[risu729]

Summary

• add authenticated GitHub API transport URLs for aqua github_content packages
• add authenticated GitHub API transport URLs for aqua github_archive packages
• request raw bytes from the GitHub Contents API
• retain public URL probing and API fallback when packages are not marked private
• persist API fallback URLs in generated lock metadata

Why

Private github_content and github_archive packages currently resolve versions through the authenticated GitHub API but fail when mise downloads from raw.githubusercontent.com or the public archive URL. Those browser-facing URLs return 404 for private repositories and do not receive GitHub API credentials.

Declared-private packages now go directly to an authenticated API endpoint. Packages without the marker retain reachability probing and fallback, which supports custom registries with missing or incorrect private metadata.

Validation

• cargo fmt --all -- --check
• cargo test test_pick_reachable_asset_url
• cargo test test_github_archive_api_url
• cargo test test_github_content_api_url
• cargo test test_private_github_download_uses_api_url_without_probe
• cargo test test_github_content_headers_request_raw_content

Summary by CodeRabbit

• Bug Fixes

  • Improved GitHub download and asset resolution for both public and private repositories, including checksums, signatures, and provenance-related files.
  • Enhanced URL transport selection and private-repo probing to better handle API vs browser endpoints.
  • Updated GitHub content request handling to support raw content downloads via the appropriate Accept header.

• Documentation

  • Clarified how GitHub asset URL selection behaves for public vs private repositories and fallback conditions.

• Tests

  • Added/updated unit tests for GitHub URL selection logic, URL encoding, probe URL behavior, and raw content request headers.

[coderabbitai]

📝 Walkthrough

Walkthrough

GitHub archive and content packages now retain encoded API transport URLs. Download, provenance, and auxiliary asset resolution selects API or browser endpoints based on repository visibility and reachability, while GitHub content requests receive raw-content headers.

Changes

Private GitHub downloads

Layer / File(s)	Summary
GitHub API URL metadata src/backend/aqua.rs	Archive and content lock information now stores canonical browser URLs alongside encoded GitHub API transport URLs.
Private download transport selection src/backend/aqua.rs	Install, provenance, and release asset downloads use centralized browser/API URL selection with updated probes and unit coverage.
GitHub content request headers src/github.rs	GitHub /contents/ API requests now use the raw-content accept header, with documentation and tests updated.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant AquaBackend
  participant URLSelector
  participant GitHubHTTP
  participant GitHubAPI
  AquaBackend->>URLSelector: package visibility and browser/API URLs
  URLSelector->>GitHubHTTP: probe selected endpoint
  GitHubHTTP-->>URLSelector: reachability result
  URLSelector-->>AquaBackend: download transport URL
  AquaBackend->>GitHubAPI: request archive, content, or asset
  GitHubAPI-->>AquaBackend: package bytes

Loading

Possibly related PRs

• jdx/mise#10591: Both modify src/github.rs header handling.
• jdx/mise#10622: Both update Aqua GitHub download and probe transport selection.

Poem

A rabbit hops where URLs gleam,
API paths now join the stream.
Private hops take routes secure,
Public probes still check the door.
Raw content headers join the cheer—
Downloads bound through GitHub clear!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: private GitHub content and archive support in aqua.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

src/backend/aqua.rs (1)

502-568: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Use the API URL for the v-prefix existence probe on private GitHub packages

The v-prefixed existence check still calls HTTP.head(&url_prefixed) on the browser URL. For private GithubContent/GithubArchive packages, that URL 404s even when the tag exists, so the code can fall back to the wrong version variant. Route the probe through the API URL or skip it for private packages.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/backend/aqua.rs` around lines 502 - 568, Update the v-prefixed existence
probe in the get_url version-selection logic to avoid calling HTTP.head on the
browser URL for private GithubContent/GithubArchive packages. Use the
corresponding API URL for the HEAD request when available, or skip the probe for
private packages, while preserving the existing fallback behavior for public
packages.

🧹 Nitpick comments (1)

src/backend/aqua.rs (1)

3307-3327: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Second test's name/args don't match what's being asserted.

test_github_release_without_api_url_uses_browser_url passes private = true and api_url = None, so it's really testing "private package without an API URL falls back to the browser URL," not anything specific to github_release. The name suggests a public/probe scenario that isn't actually exercised here.

✏️ Suggested rename

-    async fn test_github_release_without_api_url_uses_browser_url() {
+    async fn test_private_download_without_api_url_falls_back_to_browser_url() {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/backend/aqua.rs` around lines 3307 - 3327, Rename
test_github_release_without_api_url_uses_browser_url to accurately describe the
private-package fallback scenario, such as
test_private_github_download_without_api_url_uses_browser_url; keep its current
arguments and assertion unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@src/backend/aqua.rs`:
- Around line 502-568: Update the v-prefixed existence probe in the get_url
version-selection logic to avoid calling HTTP.head on the browser URL for
private GithubContent/GithubArchive packages. Use the corresponding API URL for
the HEAD request when available, or skip the probe for private packages, while
preserving the existing fallback behavior for public packages.

---

Nitpick comments:
In `@src/backend/aqua.rs`:
- Around line 3307-3327: Rename
test_github_release_without_api_url_uses_browser_url to accurately describe the
private-package fallback scenario, such as
test_private_github_download_without_api_url_uses_browser_url; keep its current
arguments and assertion unchanged.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: d58971d7-5d61-41dd-a8ba-bf4a8f0560a8

📥 Commits

Reviewing files that changed from the base of the PR and between 0e17a04 and 719d908.

📒 Files selected for processing (5)

• crates/aqua-registry/src/cache.rs
• crates/aqua-registry/src/codec.rs
• crates/aqua-registry/src/types.rs
• src/backend/aqua.rs
• src/github.rs

[greptile-apps]

Greptile Summary

This PR extends aqua's private-repo download support from GithubRelease to GithubArchive and GithubContent packages by constructing authenticated GitHub API URLs for both types and routing downloads through the same select_github_download_url logic already used for releases.

• github_archive_api_url builds a percent-encoded tarball API URL; github_content_api_url splits the path on / so each segment is encoded individually, then appends the ref query parameter — both verified by dedicated URL-encoding tests.
• get_headers in github.rs now adds Accept: application/vnd.github.raw for /contents/ API URLs, making the GitHub Contents API return raw bytes instead of JSON metadata.
• V-prefix existence probing is redirected through select_github_probe_url so private packages probe the API URL (authenticated) while public packages continue probing the browser URL with fallback.

Confidence Score: 5/5

Safe to merge — the change adds authenticated API fallback URLs for two previously unsupported package types without altering any existing download path for public packages.

All three changed code paths (URL construction, header selection, v-prefix probing) are narrow and self-contained, each backed by a new unit test. The URL-encoding logic uses the url crate's path_segments_mut rather than string interpolation, so slashes and spaces in versions or paths are handled correctly. Public packages retain the existing browser-URL-first + HTML-detect fallback path unchanged.

No files require special attention.

Important Files Changed

Filename	Overview
src/backend/aqua.rs	Adds github_archive_api_url and github_content_api_url helpers, populates url_api for both package types, routes v-prefix probing through select_github_probe_url (API URL for private, browser URL for public), and renames select_github_release_download_url to select_github_download_url. Logic is consistent and tests cover URL encoding, private/public paths, and probe routing.
src/github.rs	Extends get_headers to add Accept: application/vnd.github.raw for /contents/ API URLs, enabling raw-byte downloads from the GitHub Contents API. Updates the pick_reachable_asset_url docstring. Change is narrow and the new test_github_content_headers_request_raw_content test confirms the header is set correctly.

_{Reviews (3): Last reviewed commit: "feat(aqua): support private content and ..." | Re-trigger Greptile}

[risu729]

Addressed the AI review after rebasing onto current main:

• private GitHub archive/content v-prefix existence probes now use the authenticated API URL when available, avoiding false 404s from browser-facing URLs
• renamed the fallback test so it describes the private-package/no-API scenario
• added regression coverage for private and public probe URL selection

The remaining Greptile note about an extra public-package HEAD request describes the intentional fallback behavior retained by this PR, so no code change is needed for that observation.

This comment was generated by an AI coding assistant.