fix: validate GitHub remote host

[ajaysurya1221]

Security finding

Closes CodeQL alert #1 (py/incomplete-url-substring-sanitization). The deprecated compatibility helper previously classified any git remote -v output containing github.com as GitHub, including attacker-controlled path and suffix lookalikes.

Fix

• parse standard remote URLs and Git scp-style remotes
• require the exact normalized github.com hostname
• allow only GitHub network transport schemes
• preserve HTTPS, SSH, scp-style remotes, and the .github fallback
• add focused positive and bypass regression coverage

Verification

• both original bypass reproducers are closed
• legitimate scp-style remote remains accepted
• 411 tests pass
• Ruff lint and format pass
• wheel/sdist build, Twine, and artifact hygiene pass
• CI / required
• CodeQL / Python
• Dependency review
• Gitleaks / full history

Summary by CodeRabbit

• Bug Fixes

  • Improved GitHub repository detection across HTTPS, SSH, and other remote URL formats.
  • Prevented false positives from untrusted domains or malformed remote addresses.
  • Preserved detection for projects containing a local .github directory.

• Tests

  • Added coverage for valid remote formats, hostname variations, invalid matches, and fallback behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8750b73f-edb6-4f4d-bb81-2d5914b91f7f

📥 Commits

Reviewing files that changed from the base of the PR and between 403d47a and 131b11e.

📒 Files selected for processing (2)

• src/evalopt_graph/checks.py
• tests/test_quality_gate.py

---

📝 Walkthrough

Walkthrough

Changes

GitHub remote detection

Layer / File(s)	Summary
Remote hostname parsing and detection src/evalopt_graph/checks.py	Parses URL-style and SCP-style remotes, normalizes hostnames, and requires an exact github.com match while preserving the .github directory fallback.
Remote detection coverage tests/test_quality_gate.py	Tests accepted GitHub remote formats, rejected misleading host strings, and fallback behavior for repositories with a .github directory.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers the fix and verification, but it omits the required Boundary and compatibility and Checklist sections.	Add the template sections for Boundary and compatibility, Evidence and testing, and Checklist, including the required impact notes and completed items.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: validating GitHub remote hosts instead of using a substring check.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/codeql-url-validation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}