# `vcs` remote

Shared classification, TTL and eviction rules: [caching](../common/caching.md).

Caches source archives and release assets from GitHub (`base_url = "https://github.com"`) or any Gitea (any other `base_url`). Only the paths below are served; anything else is a 404.

| Path | Behaviour |
|---|---|
| `<owner>/<repo>/archive/refs/tags/<tag>.(tar.gz\|zip)` | immutable |
| `<owner>/<repo>/archive/<40-char sha>.(tar.gz\|zip)` | immutable |
| `<owner>/<repo>/releases/download/<tag>/<asset>` | immutable |
| `<owner>/<repo>/releases/latest/download/<asset>` | mutable |
| `<owner>/<repo>/archive/refs/heads/<branch>.(tar.gz\|zip)` | `302` to the archive of the branch's current commit, resolved via the provider API and reused for `mutable_ttl` |

Branch archives redirect, so `curl` needs `-L`; pip, npm and go follow redirects. The archive's top-level directory is `<repo>-<sha>`. `patterns` and `blocklist` match both the branch path and the commit path it redirects to, so allowlist repos by prefix (`^cli/cli/`). GitHub API calls use the [server GitHub credential](../../README.md#github-authentication); Gitea API calls use the remote's `username`/`password`.

```hcl
resource "artifactapi_remote_vcs" "github" {
  name        = "github-vcs"
  base_url    = "https://github.com"
  mutable_ttl = 600
  patterns    = ["^cli/cli/", "^psf/requests/"]
}
```

```bash
curl -fsSLO https://artifactapi.example/api/v1/remote/github-vcs/cli/cli/archive/refs/tags/v2.60.0.tar.gz
pip install https://artifactapi.example/api/v1/remote/github-vcs/psf/requests/archive/refs/tags/v2.32.3.tar.gz
```