Allow a registry to be declared as a git URL

[lmolkova]

Fixes #176.

weaver.registry and --registry now take weaver's <url>.git@<ref>[<sub folder>] format alongside a local path:

weaver:
  registry: https://github.com/open-telemetry/semantic-conventions-genai.git@67dff024[model]

Weaver would accept the URL directly, but the runner also builds advice data by reading files out of the registry, which no weaver command hands back. So the URL is fetched into the registry cache and everything downstream sees a local checkout. open-telemetry/weaver#1751 tracks the weaver-side fix; once --advice-data takes a virtual directory, the fetch here can go away.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: lmolkova / name: Liudmila Molkova (985b11b)

[opentelemetry-pr-dashboard]

Pull request dashboard status

Waiting on reviewers · refreshed 2026-09-17 06:53 UTC

Review the latest changes.

Status above doesn't look right?

• Just replied or pushed? Anything around or after the refresh time above may not be picked up yet — give it a few minutes.
• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

[Copilot]

🟡 Changes recommended

Registry selection, cache isolation, and unsafe cache-path construction introduce correctness and security issues.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds support for GitHub registry URLs alongside local paths.

Changes:

• Parses, downloads, and caches GitHub registries.
• Integrates URL registries into CLI and session handling.
• Adds tests and usage documentation.

File summaries

File	Description
tools/runner/src/opentelemetry/conformance/_registry.py	Adds URL parsing and localization.
tools/runner/src/opentelemetry/conformance/_session.py	Resolves registry URLs before Weaver runs.
tools/runner/src/opentelemetry/conformance/_domain.py	Localizes command-line registry overrides.
tools/runner/src/opentelemetry/conformance/_cli.py	Accepts URL registry arguments.
tools/runner/src/opentelemetry/conformance/__init__.py	Exports local_registry.
tools/runner/tests/test_registry.py	Tests parsing, caching, and host validation.
tools/runner/README.md	Documents YAML URL registries.
tools/gen-ai/runner/README.md	Documents CLI URL registries.

Review details

Suppressed comments (1)

tools/runner/src/opentelemetry/conformance/_registry.py:107

• The cache identity uses only the repository basename and ref. For example, org-a/model.git@main and org-b/model.git@main both map to model-main; once the first stamp exists, the second URL silently receives the first repository's checkout. Include the full repository identity (preferably a filesystem-safe digest) in the cache key.

    checkout = provision(
        repo, declared.ref or "HEAD", label=repo.rpartition("/")[2]
    )

• Files reviewed: 8/8 changed files
• Comments generated: 3
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

URL parsing, ref encoding, subfolder validation, and a public API regression must be addressed.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (2)

tools/runner/src/opentelemetry/conformance/_registry.py:108

• The parsed ref is passed into the archive URL without URL-encoding. # is allowed here (and in Git ref names), but in a URL it starts a fragment; for example @release#1 makes the HTTP request target /archive/release rather than the requested ref. Encode the ref as a URL path while preserving / before constructing the archive URL.

    checkout = provision(repo, declared.ref or "HEAD")

tools/runner/src/opentelemetry/conformance/_registry.py:109

• sub_folder is joined without ensuring it is relative to the fetched checkout. Values such as [/tmp/model] cause Path.__truediv__ to discard checkout, while [../../model] traverses outside it, so this can validate against an unrelated local directory instead of the declared repository subfolder. Reject absolute paths and .. components before joining.

    return checkout / declared.sub_folder if declared.sub_folder else checkout

• Files reviewed: 8/8 changed files
• Comments generated: 2
• Review effort level: Balanced