artifactapi/docs/vcs/remote.md

vcs remote

Shared classification, TTL and eviction rules: caching.

Caches source archives and release assets from GitHub (base_url = "https://github.com") or any Gitea (any other base_url). Only the paths below are served; anything else is a 404.

Path	Behaviour
<owner>/<repo>/archive/refs/tags/<tag>.(tar.gz|zip)	immutable
<owner>/<repo>/archive/<40-char sha>.(tar.gz|zip)	immutable
<owner>/<repo>/releases/download/<tag>/<asset>	immutable
<owner>/<repo>/releases/latest/download/<asset>	mutable
<owner>/<repo>/archive/refs/heads/<branch>.(tar.gz|zip)	302 to the archive of the branch's current commit, resolved via the provider API and reused for mutable_ttl

Branch archives redirect, so curl needs -L; pip and npm follow redirects. The archive is the host's commit archive (GitHub names its top-level directory <repo>-<sha>). patterns and blocklist match both the branch path and the commit path it redirects to, so allowlist repos by prefix (^cli/cli/). GitHub API calls use the server GitHub credential; Gitea API calls use the remote's username/password.

resource "artifactapi_remote_vcs" "github" {
  name        = "github-vcs"
  base_url    = "https://github.com"
  mutable_ttl = 600
  patterns    = ["^cli/cli/", "^psf/requests/"]
}

curl -fsSLO https://artifactapi.example/api/v1/remote/github-vcs/cli/cli/archive/refs/tags/v2.60.0.tar.gz
pip install https://artifactapi.example/api/v1/remote/github-vcs/psf/requests/archive/refs/tags/v2.32.3.tar.gz