Added FQDN support for packages by richgo · Pull Request #25 · microsoft/apm

Rich James (richgo) · 2025-11-05T21:53:09Z

Pull Request

⚡ Quick Start - Use Specialized Templates

For better guidance, consider using our specialized templates:

🚀 New Feature: Create Feature PR
🐛 Bug Fix: Create Bug Fix PR
📖 Documentation: Create Docs PR
🔧 Maintenance: Create Maintenance PR

Description

This change enables packages with fully qualified domain names to be used. This enables both packages from github.com and other git repos (e.g. GitHub enterprise) to be used within the same package dependency tree.

Type of Change

🏷️ IMPORTANT: Apply the appropriate label after creating this PR:

🚀 New Feature → Apply label: enhancement or feature
🐛 Bug Fix → Apply label: bug or fix
📖 Documentation → Apply label: documentation or docs
🔧 Other Changes → No specific label needed
🚫 Exclude from Release Notes → Apply label: ignore-for-release

Testing

Tested locally
All existing tests pass
Added tests for new functionality (if applicable)

Checklist

✅ LABEL APPLIED: I have applied the appropriate label to this PR
Code follows project style guidelines
Updated documentation if needed
Updated CHANGELOG.md for significant changes

Fixes # (issue)

This reverts commit 73dcb38.

This reverts commit c5ac252.

Daniel Meppiel (danielmeppiel) · 2025-11-06T21:42:17Z

Rich James (@richgo) thanks for spotting the bug, bare package names (e.g., team/package) should respect the GITHUB_HOST environment variable, not fallback to hardcoded github.com. I missed that one and did not test thoroughly.

Minor change needed here, could you update the PR to use default_host() instead of hardcoding github.com? That would make:

Bare packages respect GITHUB_HOST:

export GITHUB_HOST=internal.company.com
apm install team/package # → internal.company.com/team/package

FQDN packages override everything (for mixing hosts):

apm install partner.ghe.com/external/integration # → partner.ghe.com/...

This gives us the best of both worlds and is architecturally consistent with the existing GITHUB_HOST env var.

Rich James (richgo) · 2025-11-07T07:13:56Z

Done!

@richgo

- FQDN support for any Git host - Security fix for CWE-20 URL validation vulnerability - Package validation HTTPS URL fix - Virtual package orphan detection fix - GitHub Enterprise support via GITHUB_HOST Credits @richgo for FQDN and GitHub Enterprise support (PR #25)

@pofallon

…#1073) * docs(notice): rename NOTICE.md -> NOTICE; add CLA third-party section Two changes, one file rename: 1. Rename NOTICE.md -> NOTICE, matching the Apache / CNCF convention used by upstream third-party-attribution files (kubernetes-sigs/kro, kubernetes-sigs/headlamp, etc.). The .md extension was non-idiomatic for a generated legal artifact -- NOTICE files are read by tooling (license scanners, SBOM generators) that match on the bare filename. Generator (scripts/generate-notice.py), Makefile target, and the NOTICE Drift Check workflow are all updated to operate on the extension-less path. 2. Add a 'Submitted on behalf of a third-party' section to NOTICE, crediting five contributors whose pull requests landed before the microsoft-github-policy-service CLA bot recorded a signature on file. The repo transferred from danielmeppiel/awd-cli to the microsoft org; some early PRs predate CLA enforcement, and we could not retroactively reach all contributors. Mirrors section 7 of common CLA texts (the wording adopted by CNCF NOTICE files). Driven by a new _third_party_submissions block in scripts/notice-metadata.yaml -- legally-significant wording stays alongside the per-component data, not buried in code. Contributors named (verified via Check Runs API against the microsoft-github-policy-service app, license/cla check on every merged PR by each suspected author): - @pofallon (PR #4) - @richgo (PRs #8, #25, #26, #33, #34) - @ryanfk (PR #92 -- bot ran with conclusion=null, output: 'Contributor License Agreement is not agreed yet.') - @foutoucour (PR #108) - @Jah-yee (PR #184) Listed contributors who later sign the CLA (or who were signed under a different GitHub account at the time) can request removal via issue. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs(notice): trim third-party section preamble Strip the historical/CNCF-citation paragraph and the verbatim CLA-section-7 quote. Keep only the active sentence (what the listing means + how to request removal). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs(notice): address PR #1073 review Three fixes from copilot-pull-request-reviewer: 1. Drop spurious leading '---' separator in the third-party-submissions renderer. render_component already ends each component with '---\n\n', so prepending another '---' produced two consecutive separators in NOTICE. Verified: separator count dropped from 17 to 16. 2. Sweep stale 'NOTICE.md' references in scripts/generate-notice.py (top-level docstring, Modes section, ComponentMeta and DepSpec field docstrings). The constant was renamed; the docs lagged. 3. Append (#1073) PR refs to both CHANGELOG entries; ASCII-correct the arrow ('->' instead of '->'). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <copilot-rework@github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Added FQDN support for packages

@richgo

- FQDN support for any Git host - Security fix for CWE-20 URL validation vulnerability - Package validation HTTPS URL fix - Virtual package orphan detection fix - GitHub Enterprise support via GITHUB_HOST Credits @richgo for FQDN and GitHub Enterprise support (PR #25)

@pofallon

…#1073) * docs(notice): rename NOTICE.md -> NOTICE; add CLA third-party section Two changes, one file rename: 1. Rename NOTICE.md -> NOTICE, matching the Apache / CNCF convention used by upstream third-party-attribution files (kubernetes-sigs/kro, kubernetes-sigs/headlamp, etc.). The .md extension was non-idiomatic for a generated legal artifact -- NOTICE files are read by tooling (license scanners, SBOM generators) that match on the bare filename. Generator (scripts/generate-notice.py), Makefile target, and the NOTICE Drift Check workflow are all updated to operate on the extension-less path. 2. Add a 'Submitted on behalf of a third-party' section to NOTICE, crediting five contributors whose pull requests landed before the microsoft-github-policy-service CLA bot recorded a signature on file. The repo transferred from danielmeppiel/awd-cli to the microsoft org; some early PRs predate CLA enforcement, and we could not retroactively reach all contributors. Mirrors section 7 of common CLA texts (the wording adopted by CNCF NOTICE files). Driven by a new _third_party_submissions block in scripts/notice-metadata.yaml -- legally-significant wording stays alongside the per-component data, not buried in code. Contributors named (verified via Check Runs API against the microsoft-github-policy-service app, license/cla check on every merged PR by each suspected author): - @pofallon (PR #4) - @richgo (PRs #8, #25, #26, #33, #34) - @ryanfk (PR #92 -- bot ran with conclusion=null, output: 'Contributor License Agreement is not agreed yet.') - @foutoucour (PR #108) - @Jah-yee (PR #184) Listed contributors who later sign the CLA (or who were signed under a different GitHub account at the time) can request removal via issue. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs(notice): trim third-party section preamble Strip the historical/CNCF-citation paragraph and the verbatim CLA-section-7 quote. Keep only the active sentence (what the listing means + how to request removal). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs(notice): address PR #1073 review Three fixes from copilot-pull-request-reviewer: 1. Drop spurious leading '---' separator in the third-party-submissions renderer. render_component already ends each component with '---\n\n', so prepending another '---' produced two consecutive separators in NOTICE. Verified: separator count dropped from 17 to 16. 2. Sweep stale 'NOTICE.md' references in scripts/generate-notice.py (top-level docstring, Modes section, ComponentMeta and DepSpec field docstrings). The constant was renamed; the docs lagged. 3. Append (#1073) PR refs to both CHANGELOG entries; ASCII-correct the arrow ('->' instead of '->'). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <copilot-rework@github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Rich James (richgo)and others added 5 commits November 4, 2025 21:52

added package FQDN support
1379377

Updated MacOs build images to latest
c5ac252

Fixed remaining macos versions
73dcb38

Revert "Fixed remaining macos versions"
b3093d5
This reverts commit 73dcb38.

Revert "Updated MacOs build images to latest"
783bcbe
This reverts commit c5ac252.

Daniel Meppiel (danielmeppiel) added the bug Deprecated: use type/bug. Kept for issue history; will be removed in milestone 0.10.0. label Nov 6, 2025

refactor to use GITHUB_HOST
1021da3

Daniel Meppiel (danielmeppiel) approved these changes Nov 8, 2025
View reviewed changes

Daniel Meppiel (danielmeppiel) merged commit 303a17a into microsoft:mainNov 8, 2025
13 of 16 checks passed

Daniel Meppiel (danielmeppiel) mentioned this pull request Apr 30, 2026
docs(notice): rename NOTICE.md -> NOTICE; add CLA third-party section #1073
Merged

Sergio Sisternes (sergio-sisternes-epam) pushed a commit that referenced this pull request May 19, 2026
Merge pull request#25from richgo/main
e1e00b7
Added FQDN support for packages

Navigation Menu

Uh oh!

Added FQDN support for packages - #25

Added FQDN support for packages#25
Daniel Meppiel (danielmeppiel) merged 6 commits into
microsoft:mainfrom
richgo:main

Rich James (richgo) commented Nov 5, 2025•
edited by danielmeppiel
Loading

Uh oh!

Daniel Meppiel (danielmeppiel) commented Nov 6, 2025

Uh oh!

Rich James (richgo) commented Nov 7, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Rich James (richgo) commented Nov 5, 2025• edited by danielmeppiel Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request

⚡ Quick Start - Use Specialized Templates

Description

Type of Change

Testing

Checklist

Uh oh!

Daniel Meppiel (danielmeppiel) commented Nov 6, 2025

Uh oh!

Rich James (richgo) commented Nov 7, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Rich James (richgo) commented Nov 5, 2025•
edited by danielmeppiel
Loading