 2026
Merged

feat(repo-info): capture VCS namespace hierarchy (Azure full paths, finer providers, namespace_path) #1021

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b5abc3b
feat(repo-info): compose full namespace path for Azure DevOps repos
FayeSGW Jul 14, 2026
5edde80
feat(repo-info): send finer VCS provider values for Azure DevOps and …
FayeSGW Jul 14, 2026
d0e8429
feat(repo-info): send explicit namespace_path and additional_info
FayeSGW Jul 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion cmd/kosli/attestArtifact_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,7 @@ func (suite *AttestArtifactCommandTestSuite) TestAttestArtifactCmd() {
wantError: true,
name: "fails when --repo-provider is not an allowed value",
cmd: fmt.Sprintf("attest artifact testdata/file1 --fingerprint 7509e5bda0c762d2bac7f90d758b5b2263fa01ccbc542ab5e3df163be08e6ca9 --name cli --commit HEAD --build-url http://www.example.com --commit-url http://www.example.com --repo-provider jenkins %s", suite.defaultKosliArguments),
golden: "Error: --repo-provider 'jenkins' is not allowed. Must be one of: github, gitlab, bitbucket, azure-devops\n",
golden: "Error: --repo-provider 'jenkins' is not allowed. Must be one of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server\n",
},
{
name: "can attest with all repo flags",
Expand Down
2 changes: 1 addition & 1 deletion cmd/kosli/attestGeneric_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,7 +183,7 @@ func (suite *AttestGenericCommandTestSuite) TestAttestGenericCmd() {
wantError: true,
name: "fails when --repo-provider is not an allowed value",
cmd: fmt.Sprintf("attest generic --name foo --fingerprint 7509e5bda0c762d2bac7f90d758b5b2263fa01ccbc542ab5e3df163be08e6ca9 --repo-provider jenkins %s", suite.defaultKosliArguments),
golden: "Error: --repo-provider 'jenkins' is not allowed. Must be one of: github, gitlab, bitbucket, azure-devops\n",
golden: "Error: --repo-provider 'jenkins' is not allowed. Must be one of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server\n",
},
{
name: "can attest with all repo flags",
Expand Down
2 changes: 1 addition & 1 deletion cmd/kosli/attestOverride_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,7 @@ func (suite *AttestOverrideCommandTestSuite) TestAttestOverrideCmd() {
wantError: true,
name: "fails when --repo-provider is not an allowed value",
cmd: fmt.Sprintf("attest override --name foo --fingerprint 7509e5bda0c762d2bac7f90d758b5b2263fa01ccbc542ab5e3df163be08e6ca9 --reason r --original-attestation-type generic --new-compliance-status=true --repo-provider jenkins %s", suite.defaultKosliArguments),
golden: "Error: --repo-provider 'jenkins' is not allowed. Must be one of: github, gitlab, bitbucket, azure-devops\n",
golden: "Error: --repo-provider 'jenkins' is not allowed. Must be one of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server\n",
},
{
name: "can override an attestation against a trail (compliant)",
Expand Down
2 changes: 1 addition & 1 deletion cmd/kosli/attestPRAzure_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,7 +129,7 @@ func (suite *AttestAzurePRCommandTestSuite) TestAttestAzurePRCmd() {
wantError: true,
name: "15 fails when --repo-provider is not an allowed value",
cmd: fmt.Sprintf("attest pullrequest azure --name foo --commit HEAD --azure-token fake --azure-org-url https://dev.azure.com/myorg --project myproject --repository myrepo --repo-provider jenkins %s", suite.defaultKosliArguments),
golden: "Error: --repo-provider 'jenkins' is not allowed. Must be one of: github, gitlab, bitbucket, azure-devops\n",
golden: "Error: --repo-provider 'jenkins' is not allowed. Must be one of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server\n",
},
{
wantError: true,
Expand Down
2 changes: 1 addition & 1 deletion cmd/kosli/attestPRBitbucket_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,7 +168,7 @@ func (suite *AttestBitbucketPRCommandTestSuite) TestAttestBitbucketPRCmd() {
wantError: true,
name: "18 fails when --repo-provider is not an allowed value",
cmd: fmt.Sprintf("attest pullrequest bitbucket --name foo --commit %s --bitbucket-access-token fake --bitbucket-workspace myworkspace --repository myrepo --repo-provider jenkins %s", suite.commitWithPR, suite.defaultKosliArguments),
golden: "Error: --repo-provider 'jenkins' is not allowed. Must be one of: github, gitlab, bitbucket, azure-devops\n",
golden: "Error: --repo-provider 'jenkins' is not allowed. Must be one of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server\n",
},
{
wantError: true,
Expand Down
2 changes: 1 addition & 1 deletion cmd/kosli/attestPRGithub_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,7 @@ func (suite *AttestGithubPRCommandTestSuite) TestAttestGithubPRCmd() {
wantError: true,
name: "19 fails when --repo-provider is not an allowed value",
cmd: fmt.Sprintf("attest pullrequest github --name foo --commit %s --github-org myorg --repository myrepo --repo-provider jenkins %s", suite.commitWithPR, suite.defaultKosliArguments),
golden: "Error: --repo-provider 'jenkins' is not allowed. Must be one of: github, gitlab, bitbucket, azure-devops\n",
golden: "Error: --repo-provider 'jenkins' is not allowed. Must be one of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server\n",
},
{
wantError: true,
Expand Down
2 changes: 1 addition & 1 deletion cmd/kosli/attestPRGitlab_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,7 +161,7 @@ func (suite *AttestGitlabPRCommandTestSuite) TestAttestGitlabPRCmd() {
wantError: true,
name: "17 fails when --repo-provider is not an allowed value",
cmd: fmt.Sprintf("attest pullrequest gitlab --name foo --commit %s --gitlab-token fake --gitlab-org myorg --repository myrepo --repo-provider jenkins %s", suite.commitWithPR, suite.defaultKosliArguments),
golden: "Error: --repo-provider 'jenkins' is not allowed. Must be one of: github, gitlab, bitbucket, azure-devops\n",
golden: "Error: --repo-provider 'jenkins' is not allowed. Must be one of: github, gitlab, bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server\n",
},
{
wantError: true,
Expand Down
137 changes: 122 additions & 15 deletions cmd/kosli/attestation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,7 +148,9 @@ func mergeGitRepoInfo(base *gitview.GitRepoInfo, repoID, repoName, repoURL, repo
}

var allowedRepoProviders = map[string]struct{}{
"github": {}, "gitlab": {}, "bitbucket": {}, "azure-devops": {},
"github": {}, "gitlab": {},
"bitbucket": {}, "bitbucket_cloud": {}, "bitbucket_dc": {},
"azure-devops": {}, "azure_devops_services": {}, "azure_devops_server": {},
}

func validateRepoFlags(repoURL, repoProvider string, validateURL bool) error {
Expand All @@ -160,7 +162,8 @@ func validateRepoFlags(repoURL, repoProvider string, validateURL bool) error {
}
if repoProvider != "" {
if _, ok := allowedRepoProviders[repoProvider]; !ok {
return fmt.Errorf("--repo-provider '%s' is not allowed. Must be one of: github, gitlab, bitbucket, azure-devops", repoProvider)
return fmt.Errorf("--repo-provider '%s' is not allowed. Must be one of: github, gitlab, "+
"bitbucket, bitbucket_cloud, bitbucket_dc, azure-devops, azure_devops_services, azure_devops_server", repoProvider)
}
}
return nil
Expand Down Expand Up @@ -280,30 +283,134 @@ func getGitRepoInfoFromGitHub() *gitview.GitRepoInfo {

func getGitRepoInfoFromGitLab() *gitview.GitRepoInfo {
return &gitview.GitRepoInfo{
URL: os.Getenv("CI_PROJECT_URL"),
Name: os.Getenv("CI_PROJECT_PATH"),
ID: os.Getenv("CI_PROJECT_ID"),
Description: os.Getenv("CI_PROJECT_DESCRIPTION"),
Provider: "gitlab",
URL: os.Getenv("CI_PROJECT_URL"),
Name: os.Getenv("CI_PROJECT_PATH"),
ID: os.Getenv("CI_PROJECT_ID"),
Description: os.Getenv("CI_PROJECT_DESCRIPTION"),
Provider: "gitlab",
NamespacePath: splitNonEmpty(os.Getenv("CI_PROJECT_NAMESPACE")),
}
}

func getGitRepoInfoFromBitbucket() *gitview.GitRepoInfo {
repoFullName := os.Getenv("BITBUCKET_REPO_FULL_NAME")
workspace, _, _ := strings.Cut(repoFullName, "/")

var additionalInfo map[string]interface{}
if projectKey := os.Getenv("BITBUCKET_PROJECT_KEY"); projectKey != "" {
additionalInfo = map[string]interface{}{"project_key": projectKey}
}

return &gitview.GitRepoInfo{
URL: os.Getenv("BITBUCKET_GIT_HTTP_ORIGIN"),
Name: os.Getenv("BITBUCKET_REPO_FULL_NAME"),
ID: os.Getenv("BITBUCKET_REPO_UUID"),
Provider: "bitbucket",
URL: os.Getenv("BITBUCKET_GIT_HTTP_ORIGIN"),
Name: repoFullName,
ID: os.Getenv("BITBUCKET_REPO_UUID"),
// Bitbucket Pipelines (the only CI this WhichCI() branch detects, via
// BITBUCKET_BUILD_NUMBER) exists for Bitbucket Cloud only, so this is
// a known fact rather than a heuristic. Self-hosted Data Center users
// run a different CI and must pass --repo-provider bitbucket_dc themselves.
Provider: "bitbucket_cloud",

@mbevc1 mbevc1 Jul 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if this is just GH diff rendering or is this an intentional switch from bitbucket to bitbucket_cloud provider?

@FayeSGW FayeSGW Jul 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If I understand correctly, Bitbucket Cloud is the only Bitbucket CI/CD, so if we've detected Bitbucket as the CI it must be Cloud.
(Bitbucket Data Centre appears to require integration with an external CI/CD tool)

@tooky tooky Jul 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This all gets a bit tangled for me:

  • We can use Bitbucket Cloud repos with Bitbucket Cloud runners
  • We can use Bitbucket Cloud repos with Jenkins/Bamboo/CircleCI/etc runners
  • We can use Bitbucket DC repos with Jenkins/Bamboo/CircleCI/etc runners

This mean we need to understand from the runner which VSC provider we are using? Some runners are tied to the VCS (e.g. Github, Gitlab ???), others aren't - the unbundled ones.

@FayeSGW FayeSGW Jul 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I think so...but I think we only extract repo info from some of them (specifically Github, Gitlab, Bitbucket, Azure, and apparently CircleCI, but I don't think we actually use that anywhere).
So for any other CI system, the user will need to provide us with the repo info via flags, if I'm understanding it right.

@FayeSGW FayeSGW Jul 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But the more I look at all of this the more confusing it seems to get

@FayeSGW FayeSGW Jul 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, back out of the rabbit hole.
Out of the 4 CIs we get repo info from:

  • Github and Bitbucket Cloud are bundled (so the CI and repo will always match).
  • Bitbucket Data Center doesn't have it's own CI pipeline, so it will never be detected by the CLI.
  • Gitlab can act as an CI system for external repos, but it does this by creating a Gitlab-mirror of the project, and the pipeline runs against that mirror - so the repo being analysed is actually in Gitlab.
  • Azure Pipelines are the only one where the CI and repos can be genuinely decoupled, and we've got handling for that in another PR.

For any other CI system, we don't automatically get repo info, so the user has to provide it directly, and it's therefore on them to get it right.

// Bitbucket's workspace is the only path segment ahead of the repo itself
// (the project key is a separate, non-hierarchical grouping within a
// workspace, so it goes in AdditionalInfo rather than NamespacePath).
NamespacePath: splitNonEmpty(workspace),
AdditionalInfo: additionalInfo,
}
}

func getGitRepoInfoFromAzureDevops() *gitview.GitRepoInfo {
return &gitview.GitRepoInfo{
URL: os.Getenv("BUILD_REPOSITORY_URI"),
Name: os.Getenv("BUILD_REPOSITORY_NAME"),
ID: os.Getenv("BUILD_REPOSITORY_ID"),
Provider: "azure-devops",
URL: os.Getenv("BUILD_REPOSITORY_URI"),
Name: azureFullPathRepoName(),
ID: os.Getenv("BUILD_REPOSITORY_ID"),
Provider: azureDevopsProvider(),
NamespacePath: azureNamespacePath(),
}
}

// splitNonEmpty splits s on "/", returning nil for an empty string so the
// NamespacePath field is omitted from the JSON payload rather than sent as [""].
func splitNonEmpty(s string) []string {
if s == "" {
return nil
}
return strings.Split(s, "/")
}

// azureDevopsProvider refines the coarse "azure-devops" provider to
// azure_devops_services or azure_devops_server based on SYSTEM_COLLECTIONURI's
// host (dev.azure.com / *.visualstudio.com are cloud-hosted Services;
// anything else is on-prem Server). Falls back to the coarse value when the
// collection URI is missing or has no host, so the server's own URL-based
// derivation fallback still applies.
func azureDevopsProvider() string {
parsed, err := url.Parse(os.Getenv("SYSTEM_COLLECTIONURI"))
if err != nil || parsed.Host == "" {
return "azure-devops"
}
host := strings.ToLower(parsed.Host)
if host == "dev.azure.com" || strings.HasSuffix(host, ".visualstudio.com") {
return "azure_devops_services"
}
return "azure_devops_server"
}

// azureFullPathRepoName composes the full namespace path for an Azure DevOps
// repo (`Collection/Project/repo` on-prem, `Org/Project/repo` in Services)
// from SYSTEM_COLLECTIONURI and SYSTEM_TEAMPROJECT, since BUILD_REPOSITORY_NAME
// alone is just the bare repo name. Falls back to the bare name if either
// piece is unavailable, so unupgraded setups degrade gracefully.
func azureFullPathRepoName() string {
repoName := os.Getenv("BUILD_REPOSITORY_NAME")
collection, teamProject, ok := azureCollectionAndProject()
if !ok {
return repoName
}
return fmt.Sprintf("%s/%s/%s", collection, teamProject, repoName)
Comment thread
FayeSGW marked this conversation as resolved.
}

// azureNamespacePath returns the [collection, project] path ahead of the repo
// name itself, or nil when either piece is unavailable.
func azureNamespacePath() []string {
collection, teamProject, ok := azureCollectionAndProject()
if !ok {
return nil
}
return []string{collection, teamProject}
}

// azureCollectionAndProject extracts the collection/org name and
// SYSTEM_TEAMPROJECT. ok is false if either piece is missing or
// SYSTEM_COLLECTIONURI can't be parsed into a non-empty collection.
//
// On *.visualstudio.com hosts (the legacy Services URL format) the org name
// is the subdomain, not a path segment - e.g. https://fabrikam.visualstudio.com/
// has an empty path. Everywhere else (dev.azure.com/MyOrg, on-prem Server
// collection URIs) the collection is the last path segment.
func azureCollectionAndProject() (collection, teamProject string, ok bool) {
teamProject = os.Getenv("SYSTEM_TEAMPROJECT")
collectionURI := os.Getenv("SYSTEM_COLLECTIONURI")
if teamProject == "" || collectionURI == "" {
return "", "", false
}

parsed, err := url.Parse(collectionURI)
if err != nil || parsed.Host == "" {
return "", "", false
}

if host := strings.ToLower(parsed.Host); strings.HasSuffix(host, ".visualstudio.com") {
collection = strings.TrimSuffix(host, ".visualstudio.com")
return collection, teamProject, collection != ""
}

segments := strings.Split(strings.Trim(parsed.Path, "/"), "/")
collection = segments[len(segments)-1]
if collection == "" {
return "", "", false
}

return collection, teamProject, true
}

func getGitRepoInfoFromCircleci() *gitview.GitRepoInfo {
Expand Down
Loading
Loading