unkin-agent
2905ec99e4
The generic `github` remote only allowlists URL patterns: every repo needs hand-written mutable patterns for branch archives, and a moved branch re-downloads the whole archive under a ref-named key. - add `vcs` package type for GitHub or Gitea (picked from `base_url`) tag, commit and release-download paths, cached immutable - redirect `archive/refs/heads/<branch>` to the commit archive, resolving the branch via the branch API with one shared, per-remote bounded lookup cache reused for `mutable_ttl` - cache missing branches for at least 60s and map API rate limits to `503` with `Retry-After` - reject any other path shape, escaping segments and denied redirect targets - add `docs/vcs/remote.md`, a UI type def and a vcs e2e caching case Reviewed-on: #162 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
2.0 KiB
vcs remote
Shared classification, TTL and eviction rules: caching.
Caches source archives and release assets from GitHub (base_url = "https://github.com") or Gitea (any other base_url). GitHub Enterprise is not supported: a non-github.com host is treated as Gitea. Only the paths below are served; anything else is a 404.
| Path | Behaviour |
|---|---|
<owner>/<repo>/archive/refs/tags/<tag>.(tar.gz|zip) |
immutable |
<owner>/<repo>/archive/<40-char sha>.(tar.gz|zip) |
immutable |
<owner>/<repo>/releases/download/<tag>/<asset> |
immutable |
<owner>/<repo>/releases/latest/download/<asset> |
mutable |
<owner>/<repo>/archive/refs/heads/<branch>.(tar.gz|zip) |
302 to the archive of the branch's current commit, resolved via the provider's branch API and reused for mutable_ttl |
Branch archives redirect, so curl needs -L; pip and npm follow redirects. The archive is the host's commit archive (GitHub names its top-level directory <repo>-<sha>). patterns and blocklist match both the branch path and the commit path it redirects to, so allowlist repos by prefix (^cli/cli/); a branch whose commit path is denied is a 403. A missing branch is a 404, cached for mutable_ttl (at least 60s). An API rate limit (429, or 403 with rate-limit headers) is a 503 with Retry-After, unless stale_on_error serves the last known commit. Each remote caches up to 4096 branch lookups. GitHub API calls use the server GitHub credential; Gitea API calls use the remote's username/password.
resource "artifactapi_remote_vcs" "github" {
name = "github-vcs"
base_url = "https://github.com"
mutable_ttl = 600
patterns = ["^cli/cli/", "^psf/requests/"]
}
curl -fsSLO https://artifactapi.example/api/v1/remote/github-vcs/cli/cli/archive/refs/tags/v2.60.0.tar.gz
pip install https://artifactapi.example/api/v1/remote/github-vcs/psf/requests/archive/refs/tags/v2.32.3.tar.gz