The wildcard heads entries admitted a branch archive from any repository
on GitHub. patterns is the admission allowlist, so only the repos that
need a branch install belong in it.
- Replace the wildcard heads entries with one anchored entry per repo
- Cover the 14 Neovim plugins that publish no tags, zip and tar.gz
- List each repo in both patterns and mutable_patterns
patterns is a strict allowlist evaluated before mutable_patterns, so
/archive/refs/heads/ downloads are denied despite the mutable entry.
- Add heads .zip and .tar.gz to patterns
- Add heads .zip to mutable_patterns and escape the tar.gz dots
unkin-agent