Documentation
¶
Index ¶
- Variables
- func ConvertToRawURL(githubURL string) (string, error)
- func GetArtifactDownloadURL(ctx context.Context, owner, repo string, artifactID int64) (string, error)
- func GetGitHubToken() string
- func GetGitHubTokenContext(ctx context.Context) string
- func GetGitHubTokenFromCLI() string
- func GetGitHubTokenFromCLIContext(parent context.Context) string
- func GetGitHubTokenOrError() (string, error)
- func GetLatestRelease(owner string, repo string) (string, error)
- func GetLatestReleaseInfo(owner, repo string) (*github.RepositoryRelease, error)
- func GetPRHeadSHA(ctx context.Context, owner, repo string, prNumber int, token string) (string, error)
- func GetRefSHA(ctx context.Context, owner, repo, ref string) (string, error)
- func GetReleaseByTag(owner, repo, tag string) (*github.RepositoryRelease, error)
- func GetReleaseVersions(owner, repo string, limit int) ([]string, error)
- func GetReleases(opts ReleasesOptions) ([]*github.RepositoryRelease, error)
- func IsApprovedGitHubDownloadHost(host string) bool
- func IsArchived(ctx context.Context, owner, repo string) (bool, error)
- func IsNoArtifactError(err error) bool
- func IsNoWorkflowError(err error) bool
- func IsNotFoundError(err error) bool
- func IsPlatformError(err error) bool
- func IsPublicGitHubHost(host string) bool
- func ListTags(ctx context.Context, owner, repo string) ([]*github.RepositoryTag, error)
- func NewScopedTokenHTTPClient(token string, allowed Endpoints, timeout time.Duration) *http.Client
- func ParseOwnerRepo(gitURI string) (owner, repo string, ok bool)
- func ResolveEndpointURL(envVar, fallback string) string
- func SetCommanderForTesting(c execpkg.CommandExecutor) (restore func())
- func ShouldWaitForRateLimit(ctx context.Context, minRemaining int) bool
- func ShouldWaitForRateLimitWithService(ctx context.Context, service RateLimitService, minRemaining int) bool
- func SupportedPRPlatforms() []string
- func TokenForEndpoints(endpoints Endpoints, token string) string
- func WaitForRateLimit(ctx context.Context, minRemaining int) error
- type ActionsService
- type ArtifactFetcher
- func (f *ArtifactFetcher) GetArtifactDownloadURL(ctx context.Context, owner, repo string, artifactID int64) (string, error)
- func (f *ArtifactFetcher) GetPRArtifactInfo(ctx context.Context, owner, repo string, prNumber int) (*PRArtifactInfo, error)
- func (f *ArtifactFetcher) GetPRHeadSHA(ctx context.Context, owner, repo string, prNumber int) (string, error)
- func (f *ArtifactFetcher) GetRefSHA(ctx context.Context, owner, repo, ref string) (string, error)
- func (f *ArtifactFetcher) GetSHAArtifactInfo(ctx context.Context, owner, repo, sha string) (*SHAArtifactInfo, error)
- type Endpoints
- func (e Endpoints) AllowsToken() bool
- func (e Endpoints) ArchiveURL(owner, repo, tag string) string
- func (e Endpoints) Hostname() string
- func (e Endpoints) IsAPIHost(host string) bool
- func (e Endpoints) IsAPIHostForScheme(host, scheme string) bool
- func (e Endpoints) IsHost(host string) bool
- func (e Endpoints) IsHostForScheme(host, scheme string) bool
- func (e Endpoints) IsUploadHost(host string) bool
- func (e Endpoints) IsUploadHostForScheme(host, scheme string) bool
- func (e Endpoints) RawURL(owner, repo, ref, path string) string
- func (e Endpoints) ReleaseAssetURL(owner, repo, tag, asset string) string
- type PRArtifactInfo
- type PullRequestService
- type RateLimitService
- type RateLimitStatus
- type ReleasesOptions
- type RepositoriesService
- type SHAArtifactInfo
Constants ¶
This section is empty.
Variables ¶
var ( // ErrPRNotFound indicates the PR does not exist. ErrPRNotFound = errors.New("pull request not found") // ErrNoWorkflowRunFound indicates no workflow run was found for the PR. ErrNoWorkflowRunFound = errors.New("no workflow run found") // ErrNoArtifactFound indicates the requested artifact was not found. ErrNoArtifactFound = errors.New("artifact not found") // ErrNoArtifactForPlatform indicates no artifact exists for the current platform. ErrNoArtifactForPlatform = errors.New("no artifact available for current platform") // ErrRefNotFound indicates the git ref (branch or tag) does not exist. ErrRefNotFound = errors.New("git ref not found") )
Artifact-related errors.
var ( // ErrInvalidGitHubURL indicates the GitHub URL format is invalid. ErrInvalidGitHubURL = errors.New("invalid GitHub URL") // ErrUnsupportedGitHubHost indicates the GitHub host is not supported. ErrUnsupportedGitHubHost = errors.New("unsupported GitHub host") // ErrNoVersionsFound indicates no versions were found for a repository. ErrNoVersionsFound = errors.New("no versions found") )
Error definitions for the github package.
var ErrGitHubTokenRequired = errors.New("GitHub token required")
ErrGitHubTokenRequired indicates that a GitHub token is required but not found.
var RateLimitWaiter = waitForRateLimitImpl
RateLimitWaiter is the function used to wait for rate limits. Tests can override this to skip the actual wait.
Functions ¶
func ConvertToRawURL ¶ added in v1.203.0
ConvertToRawURL converts a GitHub repository URL to its raw content URL. Supports various GitHub URL formats and converts them to raw content URLs: on github.com that is raw.githubusercontent.com; on a GitHub Enterprise Server host configured via RepoEndpoints (GITHUB_SERVER_URL/GITHUB_API_URL), raw content is served from the same host under /raw/ instead.
Examples (github.com):
- https://github.com/owner/repo/blob/main/path/file.yaml → https://raw.githubusercontent.com/owner/repo/main/path/file.yaml
- https://github.com/owner/repo/tree/v1.0.0/path → https://raw.githubusercontent.com/owner/repo/v1.0.0/path
- github://owner/repo/path/file.yaml@branch → https://raw.githubusercontent.com/owner/repo/branch/path/file.yaml
- github://owner/repo@v1.0.0 → https://raw.githubusercontent.com/owner/repo/v1.0.0
func GetArtifactDownloadURL ¶ added in v1.207.0
func GetArtifactDownloadURL(ctx context.Context, owner, repo string, artifactID int64) (string, error)
GetArtifactDownloadURL returns the download URL for a specific artifact. Downloads from public repositories work without authentication (subject to rate limits); private repositories require a token.
func GetGitHubToken ¶ added in v1.207.0
func GetGitHubToken() string
GetGitHubToken retrieves a GitHub token using multiple fallback strategies. The token is required for operations that need authentication (e.g., downloading PR artifacts).
Detection order:
- --github-token CLI flag (via viper, for toolchain commands)
- ATMOS_GITHUB_TOKEN environment variable
- GITHUB_TOKEN environment variable
- `gh auth token` command output (if GitHub CLI is installed)
Returns the token if found, or an empty string if no token is available. Use GetGitHubTokenOrError if you need to require authentication.
func GetGitHubTokenContext ¶ added in v1.229.0
GetGitHubTokenContext resolves an optional token while honoring caller cancellation.
func GetGitHubTokenFromCLI ¶ added in v1.226.0
func GetGitHubTokenFromCLI() string
GetGitHubTokenFromCLI attempts to get a token from the GitHub CLI. Returns empty string if the CLI is not installed, not authenticated, or disabled.
The CLI binary is configurable via the ATMOS_GITHUB_CLI environment variable (defaults to "gh"). Setting it to an empty value disables the fallback, and setting it to a nonexistent binary forces the unauthenticated/anonymous path (useful for exercising public access).
Exported so other packages needing GitHub CLI token resolution (e.g. the git-clone token injection in pkg/downloader) can call the same fallback without duplicating it.
func GetGitHubTokenFromCLIContext ¶ added in v1.229.0
GetGitHubTokenFromCLIContext bounds the CLI lookup by both caller cancellation and the existing five-second CLI timeout. Cancellation leaves the token empty.
func GetGitHubTokenOrError ¶ added in v1.207.0
GetGitHubTokenOrError retrieves a GitHub token or returns an error if none is found. Use this when authentication is required (e.g., downloading PR artifacts).
func GetLatestRelease ¶
GetLatestRelease returns the latest release tag for a GitHub repository.
func GetLatestReleaseInfo ¶
func GetLatestReleaseInfo(owner, repo string) (*github.RepositoryRelease, error)
GetLatestReleaseInfo fetches the latest stable release from GitHub.
func GetPRHeadSHA ¶ added in v1.207.0
func GetPRHeadSHA(ctx context.Context, owner, repo string, prNumber int, token string) (string, error)
GetPRHeadSHA retrieves the current head commit SHA for a pull request. This is used for cache validation to check if the PR has new commits. The token parameter is used for API authentication if available; empty string for unauthenticated access.
func GetRefSHA ¶ added in v1.221.0
GetRefSHA resolves a git ref (branch or tag name) to its full commit SHA. It accepts bare names ("main", "v1.2.3") as well as qualified refs ("heads/main", "tags/v1.2.3") for disambiguation. The returned SHA is the full 40-character commit SHA, which is what the artifact lookup requires. Works without authentication for public repositories (subject to rate limits).
func GetReleaseByTag ¶
func GetReleaseByTag(owner, repo, tag string) (*github.RepositoryRelease, error)
GetReleaseByTag fetches a specific GitHub release by tag name.
func GetReleaseVersions ¶ added in v1.203.0
GetReleaseVersions fetches release versions as strings (tag names without 'v' prefix). Returns only non-prerelease versions, for toolchain version management: it is scoped to ToolchainEndpoints, not RepoEndpoints, since toolchain-managed tool releases live on public github.com by default even for GHES users.
func GetReleases ¶
func GetReleases(opts ReleasesOptions) ([]*github.RepositoryRelease, error)
GetReleases fetches GitHub releases with pagination, prerelease filtering, and date filtering, scoped to RepoEndpoints (the user's own repositories).
func IsApprovedGitHubDownloadHost ¶ added in v1.229.0
IsApprovedGitHubDownloadHost reports whether host (case-insensitive, with port and trailing dot normalized) is a server, API, or upload host that RepoEndpoints() or ToolchainEndpoints() resolves to. Used to validate a GitHub-issued download or redirect URL (e.g. a PR-artifact archive download, which redirects to a pre-signed, unauthenticated blob URL) before deciding whether it is safe to attach a bearer token to a request against it.
func IsArchived ¶ added in v1.223.0
IsArchived reports whether a GitHub repository is archived. Archived-ness is repository metadata only exposed by the GitHub REST API (the `Archived` field on *github.Repository`), not by the git wire protocol used for tag listing, so this is a separate API call/round-trip from ListTags. Authentication and rate-limit handling follow the shared client behavior (see newGitHubClient/handleGitHubAPIError).
func IsNoArtifactError ¶ added in v1.207.0
IsNoArtifactError checks if the error is a "no artifact" error.
func IsNoWorkflowError ¶ added in v1.207.0
IsNoWorkflowError checks if the error is a "no workflow run" error.
func IsNotFoundError ¶ added in v1.207.0
IsNotFoundError checks if the error is a "not found" type error.
func IsPlatformError ¶ added in v1.207.0
IsPlatformError checks if the error is a platform-related error.
func IsPublicGitHubHost ¶ added in v1.229.0
IsPublicGitHubHost reports whether host (case-insensitive, with port and trailing dot normalized) is public github.com, independent of whatever RepoEndpoints resolves to. Callers that must still recognize an explicit public github.com URL even when GITHUB_SERVER_URL points at a GitHub Enterprise Server host (e.g. converting a public github.com blob URL to raw content for an !include, regardless of the caller's own GHES configuration) should check this in addition to RepoEndpoints().IsHost.
func ListTags ¶ added in v1.223.0
ListTags returns all tags for a repository, newest first as reported by the GitHub API, including each tag's commit SHA. Pagination is handled internally; authentication and rate-limit handling follow the shared client behavior.
func NewScopedTokenHTTPClient ¶ added in v1.229.0
NewScopedTokenHTTPClient returns an *http.Client, honoring timeout, that attaches "Authorization: Bearer <token>" to a request only when -- re-evaluated on every hop of an automatic redirect, not decided once up front -- the request's own URL is https and its host matches allowed's server, API, or upload host. Token is passed through TokenForEndpoints first, so an empty result (allowed's own API host is not https) means no request ever carries a token, matching newGitHubClientForEndpoints' existing behavior for that case.
Centralizes the fix for a class of bug where a token is decided once from an initial URL/host, then a redirect (cross-host, or the same host downgraded from https to http) sends it somewhere it was never scoped to: pkg/ci/artifact/github/store.go, pkg/ci/cache/github, and pkg/github's own GitHub API client all build their *http.Client this way.
func ParseOwnerRepo ¶ added in v1.223.0
ParseOwnerRepo extracts the owner and repository name from a Git URI, as produced by version.ExtractGitURI (e.g. "https://github.com/owner/repo.git"). It returns ok=false for any URI that isn't a github.com repository (GitLab, Bitbucket, self-hosted Git servers, etc.), so callers can skip GitHub-only capabilities (like archived-repo detection) for those sources without treating it as an error.
func ResolveEndpointURL ¶ added in v1.229.0
ResolveEndpointURL reads envVar and returns its value trimmed of a trailing slash, or fallback when the variable is unset or its value fails to parse as an absolute HTTP(S) URL, or when it carries a query string, fragment, or userinfo component. A base URL is only ever used as a prefix that owner/repo/ref/path segments are appended to (see e.g. RawURL, ReleaseAssetURL, ArchiveURL): a RawQuery would silently vanish once those segments are appended after it (net/url's String() places the query after the whole path), a Fragment would do the same, and a User component would leak credentials into every URL built from it and complicate host comparisons that assume a bare authority. Invalid values are never fatal: they are logged at debug level and the caller falls back to the default endpoint, matching today's behavior for anyone not opting into GHES. Exported because it is shared by the toolchain registries (e.g. the aqua package's RegistryBaseURL) in addition to RepoEndpoints and ToolchainEndpoints above.
http:// is accepted here on purpose: the acceptance and unit test suites point these endpoints at local httptest/httpmock servers over plain HTTP, and resolution must keep working for them. Accepting http here is not itself a credential leak -- the leak would be attaching a token to a request built against a non-https endpoint, which is prevented centrally by TokenForEndpoints (and newGitHubClientForEndpoints, which calls it), not by rejecting http endpoints here.
func SetCommanderForTesting ¶ added in v1.226.0
func SetCommanderForTesting(c execpkg.CommandExecutor) (restore func())
SetCommanderForTesting overrides the package-level GitHub CLI command executor, for tests in other packages that exercise GetGitHubTokenFromCLI indirectly (e.g. pkg/downloader's git-clone token injection). Returns a restore func the caller must invoke (typically via t.Cleanup) to put the original commander back.
func ShouldWaitForRateLimit ¶ added in v1.203.0
ShouldWaitForRateLimit checks if rate limit is low enough to warrant waiting. This is a non-blocking check that just returns the decision.
func ShouldWaitForRateLimitWithService ¶ added in v1.203.0
func ShouldWaitForRateLimitWithService(ctx context.Context, service RateLimitService, minRemaining int) bool
ShouldWaitForRateLimitWithService checks if rate limit is low using a custom service. This is primarily used for testing with mock services.
func SupportedPRPlatforms ¶ added in v1.207.0
func SupportedPRPlatforms() []string
SupportedPRPlatforms returns a list of platforms supported by PR artifact downloads.
func TokenForEndpoints ¶ added in v1.229.0
TokenForEndpoints returns token unchanged when endpoints.AllowsToken() (its API host is https), or "" otherwise, logging at debug level so a non-https endpoint that withholds a configured token is diagnosable rather than silently degrading to anonymous access. This centralizes the "never send a token over http" rule for every caller that builds an authenticated GitHub request or client from RepoEndpoints()/ToolchainEndpoints().
func WaitForRateLimit ¶ added in v1.203.0
WaitForRateLimit checks GitHub rate limits and waits if necessary. If remaining requests are below minRemaining, it waits until the rate limit resets. Uses a spinner UI in TTY mode, otherwise simple output. Returns nil on success or context cancellation error. Does not return error on rate limit check failures (to avoid blocking operations).
Types ¶
type ActionsService ¶ added in v1.207.0
type ActionsService interface {
ListRepositoryWorkflowRuns(ctx context.Context, owner, repo string, opts *github.ListWorkflowRunsOptions) (*github.WorkflowRuns, *github.Response, error)
ListWorkflowRunArtifacts(ctx context.Context, owner, repo string, runID int64, opts *github.ListOptions) (*github.ArtifactList, *github.Response, error)
GetArtifact(ctx context.Context, owner, repo string, artifactID int64) (*github.Artifact, *github.Response, error)
}
ActionsService defines the interface for GitHub Actions operations. This allows for mocking in tests.
type ArtifactFetcher ¶ added in v1.207.0
type ArtifactFetcher struct {
// contains filtered or unexported fields
}
ArtifactFetcher wraps the artifact fetching logic with injectable services. Use NewArtifactFetcher to create an instance with custom services for testing.
func NewArtifactFetcher ¶ added in v1.207.0
func NewArtifactFetcher(prs PullRequestService, actions ActionsService) *ArtifactFetcher
NewArtifactFetcher creates an ArtifactFetcher with custom services. This is primarily used for testing with mock services.
func NewToolchainArtifactFetcher ¶ added in v1.229.0
func NewToolchainArtifactFetcher(ctx context.Context) *ArtifactFetcher
NewToolchainArtifactFetcher returns an ArtifactFetcher backed by a GitHub client scoped to ToolchainEndpoints rather than RepoEndpoints. Use this (instead of the free GetPRArtifactInfo/ GetPRHeadSHA/GetSHAArtifactInfo/GetRefSHA functions) when fetching build artifacts of a toolchain-managed repository -- e.g. atmos's own PR/SHA/ref build artifacts for self-install -- which live on public github.com by default even for GHES users.
func (*ArtifactFetcher) GetArtifactDownloadURL ¶ added in v1.207.0
func (f *ArtifactFetcher) GetArtifactDownloadURL(ctx context.Context, owner, repo string, artifactID int64) (string, error)
GetArtifactDownloadURL returns the download URL using custom services.
func (*ArtifactFetcher) GetPRArtifactInfo ¶ added in v1.207.0
func (f *ArtifactFetcher) GetPRArtifactInfo(ctx context.Context, owner, repo string, prNumber int) (*PRArtifactInfo, error)
GetPRArtifactInfo retrieves build artifact info for a PR using custom services.
func (*ArtifactFetcher) GetPRHeadSHA ¶ added in v1.207.0
func (f *ArtifactFetcher) GetPRHeadSHA(ctx context.Context, owner, repo string, prNumber int) (string, error)
GetPRHeadSHA retrieves the head SHA for a PR using custom services.
func (*ArtifactFetcher) GetRefSHA ¶ added in v1.221.0
GetRefSHA resolves a git ref to its full commit SHA using custom services.
func (*ArtifactFetcher) GetSHAArtifactInfo ¶ added in v1.207.0
func (f *ArtifactFetcher) GetSHAArtifactInfo(ctx context.Context, owner, repo, sha string) (*SHAArtifactInfo, error)
GetSHAArtifactInfo retrieves build artifact info for a SHA using custom services.
type Endpoints ¶ added in v1.229.0
type Endpoints struct {
// ServerURL is the web/clone host, e.g. "https://github.com" or "https://ghes.example.com".
ServerURL string
// APIURL is the REST API base, e.g. "https://api.github.com" or "https://ghes.example.com/api/v3".
APIURL string
// UploadURL is the API host used for release asset uploads, e.g. "https://uploads.github.com"
// on github.com, or "<ServerURL>/api/uploads" on GHES.
UploadURL string
// Host is the normalized host of ServerURL (lowercased, no trailing dot, no default port).
// It may still carry a non-default port (e.g. "ghes.example.com:8443") -- normalizeHost
// only strips the default 80/443 ports, so a GHES host (or test mock) reachable only on a
// non-default port keeps that port here and can still match its own URLs via IsHost.
Host string
}
Endpoints describes where a set of GitHub (or GitHub Enterprise Server) resources live: the web UI/clone host, the REST API host, and the derived upload host. Two independent concerns resolve to their own Endpoints value:
- RepoEndpoints reads GITHUB_SERVER_URL / GITHUB_API_URL — where the *user's* repositories live (CI provider, imports/vendoring, releases/tags/artifacts API, token host allowlist).
- ToolchainEndpoints reads ATMOS_TOOLCHAIN_GITHUB_URL / ATMOS_TOOLCHAIN_GITHUB_API_URL — where toolchain release assets live. This is deliberately separate: toolchain assets (and the aqua-registry mirror, resolved independently by the aqua package) live on public github.com even for GHES users, so the toolchain must not follow the repo vars (doing so would break `atmos toolchain install` on every GHES runner).
Both env vars, on both constructors, default to public GitHub.com so behavior is byte-identical to today when unset.
func RepoEndpoints ¶ added in v1.229.0
func RepoEndpoints() Endpoints
RepoEndpoints resolves the endpoints for the user's own repositories from the standard GITHUB_SERVER_URL / GITHUB_API_URL environment variables (the same variables GitHub Actions exports on both github.com and GitHub Enterprise Server runners). Consumed by the CI provider, imports/vendoring raw fetches, the pkg/github API client, the token host allowlist, and token-injection host recognition.
func ToolchainEndpoints ¶ added in v1.229.0
func ToolchainEndpoints() Endpoints
ToolchainEndpoints resolves the endpoints for toolchain release assets and archives from ATMOS_TOOLCHAIN_GITHUB_URL / ATMOS_TOOLCHAIN_GITHUB_API_URL. These are separate from RepoEndpoints because aqua-registry tools are hosted on public github.com even when the user's own repositories live on a GitHub Enterprise Server. Useful for corporate release proxies/mirrors that front public GitHub releases.
func (Endpoints) AllowsToken ¶ added in v1.229.0
AllowsToken reports whether it is safe to attach a bearer/OAuth token to a request against this Endpoints value's API host: only when APIURL resolves to an https URL. Sending a token over plain HTTP would put it on the wire in cleartext. ResolveEndpointURL intentionally accepts http:// (the acceptance/unit test suites point endpoints at local httptest/httpmock servers over plain HTTP), so those endpoints must still resolve -- they simply must never be paired with a token.
func (Endpoints) ArchiveURL ¶ added in v1.229.0
ArchiveURL builds the URL for downloading a tag's source archive (`/<owner>/<repo>/archive/refs/tags/<tag>.tar.gz`), identical on github.com and GHES. Each component is percent-encoded as a single opaque path segment.
func (Endpoints) Hostname ¶ added in v1.229.0
Hostname returns e.Host with any port stripped, e.g. "ghes.example.com:8443" becomes "ghes.example.com". Host deliberately keeps a non-default port (see its doc comment) so IsHost can match a GHES instance reachable only on a non-default port; callers that need to compare against a portless value instead -- e.g. the host captured from an SCP-style Git remote (git@host:org/repo.git), which carries no port of its own -- use this instead of comparing against Host directly.
func (Endpoints) IsAPIHost ¶ added in v1.229.0
IsAPIHost reports whether host (case-insensitive, with port and trailing dot normalized) matches this Endpoints value's API host (derived from APIURL). This can differ from IsHost (ServerURL's host) for a corporate mirror that fronts the web/clone host and the API host separately, e.g. ATMOS_TOOLCHAIN_GITHUB_URL and ATMOS_TOOLCHAIN_GITHUB_API_URL pointing at different hosts. Callers that authenticate requests sent to APIURL (rather than ServerURL) should check this in addition to IsHost.
func (Endpoints) IsAPIHostForScheme ¶ added in v1.229.0
IsAPIHostForScheme is IsAPIHost's scheme-aware sibling (see normalizeHostForScheme). Callers deciding whether to attach a bearer/OAuth token to a request MUST use this instead of IsAPIHost.
func (Endpoints) IsHost ¶ added in v1.229.0
IsHost reports whether host (case-insensitive, with port and trailing dot normalized) matches this Endpoints value's own Host. It intentionally does not also match "github.com": callers that need to recognize both this endpoint's host and public github.com (e.g. because toolchain assets are always public even under GHES) combine IsHost with an explicit github.com check.
func (Endpoints) IsHostForScheme ¶ added in v1.229.0
IsHostForScheme is IsHost's scheme-aware sibling (see normalizeHostForScheme): it strips only the default port for scheme instead of unconditionally stripping both 80 and 443, so an explicit non-default port (e.g. "host:80" for a "https" request) never matches the bare configured host. Callers deciding whether to attach a bearer/OAuth token to a request -- where the scheme is already known -- MUST use this instead of IsHost.
func (Endpoints) IsUploadHost ¶ added in v1.229.0
IsUploadHost reports whether host (case-insensitive, with port and trailing dot normalized) matches this Endpoints value's upload host (derived from UploadURL). This can differ from both IsHost and IsAPIHost, e.g. on public github.com uploads go to the separate uploads.github.com host. Callers that authenticate requests sent for release-asset uploads should check this in addition to IsHost/IsAPIHost.
func (Endpoints) IsUploadHostForScheme ¶ added in v1.229.0
IsUploadHostForScheme is IsUploadHost's scheme-aware sibling (see normalizeHostForScheme). Callers deciding whether to attach a bearer/OAuth token to a request MUST use this instead of IsUploadHost.
func (Endpoints) RawURL ¶ added in v1.229.0
RawURL builds the URL for fetching a file's raw content at ref from owner/repo. On github.com this is raw.githubusercontent.com; on GitHub Enterprise Server, raw content is served from the same host under /raw/ instead of a separate subdomain. Path may be empty (returns the ref root) and any leading slash is stripped.
Owner, repo, and ref are percent-encoded as single opaque path segments -- a "/" occurring within one of them (e.g. a malicious or malformed ref) is escaped as data ("%2F") rather than reinterpreted as an additional path separator. Path is a genuine multi-segment file path, so each "/"-separated segment is escaped independently instead.
func (Endpoints) ReleaseAssetURL ¶ added in v1.229.0
ReleaseAssetURL builds the URL for downloading a release asset. The path shape (`/<owner>/<repo>/releases/download/<tag>/<asset>`) is identical on github.com and GHES. Each component is percent-encoded as a single opaque path segment.
type PRArtifactInfo ¶ added in v1.207.0
type PRArtifactInfo struct {
// PR number.
PRNumber int
// Head SHA of the PR.
HeadSHA string
// Workflow run ID that produced the artifact.
RunID int64
// Artifact ID.
ArtifactID int64
// Artifact name (e.g., "build-artifacts-macos").
ArtifactName string
// Size in bytes.
SizeInBytes int64
// Download URL. Downloads from public repositories work without authentication
// (subject to rate limits); private repositories require a token.
DownloadURL string
// RunStartedAt is when the workflow run started.
RunStartedAt time.Time
}
PRArtifactInfo contains information about a PR's build artifact.
func GetPRArtifactInfo ¶ added in v1.207.0
func GetPRArtifactInfo(ctx context.Context, owner, repo string, prNumber int) (*PRArtifactInfo, error)
GetPRArtifactInfo retrieves build artifact information for a PR. This finds the latest successful workflow run for the PR and locates the artifact matching the current platform. Works without authentication for public repositories (subject to rate limits).
type PullRequestService ¶ added in v1.207.0
type PullRequestService interface {
Get(ctx context.Context, owner string, repo string, number int) (*github.PullRequest, *github.Response, error)
}
PullRequestService defines the interface for pull request operations. This allows for mocking in tests.
type RateLimitService ¶ added in v1.203.0
type RateLimitService interface {
Get(ctx context.Context) (*github.RateLimits, *github.Response, error)
}
RateLimitService defines the interface for rate limit operations. This allows for mocking in tests.
type RateLimitStatus ¶ added in v1.203.0
type RateLimitStatus struct {
// Remaining is the number of requests remaining in the current rate limit window.
Remaining int
// Limit is the maximum number of requests allowed in the rate limit window.
Limit int
// ResetAt is when the rate limit will reset.
ResetAt time.Time
}
RateLimitStatus contains information about GitHub API rate limits.
func CheckRateLimit ¶ added in v1.203.0
func CheckRateLimit(ctx context.Context) (*RateLimitStatus, error)
CheckRateLimit queries the GitHub API for current rate limit status. Returns nil status (not error) if the check fails, to avoid blocking operations.
func CheckRateLimitWithService ¶ added in v1.203.0
func CheckRateLimitWithService(ctx context.Context, service RateLimitService) (*RateLimitStatus, error)
CheckRateLimitWithService queries the GitHub API using a custom service. This is primarily used for testing with mock services.
type ReleasesOptions ¶
type ReleasesOptions struct {
Owner string
Repo string
Limit int
Offset int
IncludePrereleases bool
Since *time.Time
}
ReleasesOptions contains options for fetching GitHub releases.
type RepositoriesService ¶ added in v1.221.0
type RepositoriesService interface {
GetCommitSHA1(ctx context.Context, owner, repo, ref, lastSHA string) (string, *github.Response, error)
}
RepositoriesService defines the interface for repository operations. This allows for mocking in tests.
type SHAArtifactInfo ¶ added in v1.207.0
type SHAArtifactInfo struct {
// Head SHA of the commit.
HeadSHA string
// Workflow run ID that produced the artifact.
RunID int64
// Artifact ID.
ArtifactID int64
// Artifact name (e.g., "build-artifacts-macos").
ArtifactName string
// Size in bytes.
SizeInBytes int64
// Download URL. Downloads from public repositories work without authentication
// (subject to rate limits); private repositories require a token.
DownloadURL string
// RunStartedAt is when the workflow run started.
RunStartedAt time.Time
}
SHAArtifactInfo contains information about a SHA's build artifact.
func GetSHAArtifactInfo ¶ added in v1.207.0
func GetSHAArtifactInfo(ctx context.Context, owner, repo, sha string) (*SHAArtifactInfo, error)
GetSHAArtifactInfo retrieves build artifact information for a commit SHA. This finds the latest successful workflow run for the SHA and locates the artifact matching the current platform. Works without authentication for public repositories (subject to rate limits).
Source Files
¶
Directories
¶
| Path | Synopsis |
|---|---|
|
Package actions provides utilities for GitHub Actions workflows.
|
Package actions provides utilities for GitHub Actions workflows. |
|
Package oidc reads GitHub Actions OIDC token claims (repository, environment, ref) for runtime context detection.
|
Package oidc reads GitHub Actions OIDC token claims (repository, environment, ref) for runtime context detection. |