Document SCP-like URL limitation for relative submodules

- Add explicit check for SCP-like parent URLs when resolving relative submodules
- Return clear error message with link to tracking issue
- Document limitation in function doc comment
- Add test cases for SCP parent with relative and absolute submodule URLs

Addresses review feedback from johnstcn.

Author: bjornrobertsson

git/git.go

@@ -499,12 +499,22 @@ func RedactURL(u string) string {
 }
 
 // ResolveSubmoduleURL resolves a potentially relative submodule URL against a parent repository URL.
+//
+// Limitation: SCP-like URLs (e.g., git@github.com:org/repo.git) are not supported as parent URLs
+// when the submodule uses a relative path. This is a known limitation.
+// See: https://github.com/coder/envbuilder/issues/487
 func ResolveSubmoduleURL(parentURL, submoduleURL string) (string, error) {
 	// If the submodule URL is absolute (contains ://) or doesn't start with ./ or ../, return it as-is
 	if strings.Contains(submoduleURL, "://") || (!strings.HasPrefix(submoduleURL, "../") && !strings.HasPrefix(submoduleURL, "./")) {
 		return submoduleURL, nil
 	}
 
+	// Check if parent URL is SCP-like (e.g., git@github.com:org/repo.git)
+	// These cannot be properly parsed by net/url and relative submodule resolution is not supported.
+	if scpLikeURLRegex.MatchString(parentURL) {
+		return "", fmt.Errorf("relative submodule URL %q cannot be resolved: parent URL %q uses SCP-like syntax which is not supported for relative submodule resolution (see https://github.com/coder/envbuilder/issues/487)", submoduleURL, RedactURL(parentURL))
+	}
+
 	// Parse the parent URL
 	parentParsed, err := url.Parse(parentURL)
 	if err != nil {

git/git_test.go

@@ -812,6 +812,18 @@ func TestResolveSubmoduleURL(t *testing.T) {
 			subURL:    "./child",
 			expectErr: "parse parent URL",
 		},
+		{
+			name:      "scpParentWithRelativeSubmodule",
+			parentURL: "git@github.com:org/main.git",
+			subURL:    "../other/submodule.git",
+			expectErr: "SCP-like syntax which is not supported",
+		},
+		{
+			name:      "scpParentWithAbsoluteSubmodule",
+			parentURL: "git@github.com:org/main.git",
+			subURL:    "https://github.com/other/submodule.git",
+			expect:    "https://github.com/other/submodule.git",
+		},
 	}
 
 	for _, tc := range cases {