Allow github:ORG// repos to redirect to other repos in the same org

[jandubois]

See #4134 (comment) for background.

---

Regarding #4134 (comment), it is now possible to implement this yourself, if you want to:

❯ cat ~/bin/limactl-url-gh
#!/bin/bash
echo "github:$1"
❯ l tmpl url gh:jandubois
WARN[0003] The github: scheme is still EXPERIMENTAL
https://raw.githubusercontent.com/jandubois/jandubois/main/templates/demo.yaml

[AkihiroSuda]

On second though the "CORS" restriction may not make much sense for GitHub URLs, as a COMMIT hash in https://raw.githubusercontent.com/ORG/REPO/COMMIT/PATH can (surprisingly) refer to a fork repo outside the ORG

[jandubois]

On second though the "CORS" restriction may not make much sense for GitHub URLs, as a COMMIT hash in https://raw.githubusercontent.com/ORG/REPO/COMMIT/PATH can (surprisingly) refer to a fork repo outside the ORG

It is not so surprising once you realize that all forks are part of the same repo on the server side, and serve simply as namespaces for branch and tag names.

This is also the reason GitHub does not allow public forks of private repos. Because if the SHA1 of a private commit is leaked, it becomes accessible through the public fork.

I already mentioned before that we don't restrict redirects on http:// and https:// URLs either, so it is a little odd to have them on github: URLs.

But I think the use case is really to redirect from the github:ORG// repo to a different place in the same ORG, not to be a generic link redirector.

I can remove the restriction, if you want; I don't think it matters much either way.

But we can also remove the restriction later, once an actual use case for cross-org linking has appeared.

[jandubois]

While working on the tests for this PR I tripped myself a few times over the problem that except for the root redirect of github:jandubois, all others need to specify a trailing slash to mark them as directories:

❯ l tmpl url github:jandubois//redirect
https://raw.githubusercontent.com/jandubois/jandubois/main/redirect.yaml

❯ l tmpl url github:jandubois//redirect/
https://raw.githubusercontent.com/jandubois/lima/master/templates/default.yaml

Without the trailing slash redirect is treated as redirect.yaml and cannot redirect to another repo, even if redirect.yaml doesn't exist.

If I can accidentally forget to add the slash while working on the tests, then it is very likely that casual users will also run into it¹.

I think we can do 2 things to mitigate it:

1. Treat foo as foo/ if foo.yaml does not exist (and foo has no extension).

   So we need to make at least a HEAD request for foo.yaml, and if that fails we decide that this was meant to look up foo/.lima.yaml instead.

2. Allow all *.yaml references (only in ORG repos?) to be symlinks or redirects

   This has the advantage that the user doesn't have to create extra subdirectories as containers for .lima.yaml, as there is likely nothing else in there. Instead foo.yaml could contain the redirect URL (or symlink).

I think (2) is more useful than (1), but if we do (2) and already fetch the file, then we can just do (1) at the same time at no extra cost.

It is just a fallback when foo.yaml doesn't exist, so the alternatives are either return an error right away, or retry the foo/.lima.yaml symlink as well.

I think we should implement both (1) and (2). For consistency we should probably also implement them for non-ORG repos, but of course they would only allow symlinks and not redirects to other repos.

This should again be done in a separate PR because this one is already big enough.

But let me know what you think first!

Footnotes

1. For similar reasons many websites redirect http://example.com/ to http://example.com (or vice versa). ↩