VSCode.dev can't switch branches in private repositories

[seanofw]

Does this issue occur when all extensions are disabled?: Yes

• VS Code Version: VSCode.dev
• OS Version: Windows 10, 64-bit

Steps to Reproduce:

1. Open vscode.dev.
2. Open a private repository on GitHub in vscode.dev.
3. At the bottom, click where it says master (or whatever the default branch is named).
4. In the popup that appears, click on any branch other than master.
5. The page will flash white and reload, and the Explorer section will be blank.

This appears to only happen in my private repositories; it doesn't seem to happen in any of the public ones. It can correctly load master from the private repositories, just not other branches.

I'm using Firefox 93, 64-bit, on Windows 10 64-bit.

I just heard about VSCode.dev tonight and thought I'd give it a spin, so I opened it, pointed it at the repository I've been working in lately, switched to the branch I've been working in, and — immediately it broke :(

[lramos15]

I can reproduce with repos that require SAML. I.e. some of the private Microsoft ones, but not with my personal private repos. @seanofw Do your private repos happen to be org repos that require single sign on?

[seanofw]

My private repos are personal, private repos on GitHub. I do have 2FA enabled for my account, though, so it's quite possible that it's still doing corporate-like SSO-ish things with them.

[joyceerhl]

@seanofw do you have slashes in the names of the branches that you're trying to switch to? And if you install the GitHub Repositories extension on desktop VS Code, can you switch branches in the same repo?

[joyceerhl]

OK, it looks like this is a bug in how the workbench embedder parses branch names for private repos. Public repos are unaffected because no authentication is required to validate the branch name against the GitHub APIs.

[joyceerhl]

The problem is that for treeish GitHub urls, we can't tell where the branch name (which can contain slashes) ends and the directory path begins. For example,

• resources directory on main branch: https://github.com/microsoft/vscode/tree/main/resources
• resources directory on a dev branch: https://github.com/microsoft/vscode/tree/TylerLeonhardt/fix-quickpick-focus/resources

So in the dev branch case above, our current code assumes that TylerLeonhardt is the branch name and fix-quickpick-focus/resources is the directory path. The default branch works because main is indeed the branch name.

This bug impacts vscode.dev only and not github.dev or desktop RemoteHub, because you have to sign into GitHub to access github.dev, and RemoteHub asks you to sign into GitHub when accessing a GitHub repo as well.

To handle opening treeish urls in private repos correctly, some component in the vscode.dev -> RemoteHub flow must be able to make an authenticated GH extract-ref API call (which is how github.dev deals with this problem) to validate the url.

1. One thought is we could delegate all the url handling for private repos back to RemoteHub instead of trying to parse them in the workbench embedder, since there's no heuristic we can use to parse urls ourselves. This means private repos won't benefit from the editor defaultLayout work we've done, since we have to wait for the extension to activate first
2. I believe there was also some discussion regarding creating a url resolver extension which can handle the url parsing. Again, we have to wait for the extension to activate to handle the url
3. Would it make sense to require auth in the workbench embedder for private repos? The user already needs to authenticate in that case. cc @joaomoreno @TylerLeonhardt for additional thoughts

[seanofw]

@joyceerhl Indeed I do use slash-delimited branch names, and I'll bet that's the exact cause. I use branch names like feature/foo and bugfix/bar and release/baz in almost every repository I work with: It's a pretty common pattern.

Admittedly, while invoking the extract-ref API is probably the right answer, you might want to consider implementing a cheat in the short term and allow for a user-specified wildcard pattern or a regex to be specified in the configuration somewhere that indicates either what part of the path is the branch name (feature/), or directly indicates how to decompose it (^(?<branch>\w*)\/(?<path>.*)$). That's hacktacular, but it's also a really trivial solution to implement, while invoking the API is probably a lot more complex. Just a thought.

[joaomoreno]

Correct, this won't work unless we come up with a way for a lightweight extension host to spin up both the GitHub Authentication and RemoteHub extensions, let them auth and resolve the workspace and only then open it up. This is somewhat what already happens in remote. I've had discussions about it with @bpasero. Also cc @alexdima @aeschli.