refactor: share one git remote parser between Buildkite consumers

The GitHub comment adapter and pull request link construction each parsed
BUILDKITE_REPO independently. Consolidate on socketsecurity.core.git_remote,
which also reports the remote host (needed for self-hosted GitHub Enterprise
and GitLab) and preserves nested GitLab subgroup paths.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: lelia

docs/ci-cd.md

@@ -135,11 +135,12 @@ checked-out head commit. The CLI uses those local refs first and performs a
 targeted fetch only when a required ref or its comparison history is missing;
 it does not fetch every remote ref and tag during startup.
 
-When `--scm github` is used from Buildkite, the CLI also derives GitHub comment
-context from `BUILDKITE_REPO`, `BUILDKITE_BUILD_CHECKOUT_PATH`, and the variables
-above. Set `GH_API_TOKEN` to a GitHub token with the required repository access.
-GitHub Enterprise users should also set `GITHUB_API_URL`; GitHub.com defaults to
-`https://api.github.com`.
+When `--scm github` is used from Buildkite, the CLI also posts GitHub PR comments.
+It identifies the repository from `BUILDKITE_REPO` and takes the rest of the build
+context from `BUILDKITE_BUILD_CHECKOUT_PATH` and the variables above — see
+[Buildkite PR context](#buildkite-pr-context). Set `GH_API_TOKEN` to a GitHub token
+with the required repository access. GitHub Enterprise users should also set
+`GITHUB_API_URL`; GitHub.com defaults to `https://api.github.com`.
 
 #### Merge-base baselines in Buildkite (dynamic pipelines)
 
@@ -246,13 +247,14 @@ the Buildkite platform example above. Buildkite sets `BUILDKITE_PULL_REQUEST` to
 `false` outside PR builds; the CLI treats that value as no PR.
 
 Use `--integration github` for GitHub-hosted repositories and `--integration gitlab`
-for GitLab-hosted ones. In both cases the CLI reads the repository slug and host from
-[`BUILDKITE_REPO`](https://buildkite.com/docs/pipelines/configure/environment-variables#BUILDKITE_REPO)
-to build the pull request or merge request link, so github.com, GitLab.com, and
-self-hosted installations all work without extra configuration. Setting
-`CI_PROJECT_URL` still overrides the derived GitLab project URL. Keep `--scm api`
-unless you also intend to configure an existing GitHub or GitLab comment adapter and
-its provider token.
+for GitLab-hosted ones. The CLI identifies the repository from
+[`BUILDKITE_REPO`](https://buildkite.com/docs/pipelines/configure/environment-variables#BUILDKITE_REPO),
+taking both the slug and the host from it, so github.com, GitLab.com, and self-hosted
+installations all build a correct pull request or merge request link without extra
+configuration. That same value identifies the repository for GitHub PR comments when
+`--scm github` is set. `CI_PROJECT_URL` still overrides the derived GitLab project URL.
+Keep `--scm api` unless you also intend to configure an existing GitHub or GitLab
+comment adapter and its provider token.
 
 `--scm github` and `--scm gitlab` also imply the matching scan integration for
 Dashboard metadata unless `--integration` was explicitly supplied. PR comments

socketsecurity/core/git_remote.py

@@ -0,0 +1,43 @@
+"""Parsing for git remote URLs.
+
+CI systems that are not tied to a single SCM expose the checkout URL rather than
+an ``owner/repo`` slug (Buildkite's ``BUILDKITE_REPO``, for example). Both the
+GitHub comment adapter and pull request context resolution need to recover the
+slug from it, so the parsing lives here rather than in either caller.
+"""
+import re
+from typing import Optional, Tuple
+from urllib.parse import urlparse
+
+# git@host:owner/repo - the scp-like syntax urlparse cannot handle. The negative
+# lookahead keeps scheme-prefixed URLs (https://, ssh://) out of this branch.
+_SCP_LIKE_REMOTE = re.compile(r"^(?:[^@/]+@)?([^:/]+):(?!//)(.+)$")
+
+
+def parse_git_remote(value: Optional[str]) -> Tuple[Optional[str], Optional[str]]:
+    """Split a git remote URL into its host and its repository path.
+
+    Returns ``(host, path)``, or ``(None, None)`` when the value is not a usable
+    remote. The path is returned whole rather than as ``owner``/``repo`` because
+    GitLab projects can be nested under subgroups; callers that only want the
+    last two segments can split it themselves. ``host`` is ``None`` for a bare
+    ``owner/repo`` path, which carries no host to report.
+    """
+    if not value:
+        return None, None
+    url = value.strip().rstrip("/")
+    if url.endswith(".git"):
+        url = url[:-4]
+
+    match = _SCP_LIKE_REMOTE.match(url)
+    if match:
+        return match.group(1), match.group(2).strip("/")
+
+    parsed = urlparse(url)
+    if parsed.scheme in ("http", "https", "ssh", "git") and parsed.hostname:
+        return parsed.hostname, parsed.path.strip("/")
+
+    # A bare owner/repo path, with no scheme and nothing to infer a host from.
+    if "/" in url:
+        return None, url.strip("/")
+    return None, None

socketsecurity/core/pull_request.py

@@ -3,6 +3,8 @@
 from typing import Mapping, Optional
 from urllib.parse import urlparse
 
+from socketsecurity.core.git_remote import parse_git_remote
+
 
 @dataclass(frozen=True)
 class PullRequestContext:
@@ -28,35 +30,6 @@ def _repository_url(value: Optional[str]) -> Optional[str]:
     return url if parsed.scheme in ("http", "https") and parsed.netloc else None
 
 
-# git@host:owner/repo - the scp-like syntax urlparse cannot handle. The negative
-# lookahead keeps scheme-prefixed URLs (https://, ssh://) out of this branch.
-_SCP_LIKE_REMOTE = re.compile(r"^(?:[^@/]+@)?([^:/]+):(?!//)(.+)$")
-
-
-def _parse_remote(value: Optional[str]) -> tuple[Optional[str], Optional[str]]:
-    """Split a git remote URL into its host and its ``owner/repo`` path.
-
-    Providers expose the checkout URL rather than a slug on CI systems that are
-    not tied to a single SCM (Buildkite's ``BUILDKITE_REPO``, for example), so
-    the slug the URL builders need has to be recovered from it. The path is
-    returned whole because GitLab projects can be nested under subgroups.
-    """
-    if not value:
-        return None, None
-    url = value.strip().rstrip("/")
-    if url.endswith(".git"):
-        url = url[:-4]
-
-    match = _SCP_LIKE_REMOTE.match(url)
-    if match:
-        return match.group(1), match.group(2).strip("/")
-
-    parsed = urlparse(url)
-    if parsed.scheme in ("http", "https", "ssh", "git") and parsed.hostname:
-        return parsed.hostname, parsed.path.strip("/")
-    return None, None
-
-
 def _github_number(env: Mapping[str, str]) -> int:
     number = _positive_int(env.get("PR_NUMBER"))
     if number:
@@ -66,7 +39,7 @@ def _github_number(env: Mapping[str, str]) -> int:
 
 
 def _github_url(number: int, repo: Optional[str], env: Mapping[str, str]) -> Optional[str]:
-    remote_host, remote_path = _parse_remote(env.get("BUILDKITE_REPO"))
+    remote_host, remote_path = parse_git_remote(env.get("BUILDKITE_REPO"))
     # config.repo is only ever a bare repository name, so it cannot produce a
     # slug on its own; it is kept last for callers that pass a full owner/repo.
     repository = env.get("GITHUB_REPOSITORY") or remote_path or repo
@@ -80,7 +53,7 @@ def _github_url(number: int, repo: Optional[str], env: Mapping[str, str]) -> Opt
 def _gitlab_url(number: int, repo: Optional[str], env: Mapping[str, str]) -> Optional[str]:
     project_url = _repository_url(env.get("CI_PROJECT_URL"))
     if not project_url:
-        remote_host, remote_path = _parse_remote(env.get("BUILDKITE_REPO"))
+        remote_host, remote_path = parse_git_remote(env.get("BUILDKITE_REPO"))
         project_path = env.get("CI_PROJECT_PATH") or remote_path or repo
         server = env.get("CI_SERVER_URL") or (f"https://{remote_host}" if remote_host else "")
         server = server.rstrip("/")

socketsecurity/core/scm/github.py

@@ -1,14 +1,14 @@
 import json
 import os
 import sys
-import urllib.parse
 from dataclasses import dataclass
 
 from git import Optional
 
 from socketsecurity import USER_AGENT
 from socketsecurity.core import log
 from socketsecurity.core.classes import Comment
+from socketsecurity.core.git_remote import parse_git_remote
 from socketsecurity.core.scm_comments import Comments
 from socketsecurity.socketcli import CliClient
 
@@ -38,24 +38,12 @@ class GithubConfig:
     @staticmethod
     def _repository_from_buildkite() -> tuple[str, str]:
         """Return ``(owner, repository)`` from Buildkite's Git repository URL."""
-        repository_url = (
-            # Comments and statuses belong to the pipeline/base repository,
-            # not a contributor's fork from BUILDKITE_PULL_REQUEST_REPO.
-            os.getenv("BUILDKITE_REPO")
-            or os.getenv("BUILDKITE_PULL_REQUEST_REPO")
-            or ""
-        ).strip()
-        if not repository_url:
-            return "", ""
-
-        if "://" in repository_url:
-            repository_path = urllib.parse.urlparse(repository_url).path
-        elif ":" in repository_url:
-            # SCP-style SSH URL: git@github.com:owner/repository.git
-            repository_path = repository_url.split(":", 1)[1]
-        else:
-            repository_path = repository_url
-        parts = repository_path.strip("/").removesuffix(".git").split("/")
+        # Comments and statuses belong to the pipeline/base repository, not a
+        # contributor's fork from BUILDKITE_PULL_REQUEST_REPO.
+        _, repository_path = parse_git_remote(
+            os.getenv("BUILDKITE_REPO") or os.getenv("BUILDKITE_PULL_REQUEST_REPO")
+        )
+        parts = repository_path.split("/") if repository_path else []
         if len(parts) < 2:
             return "", ""
         return parts[-2], parts[-1]

tests/unit/test_git_remote.py

@@ -0,0 +1,41 @@
+"""Tests for the shared git remote parser.
+
+Both the GitHub comment adapter (`GithubConfig._repository_from_buildkite`) and
+pull request URL construction depend on this, so the URL forms Buildkite and
+self-hosted installations emit are pinned here rather than in either caller.
+"""
+import pytest
+
+from socketsecurity.core.git_remote import parse_git_remote
+
+
+@pytest.mark.parametrize(
+    ("remote", "expected"),
+    [
+        # The three forms BUILDKITE_REPO is observed to take.
+        ("git@github.com:acme/widgets.git", ("github.com", "acme/widgets")),
+        ("https://github.com/acme/widgets.git", ("github.com", "acme/widgets")),
+        ("ssh://git@github.com/acme/widgets.git", ("github.com", "acme/widgets")),
+        # Self-hosted hosts must survive: they decide the PR/MR link's origin.
+        ("git@github.example.com:acme/widgets.git", ("github.example.com", "acme/widgets")),
+        ("https://gitlab.example.com/acme/widgets", ("gitlab.example.com", "acme/widgets")),
+        # GitLab subgroups: the path is returned whole, not just the last two parts.
+        (
+            "ssh://git@gitlab.example.com/acme/platform/widgets.git",
+            ("gitlab.example.com", "acme/platform/widgets"),
+        ),
+        ("git://github.com/acme/widgets.git", ("github.com", "acme/widgets")),
+        # Cosmetic variation callers should not have to normalise themselves.
+        ("  https://github.com/acme/widgets/  ", ("github.com", "acme/widgets")),
+        # Credentials in the URL must not leak into the host.
+        ("https://user@github.com/acme/widgets", ("github.com", "acme/widgets")),
+        # A bare slug carries no host to report, but is still usable.
+        ("acme/widgets", (None, "acme/widgets")),
+        # Nothing usable.
+        ("not-a-repository", (None, None)),
+        ("", (None, None)),
+        (None, (None, None)),
+    ],
+)
+def test_parse_git_remote(remote, expected):
+    assert parse_git_remote(remote) == expected