fix: allow tilde in repository path components for Bitbucket DC personal repos (#1375) by danielmeppiel · Pull Request #1377 · microsoft/apm

danielmeppiel · 2026-05-18T21:14:34Z

fix: allow tilde in repository path components for Bitbucket DC personal repos

TL;DR

apm install rejects valid Bitbucket Data Center / Server personal-repository URLs (e.g. https://example.com/scm/~myuser/repo.git) with Invalid repository path component: ~myuser. Bitbucket DC uses ~username as the canonical path prefix for personal user projects on both HTTP and SSH clones. This PR adds ~ to the non-Azure-DevOps path-component whitelist at all three validation sites. ~ is an RFC 3986 unreserved character, so the injection-character guarantee that backs the existing $bad rejection test is preserved.

Problem (WHY)

Reporter (issue [BUG] Tilde causes invalid repository path component error #1375) declares https://example.com/scm/path/~myuser/my-apm-repo.git in apm.yml and apm install fails with [x] Failed to parse apm.yml: Invalid APM dependency '...': Invalid repository path component: ~myuser.
Bitbucket Data Center / Server emits personal-repo clone URLs of the form /scm/~<username>/<repo>.git (HTTP) and ssh://git@host/~<username>/<repo>.git (SSH). Verified against a real Bitbucket Server webhook payload published in tektoncd/triggers/examples/v1beta1/bitbucket-server/README.md: "href": "http://localhost:7990/scm/~test/helloworld.git". GitHub code search returns ~240 public matches for the literal /scm/~ clone pattern.
APM's path-component whitelist is ^[a-zA-Z0-9._-]+$ for non-Azure-DevOps hosts. ~ is not in the set, so any Bitbucket DC personal repo is unreachable.
This is a silent capability gap: APM advertises generic git host support (issue is filed against v0.13.0, post the GitLab/Bitbucket/self-hosted generic-host work), so users reasonably expect a valid Bitbucket clone URL to install.

Approach (WHAT)

Single-character whitelist extension at the three sites that validate per-segment characters on non-ADO hosts. No new code paths, no host-specific carve-out. ~ is RFC 3986 unreserved, so it adds no traversal or injection surface beyond what validate_path_segments already covers.

Site	File:Line	Form it validates
Shorthand (`host/user/repo`)	`src/apm_cli/models/dependency/reference.py:1092`	bare FQDN shorthand
HTTPS / SSH URL path	`src/apm_cli/models/dependency/reference.py:1205`	parsed-URL path components
Final post-parse repo_url	`src/apm_cli/models/dependency/reference.py:1312`	normalised `repo_url` returned to caller

Implementation (HOW)

src/apm_cli/models/dependency/reference.py -- three sibling regex updates from ^[a-zA-Z0-9._-]+$ to ^[a-zA-Z0-9._~-]+$ on the non-ADO branch only. ADO retains its existing whitelist (ADO repo/project naming rules do not include ~). One inline comment per site explains the Bitbucket DC motivation so the next reader does not strip ~ as "weird".
tests/unit/test_generic_git_urls.py -- two positive tests:
- test_bitbucket_personal_repo_tilde_url covers the reporter's HTTPS URL verbatim.
- test_bitbucket_personal_repo_tilde_shorthand covers the FQDN shorthand form.
- The existing test_invalid_characters_rejected (which rejects $) is preserved unchanged, confirming the whitelist remains tight.
CHANGELOG.md -- one Unreleased / Fixed bullet referencing [BUG] Tilde causes invalid repository path component error #1375.

Diagram

Decision flow for path-component validation, with the NEW behavior boxed.

flowchart LR
    A["URL path part<br/>e.g. ~myuser"] --> B{"is_ado_host?"}
    B -- yes --> C["match<br/>^[a-zA-Z0-9._\- ]+$"]
    B -- no --> D["match<br/>^[a-zA-Z0-9._~-]+$"]
    C --> E{match?}
    D --> E
    E -- yes --> F["accept"]
    E -- no --> G["raise ValueError:<br/>Invalid repository<br/>path component"]
    style D fill:#d4f4dd,stroke:#1f883d,stroke-width:2px

Trade-offs

Whitelist extension vs allowlist of host-specific quirks. Could have gated ~ behind a is_bitbucket_dc_hostname check, but Bitbucket DC is self-hosted on arbitrary FQDNs (no fixed domain to detect). A blanket ~ allowance on non-ADO hosts is simpler and matches RFC 3986. Cost: a non-Bitbucket host that happens to also use ~ segments gets implicit support -- not a security concern because ~ cannot construct path traversal.
Did not touch the ADO branch. Azure DevOps repo/project naming rules don't permit ~, and the ADO whitelist (which already allows space) is tightly tied to ADO's own validation surface. No reason to drift it.

Benefits

Unblocks Bitbucket Data Center / Server users (a documented enterprise host) from declaring personal-repo dependencies.
Zero diff to APM's normal install / fetch / lockfile path -- the fix is at the parser boundary.
Existing $-rejection test is untouched, so the security posture against injection characters is provably unchanged.

Validation

Full CI mirror (lint + unit tests) is green locally.

Lint (CI Lint job mirror)

$ uv run --extra dev ruff check src/ tests/ && uv run --extra dev ruff format --check src/ tests/
All checks passed!
782 files already formatted

Unit tests -- full suite

$ uv run --extra dev pytest tests/unit/ -x -q
...
8649 passed, 1 skipped, 1 warning, 33 subtests passed in 84.71s (0:01:24)

Reproduces the reporter's failure mode -- before and after

Before (main):

>>> DependencyReference.parse("https://example.com/scm/~myuser/my-apm-repo.git")
ValueError: Invalid repository path component: ~myuser

After (this branch):

>>> d = DependencyReference.parse("https://example.com/scm/~myuser/my-apm-repo.git")
>>> d.host, d.repo_url, d.is_virtual
('example.com', 'scm/~myuser/my-apm-repo', False)

Scenario evidence

User-promise scenario	Test proving it	APM principle
Declare a Bitbucket DC personal repo via HTTPS URL and have `apm install` accept it	`tests/unit/test_generic_git_urls.py::TestSecurityValidation::test_bitbucket_personal_repo_tilde_url`	Generic git host support is honored end-to-end
Declare the same via FQDN shorthand form	`tests/unit/test_generic_git_urls.py::TestSecurityValidation::test_bitbucket_personal_repo_tilde_shorthand`	Shorthand and URL forms remain symmetric
Reject injection characters in repo paths	`tests/unit/test_generic_git_urls.py::TestSecurityValidation::test_invalid_characters_rejected` (preserved)	Defense-in-depth on the parser boundary is unchanged

How to test

Check out this branch and run uv run --extra dev pytest tests/unit/test_generic_git_urls.py::TestSecurityValidation -v. The two new tilde tests pass; the $bad rejection test still passes.
In a scratch project, add to apm.yml:
```
dependencies:
  apm:
    - https://example.com/scm/~myuser/my-apm-repo.git
```
Run apm install. Parsing now succeeds (the fetch will fail because example.com is not a real Bitbucket host -- that is expected and confirms we got past the parser).
Confirm Azure DevOps URLs still reject ~: DependencyReference.parse("https://dev.azure.com/org/proj/_git/~bad") should still raise.

Fixes #1375

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

…nal repos Bitbucket Data Center / Server uses '~username' as the URL prefix for personal user repositories (e.g. https://example.com/scm/~myuser/repo.git). The non-ADO path-component whitelist rejected '~', causing 'apm install' to fail with 'Invalid repository path component: ~myuser'. Added '~' to the allowed character set at all three validation sites (_resolve_shorthand_dependency, _validate_url_repo_path, _validate_final_repo_fields). Tilde is an RFC 3986 unreserved character, so this adds no traversal risk. The '$bad' rejection test still passes, confirming the whitelist remains tight against injection characters. Fixes #1375 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

This PR updates dependency reference parsing so Bitbucket Data Center / Server personal repository paths containing ~username are accepted on non-Azure-DevOps git hosts.

Changes:

Allows ~ in non-ADO repository path segment validation.
Adds regression coverage for HTTPS and FQDN shorthand Bitbucket personal repo references.
Adds an Unreleased changelog entry for #1375.

Show a summary per file

File	Description
`src/apm_cli/models/dependency/reference.py`	Expands non-ADO path component validation to include `~`.
`tests/unit/test_generic_git_urls.py`	Adds positive parser tests for Bitbucket personal repo URLs and shorthand.
`CHANGELOG.md`	Documents the Bitbucket personal repository parsing fix.

Copilot's findings

Files reviewed: 3/3 changed files
Comments generated: 2

+        # ``~`` is allowed on non-ADO hosts to support Bitbucket Data Center /
+        # Server personal repository URLs (``/scm/~username/repo.git``).
+        allowed_pattern = r"^[a-zA-Z0-9._\- ]+$" if is_ado_host else r"^[a-zA-Z0-9._~-]+$"


+    def test_bitbucket_personal_repo_tilde_url(self):
+        """Bitbucket Data Center personal repos use ``~username`` path segments."""
+        dep = DependencyReference.parse("https://example.com/scm/~myuser/my-apm-repo.git")
+        assert dep.host == "example.com"
+        assert dep.repo_url == "scm/~myuser/my-apm-repo"
+        assert dep.is_virtual is False
+
+    def test_bitbucket_personal_repo_tilde_shorthand(self):
+        """Tilde-prefixed user segment is also valid in FQDN shorthand form."""
+        dep = DependencyReference.parse("example.com/scm/~myuser/my-apm-repo")
+        assert dep.host == "example.com"
+        assert dep.repo_url == "scm/~myuser/my-apm-repo"
+


danielmeppiel · 2026-05-18T21:21:34Z

APM Review Panel: `ship_with_followups`

Unblocks Bitbucket DC personal-repo URLs by adding RFC 3986 unreserved tilde to the non-ADO path-segment whitelist -- correct, secure, well-tested fix.

cc @danielmeppiel @sergio-sisternes-epam -- a fresh advisory pass is ready for your review.

All seven panelists converge: the fix is correct, the security surface is unchanged (tilde is not a traversal primitive, subprocess calls use list-form), and auth routing is unaffected. No dissent on the change itself.

The single high-signal gap is docs-as-contract drift: three panelists (devx-ux, doc-writer, growth) independently flagged that reference/manifest-schema.md still documents the path-component charset as [a-zA-Z0-9._-]+ while the implementation now accepts ~. This is a real discrepancy -- users who treat the manifest reference as authoritative will believe tilde is invalid. This should be fixed in-PR or in an immediate follow-up PR before release. The regex-DRY recommendation from python-architect is sound engineering hygiene (3 identical literals is the extraction threshold per APM design philosophy) but does not carry release urgency.

The test-coverage-expert's call for an ADO-rejects-tilde regression trap is well-reasoned: the asymmetry between non-ADO and ADO whitelists is the security invariant, and no test guards it today. Weight this as a high-value follow-up since it protects a secure_by_default surface, even though outcome is missing rather than failed.

Aligned with: secure-by-default (tilde is RFC 3986 unreserved; ADO paths remain restricted; supply-chain-security confirms no traversal or injection vector); multi-harness, multi-host (extends host compatibility to Bitbucket DC personal repos and incidentally Sourcehut ~user paths); OSS community-driven (closes a community-filed bug #1375 with a minimal, well-scoped fix and clear CHANGELOG entry); portable-by-manifest (docs must now reflect the expanded charset so manifests remain self-describing).

Growth signal. Bitbucket Data Center is a top-3 enterprise git host. Unblocking personal-repo URLs removes a papercut that enterprise evaluators hit during pilot. A one-line example in the private-packages doc (https://bitbucket.example.com/scm/~jdoe/ml-utils.git) would compound discoverability for the exact search query enterprise teams use.

Panel summary

Persona	R	N	Takeaway
Python Architect	1	1	Correct fix; the tripled regex literal is a DRY smell that should be extracted to a module-level constant or helper.
CLI Logging Expert	0	1	Error messages are pre-existing and unchanged; no CLI logging regression. Nit: messages could hint at allowed chars.
DevX UX Expert	1	1	Bug-fix restores expected behavior for Bitbucket DC users; docs should update the path-segment grammar to avoid future surprise.
Supply Chain Security Expert	0	1	Tilde addition is safe: no shell-injection vector, no traversal primitive, RFC 3986 unreserved char; ship.
OSS Growth Hacker	1	2	Good CHANGELOG entry closes the reporter loop; a one-line Bitbucket DC example in the private-packages doc would compound enterprise discoverability.
Auth Expert	0	1	Tilde in path components does not affect host classification or token routing; generic-host credential-fill is the expected auth path for Bitbucket DC.
Doc Writer	2	1	CHANGELOG entry is clear and in-voice; reference/manifest-schema.md owner/repo regex now drifts from implementation, and no doc shows the /scm/~user/ form users would search for.
Test Coverage Expert	1	1	HTTPS and shorthand tilde paths well-covered; missing regression traps for SSH tilde form and ADO tilde rejection asymmetry.

B = blocking-severity findings, R = recommended, N = nits.
Counts are signal strength, not gates. The maintainer ships.

Top 4 follow-ups

[DevX UX Expert] Update reference/manifest-schema.md path-component regex to include tilde for non-ADO hosts -- Docs-as-contract violation: three panelists flagged the same drift. Users treating the spec table as authoritative will believe tilde is invalid. Fix in-PR or immediate follow-up.
[Test Coverage Expert] Add regression test asserting ADO URLs reject tilde in path segments -- Guards the security-critical asymmetry between ADO and generic-host whitelists. Missing test on a secure_by_default surface.
[Python Architect] Extract duplicated path-segment regex to a module-level constant (NON_ADO_PATH_SEGMENT_RE / ADO_PATH_SEGMENT_RE) -- Same literal repeated 3x triggers APM's DRY extraction threshold. Prevents silent charset divergence on future edits.
[OSS Growth Hacker] Add Bitbucket DC personal-repo (~user) example to private-and-org-packages doc page -- Enterprise evaluators searching 'APM Bitbucket personal repo' land on this page. One example line compounds discoverability.

Architecture

classDiagram
    direction LR
    class DependencyReference {
        <<Parser>>
        +parse(dep_str) DependencyReference
        -_parse_full_url_reference()
        -_validate_url_repo_path()
        -_resolve_ado_parts()
    }
    class path_security {
        <<Module>>
        +validate_path_segments(path_str, context)
        +ensure_path_within(base, target)
    }
    class re {
        <<stdlib>>
        +match(pattern, string)
    }
    DependencyReference ..> path_security : calls validate_path_segments
    DependencyReference ..> re : inline allowed_pattern match x3
    class DependencyReference:::touched
    classDef touched fill:#fff3b0,stroke:#d47600

flowchart TD
    A["User input: dep string"] --> B["DependencyReference.parse()"]
    B --> C{"URL or shorthand?"}
    C -->|full URL| D["_parse_full_url_reference()"]
    C -->|shorthand| E["_resolve_ado_parts()"]
    D --> F["_validate_url_repo_path()"]
    D --> G["validate_path_segments()"]
    D --> H["re.match(allowed_pattern)<br/>lines 1094, 1209, 1318"]
    F --> G
    F --> H
    E --> G
    E --> H
    H -->|no match| I["raise ValueError"]
    H -->|match| J["Return parsed DependencyReference"]
    G -->|traversal| I

Recommendation

Ship the fix as-is -- it is correct, secure, and well-tested for the primary paths. Track the docs-charset update as the highest-priority follow-up (ideally same release); the ADO regression-trap test and regex extraction are good-hygiene items for the next PR.

Full per-persona findings

Python Architect

[recommended] Same regex pattern duplicated 3 times in one file -- extract to a module-level constant or helper at src/apm_cli/models/dependency/reference.py:1094
APM design philosophy: 'Abstract when 3+ call sites share the same logic pattern.' Pattern r"^[a-zA-Z0-9._~-]+$" now at lines 1094, 1209, 1318 with identical semantics. Future character-set change requires editing 3 sites that can silently diverge. Extract to a constant pair (NON_ADO_PATH_SEGMENT_RE / ADO_PATH_SEGMENT_RE) or _validate_path_component helper. Also removes 3x comment duplication.
[nit] Consider co-locating the character-set check with validate_path_segments in path_security.py
path_security.py already owns traversal validation. A _validate_path_chars helper there would keep the entire path-validation contract in one module.

CLI Logging Expert

[nit] Rejection messages do not tell the user which characters ARE allowed at src/apm_cli/models/dependency/reference.py:1098
Pre-existing -- the PR does not regress it. A follow-up could interpolate the allowed set ('only alphanumeric, dot, underscore, hyphen, and tilde are allowed').

DevX UX Expert

[recommended] manifest-schema.md documents the path-component charset as [a-zA-Z0-9.-]+ but code now allows tilde at docs/src/content/docs/reference/manifest-schema.md:285
Line 285 of docs/src/content/docs/reference/manifest-schema.md defines owner/repo as '2+ path segments of [a-zA-Z0-9.-]+'. After this PR the actual accepted charset for non-ADO hosts is [a-zA-Z0-9._~-]+. Docs-as-contract violation.
[nit] Consider mentioning Sourcehut tilde-prefix convention alongside Bitbucket DC in the code comment at src/apm_cli/models/dependency/reference.py:1092
Sourcehut (sr.ht) also uses ~username paths. Broadening the comment to mention RFC 3986 unreserved + Sourcehut would prevent a future contributor from wondering whether this is over- or under-scoped.

Supply Chain Security Expert

[nit] Add a brief inline comment at the regex explaining WHY tilde is safe from a security perspective.
Future reviewers will benefit from a one-liner noting that ~ is not a POSIX path traversal token and all subprocess calls use list-form.

OSS Growth Hacker

[recommended] Add a Bitbucket DC personal-repo example to the private-and-org-packages doc page at docs/src/content/docs/consumer/private-and-org-packages.md
The private-and-org-packages doc already has Bitbucket team-project examples but no personal-repo (~user) example. Enterprise evaluators searching 'APM Bitbucket personal repo' will land here.
[nit] CHANGELOG could mention Sourcehut as incidentally unblocked
[nit] Reply to issue [BUG] Tilde causes invalid repository path component error #1375 with release-note phrasing when shipping

Auth Expert

[nit] org extraction from repo_url may yield tilde-prefixed org like ~myuser for per-org PAT lookup
Per-org PAT lookup is GitHub-only and skipped for generic hosts. No credential mis-routing.

Doc Writer

[recommended] reference/manifest-schema.md owner/repo pattern '[a-zA-Z0-9._-]+' contradicts the new whitelist; '~' is now valid on non-Azure-DevOps hosts but the spec table still excludes it. at docs/src/content/docs/reference/manifest-schema.md:285
[recommended] No dependency-reference example shows the Bitbucket DC personal-repo form '/scm/~user/repo.git' that this PR enables; users will not discover the now-supported syntax. at packages/apm-guide/.apm/skills/apm-usage/dependencies.md
[nit] CHANGELOG bullet is clear, accurate, technical, in voice.

Test Coverage Expert

[recommended] No test for ADO URLs rejecting tilde (defense-in-depth asymmetry guarantee) at tests/unit/test_generic_git_urls.py
If someone accidentally unifies the regexes later, no test would fail.
Proof (missing at): tests/unit/test_generic_git_urls.py
[nit] No test for SSH-form Bitbucket DC personal repos with tilde
Same regex code path as HTTPS, just different entry. SSH forms parse correctly manually-verified.

_{This panel is advisory. It does not block merge. Re-apply the panel-review label after addressing feedback to re-run.}

Convergent recommendations from the advisory panel on PR #1377: - python-architect: extract the 3x duplicated path-segment regex literal to module-level constants (_ADO_PATH_SEGMENT_RE / _NON_ADO_PATH_SEGMENT_RE) plus a _path_segment_pattern helper. Prevents silent charset divergence on future edits and removes 3x comment duplication. - devx-ux + doc-writer: widen reference/manifest-schema.md owner/repo grammar to document the actual non-ADO charset [a-zA-Z0-9._~-]+ and call out the ADO asymmetry (spaces allowed, tilde not). - oss-growth + doc-writer: add a Bitbucket Data Center personal-repo (~user) example to private-and-org-packages.md and dependencies.md. - test-coverage: add test_ado_rejects_tilde_in_repo_path regression trap for the secure_by_default ADO/non-ADO whitelist asymmetry. - oss-growth nit: CHANGELOG now mentions Sourcehut as incidentally unblocked. All three call sites in reference.py now share one constant; behavior unchanged. 8650 tests pass, lint silent. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Addresses Copilot PR review comment on PR #1377: extend tilde coverage to SCP shorthand (git@host:path) and ssh:// URL forms with a custom port. Same code path as the HTTPS tests, but guards the documented SSH transport that Bitbucket DC commonly emits. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

danielmeppiel · 2026-05-18T21:25:47Z

Addressed both Copilot review comments in commit 5949045:

Docs sync (already in 823c647 after the panel pass) — Bitbucket Data Center ~user form added to:
- docs/src/content/docs/reference/manifest-schema.md (path-component grammar)
- docs/src/content/docs/consumer/private-and-org-packages.md (new Bitbucket Data Center personal repos section)
- packages/apm-guide/.apm/skills/apm-usage/dependencies.md (example block)
SSH transports — added test_bitbucket_personal_repo_tilde_scp_form and test_bitbucket_personal_repo_tilde_ssh_url to tests/unit/test_generic_git_urls.py covering both git@host:~user/repo.git and ssh://git@host:7999/~user/repo.git.

Lint silent, 8650+ unit tests pass.

…de-in-repo-path # Conflicts: # CHANGELOG.md

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore: cut 0.14.0 Renames the [Unreleased] block in CHANGELOG.md to [0.14.0] - 2026-05-18 and bumps the package version from 0.13.0 to 0.14.0 in pyproject.toml (and uv.lock by regeneration). 0.14.0 ships the producer-experience epic (#1348) on the CLI side -- notably: - apm pack --check-versions / --check-clean (#1365), the release gates consumed by apm-action mode: release. - apm plugin init (#1370), the noun-verb successor to apm init --plugin. - apm pack multi-format outputs (--marketplace, --marketplace-path, --json, marketplace.outputs map form) (#1317). - New producer docs corpus (repo-shapes / releasing-from-any-ci / versioning-strategies) (#1370). - Breaking: MCP registry client adopts the official v0.1 spec; self- hosted registries must serve /v0.1/ paths (#1337). Plus the deprecations and fixes already listed in the moved block. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs(changelog): tighten v0.14.0 entries; add post-cut PRs - One concise line per PR answering 'so what?' for end users - Add 5 missing entries: #1376 (perf resolver), #1373 (shared/apm.md matrix secret-stripping), #1246 (install.ps1 GHES env vars), #1255 (warn missing apm.yml), #1248 (extends:org unmanaged_files) - Drop internal/CI/test-infra entries (#1270, #1271, #1272, #1274, #1276, #1291, #1360 refactor) - Consolidate three #605 lines and four #1317 lines into one entry per PR where appropriate - Promote MCP Registry v0.1 to a dedicated Breaking section Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs(changelog): add #1377 Bitbucket DC tilde fix Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Daniel Meppiel <copilot-rework@github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

danielmeppiel requested a review from sergio-sisternes-epam as a code owner May 18, 2026 21:14

Copilot AI review requested due to automatic review settings May 18, 2026 21:14

Copilot started reviewing on behalf of danielmeppiel May 18, 2026 21:16 View session

Copilot AI reviewed May 18, 2026

View reviewed changes

Daniel Meppiel and others added 2 commits May 18, 2026 23:24

Merge remote-tracking branch 'origin/main' into danielmeppiel/fix-til…

b06aaaf

…de-in-repo-path # Conflicts: # CHANGELOG.md

danielmeppiel merged commit d20f187 into main May 18, 2026
11 checks passed

danielmeppiel deleted the danielmeppiel/fix-tilde-in-repo-path branch May 18, 2026 21:29

danielmeppiel pushed a commit that referenced this pull request May 18, 2026

docs(changelog): add #1377 Bitbucket DC tilde fix

b30d913

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: allow tilde in repository path components for Bitbucket DC personal repos (#1375)#1377

fix: allow tilde in repository path components for Bitbucket DC personal repos (#1375)#1377
danielmeppiel merged 4 commits into
mainfrom
danielmeppiel/fix-tilde-in-repo-path

danielmeppiel commented May 18, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

danielmeppiel commented May 18, 2026

Python Architect

CLI Logging Expert

DevX UX Expert

Supply Chain Security Expert

OSS Growth Hacker

Auth Expert

Doc Writer

Test Coverage Expert

Uh oh!

danielmeppiel commented May 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

danielmeppiel commented May 18, 2026

fix: allow tilde in repository path components for Bitbucket DC personal repos

TL;DR

Problem (WHY)

Approach (WHAT)

Implementation (HOW)

Diagram

Trade-offs

Benefits

Validation

Scenario evidence

How to test

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

danielmeppiel commented May 18, 2026

APM Review Panel: ship_with_followups

Panel summary

Top 4 follow-ups

Architecture

Recommendation

Python Architect

CLI Logging Expert

DevX UX Expert

Supply Chain Security Expert

OSS Growth Hacker

Auth Expert

Doc Writer

Test Coverage Expert

Uh oh!

danielmeppiel commented May 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

APM Review Panel: `ship_with_followups`