The wildcard heads entries admitted a branch archive from any repository
on GitHub. patterns is the admission allowlist, so only the repos that
need a branch install belong in it.
- Replace the wildcard heads entries with one anchored entry per repo
- Cover the 14 Neovim plugins that publish no tags, zip and tar.gz
- List each repo in both patterns and mutable_patterns
patterns is a strict allowlist evaluated before mutable_patterns, so
/archive/refs/heads/ downloads are denied despite the mutable entry.
- Add heads .zip and .tar.gz to patterns
- Add heads .zip to mutable_patterns and escape the tar.gz dots
jellyfin-ha bakes the LDAP and SSO auth plugins into its image, and all
outside artifacts must be fetched via artifactapi rather than direct.
- Add remote_generic/jellyfin.yaml proxying repo.jellyfin.org, scoped to
the ldap-authentication plugin zip.
- Add a github.yaml pattern for 9p4/jellyfin-plugin-sso release zips
(GitHub redirects release downloads to objects.githubusercontent.com,
which the existing github remote already follows).
The iplocate patterns were added to mutable_patterns only, which tags TTL but
does not allowlist — requests 403'd 'access denied'. Verified: existing
mutable_patterns-only paths (branch archives, webadmin) also 403, while patterns
entries (uv) return 200. Add the iplocate patterns to patterns (the allowlist),
keeping them in mutable_patterns so the daily-updated DB stays mutable.
Add patterns to the github.com generic remote for the iplocate ip-to-asn /
ip-to-country databases rather than standing up a new remote. The files are
Git-LFS, so the /raw/ path redirects to media.githubusercontent.com; the github
remote already follows github's cross-host redirects (as it does for release
assets), and the raw path returns the real bytes (verified: 12MB zip / 78MB mmdb).
Marked mutable (branch content).
unkin-agent
unkinben
benvin