unkin/terraform-artifactapi
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow GitHub branch archives through the github remote #45

Merged
benvin merged 2 commits from benvin/github-branch-archives into main 2026-09-11 23:37:08 +10:00
Conversation 0 Commits 2 Files Changed 1
+34 -1
unkin-agent commented 2026-09-11 23:26:37 +10:00
Member
Copy Link
Copy Source

Branch (head) archives from GitHub return 403. patterns is a strict allowlist evaluated before mutable_patterns, so /archive/refs/heads/ paths are denied before the mutable entry is consulted. Fourteen Neovim plugins publish no tags at all, so a branch archive is the only way to fetch them.

  • Admit those fourteen repos with one anchored entry each, .zip and .tar.gz
  • Pin each entry to the repo's real default branch, main or master
  • Repeat every entry in mutable_patterns so branch archives revalidate on the mutable TTL
  • Drop the wildcard heads entries, which admitted any repository on GitHub
Branch (head) archives from GitHub return 403. `patterns` is a strict allowlist evaluated before `mutable_patterns`, so `/archive/refs/heads/` paths are denied before the mutable entry is consulted. Fourteen Neovim plugins publish no tags at all, so a branch archive is the only way to fetch them. - Admit those fourteen repos with one anchored entry each, `.zip` and `.tar.gz` - Pin each entry to the repo's real default branch, `main` or `master` - Repeat every entry in `mutable_patterns` so branch archives revalidate on the mutable TTL - Drop the wildcard heads entries, which admitted any repository on GitHub
unkin-agent added 1 commit 2026-09-11 23:26:37 +10:00
Allow GitHub branch archives through the github remote
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
b76fddecb9 
patterns is a strict allowlist evaluated before mutable_patterns, so
/archive/refs/heads/ downloads are denied despite the mutable entry.

- Add heads .zip and .tar.gz to patterns
- Add heads .zip to mutable_patterns and escape the tar.gz dots
unkin-agent added 1 commit 2026-09-11 23:34:17 +10:00
Narrow GitHub branch archives to named repos
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
d7542d8fe2 
The wildcard heads entries admitted a branch archive from any repository
on GitHub. patterns is the admission allowlist, so only the repos that
need a branch install belong in it.

- Replace the wildcard heads entries with one anchored entry per repo
- Cover the 14 Neovim plugins that publish no tags, zip and tar.gz
- List each repo in both patterns and mutable_patterns
benvin merged commit 03eb79f27b into main 2026-09-11 23:37:08 +10:00
benvin deleted branch benvin/github-branch-archives 2026-09-11 23:37:08 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-artifactapi#45
Delete Branch "benvin/github-branch-archives"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?