Consolidate public GitHub API GET fallback transport by Copilot · Pull Request #71893 · github/gh-aw

Copilot · 2026-10-25T12:27:39Z

Three CLI and parser fallbacks duplicate unauthenticated GitHub GET handling, creating opportunities for response and cancellation behavior to diverge.

Shared transport: Add githubapi.GetPublic(ctx, client, endpointURL) for context-aware requests, the GitHub JSON Accept header, body reading and closure, and HTTP 200 validation.
Error compatibility: Return typed HTTPStatusError values while preserving existing caller-specific messages and debug logging.
Caller boundaries: Keep operation timing, URL escaping, fallback eligibility, client timeouts, and SHA parsing in the callers.

body, err := githubapi.GetPublic(ctx, client, endpointURL)

Fixes [duplicate-code] Duplicate Code: Public GitHub API GET fallback repeated across CLI and parser #71713

…vior Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-10-25T13:22:33Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-10-25T13:22:36Z

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-10-25T13:22:37Z

✅ Ponytail Reviewer completed successfully!

Ponytail Reviewer

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Ponytail Reviewer · gpt56 · ~7 AIC · ⌖ ~6 AIC · ⊞ 14.8K · ◷

Generated by Ponytail Reviewer for #71893

github-actions · 2026-10-25T13:22:45Z

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Test Quality Sentinel · haiku45 · ~6 AIC · ⌖ ~14 AIC · ◇ ~5 AIC · ⊞ 9.2K · ◷

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-10-25T13:22:46Z

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

Commit pushed: 672c4d5

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-10-25T13:27:46Z

Comment Memory

Peek at saved memory (pr-code-quality-reviewer)

reviewed_at: 2026-10-25T13:24:31Z
review_event: COMMENT
top_themes:
  - unbounded public API response buffering
files_reviewed:
  - pkg/githubapi/public_get.go
  - pkg/cli/update_workflows.go
  - pkg/parser/remote_client.go
  - pkg/parser/remote_resolve_sha.go
comment_count: 1

Note

This comment is managed by comment memory.

Expand the saved memory block to view or edit the persistent context for this thread.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt50 · ~2 AIC · ⌖ ~1 AIC · ⊞ 1.6K · ◷
_{Comment /review to run again}

github-actions

Review summary

One non-blocking concern is noted inline: the shared helper buffers the complete response without a size limit.

Details

The consolidation preserves the prior callers' behavior, but the new common boundary should ideally protect all callers from unexpectedly large public API responses.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt50 · ~2 AIC · ⌖ ~1 AIC · ⊞ 1.6K
_{Comment /review to run again}

github-actions · 2026-10-25T13:27:50Z

+		}
+	}()
+
+	body, err := io.ReadAll(resp.Body)


Reading the entire public response with io.ReadAll leaves every caller exposed to unbounded memory use if GitHub (or a test/custom transport) returns a very large body.

💡 Cap the response size

Wrap the body in an io.LimitReader with an explicit API response limit and return a distinct error when the limit is exceeded. This keeps the shared helper from turning a large remote response into a process-wide memory spike while preserving the existing caller behavior for normal responses.

Bound GetPublic to 10 MiB and return *ResponseTooLargeError after reading at most limit+1 bytes; the regression test also verifies the body is closed. Implemented in 6ba63dc.

…port

github-actions · 2026-10-25T13:28:06Z

🏗️ Design Decision Gate — ADR Required

This PR makes significant changes to core business logic (368 new lines in pkg/) but does not link an Architecture Decision Record (ADR).

📄 Draft ADR committed: docs/adr/71893-centralize-public-github-api-get-transport.md. Review and complete it before merging. Also correct its Date field; the draft shows 2026-05-14.

Decision found in the diff: add a shared githubapi.GetPublic(ctx, client, endpointURL) helper that returns a typed *HTTPStatusError. It replaces three copies of the unauthenticated GET code in pkg/cli/update_workflows.go, pkg/parser/remote_client.go and pkg/parser/remote_resolve_sha.go. URL escaping, timing, client timeouts and response parsing stay in the callers.

🔒 This PR cannot merge until an ADR is linked in the PR body.

📋 What to do next

Review the draft ADR committed to your branch. It was generated from the PR diff.
Complete the missing sections: add context the AI couldn't infer, refine the decision rationale, and check the alternatives (keep the per-caller copies, build a full public-API client, or return a plain string error).
Commit the finalized ADR to docs/adr/ on your branch.
Reference the ADR in this PR body by adding a line such as:

ADR: ADR-71893: Centralize Public GitHub API GET Transport in githubapi Package

Once an ADR is linked in the PR body, this gate will re-run and verify the implementation matches the decision.

❓ Why ADRs Matter

"AI made me procrastinate on key design decisions. Because refactoring was cheap, I could always say 'I'll deal with this later.' Deferring decisions corroded my ability to think clearly."

ADRs create a searchable, permanent record of why the codebase looks the way it does. Future contributors (and your future self) will thank you.

📋 Michael Nygard ADR Format Reference

An ADR must contain these four sections to be considered complete:

Context: What is the problem? What forces are at play?
Decision: What did you decide? Why?
Alternatives Considered: What else could have been done?
Consequences: What are the trade-offs (positive and negative)?

All ADRs are stored in docs/adr/ as Markdown files numbered by PR number.

🏗️ ADR gate enforced by Design Decision Gate 🏗️ · pi · opus55 · ~26 AIC · ⌖ ~36 AIC · ⊞ 1.9K · ◷
_{Comment /review to run again}

github-actions

Skills-Based Review 🧠

Applied /codebase-design (triage: refactor_cleanup) — clean, behavior-preserving extraction. Approving.

📋 Key Themes & Highlights

Verification performed

Confirmed go build/go vet succeed and all new/changed tests pass (TestGetPublicResponse, TestGetPublicInvalidURL, TestGetPublicRequestFailure, TestGetPublicCancellation, TestFetchPublicGitHubAPI, TestPublicAPIFallbackResponses).
Traced error-message parity: HTTPStatusError.Error() reproduces the exact pre-refactor "GitHub API returned %d: %s" text, so callers that don't type-assert (release tags pagination, default-branch fallback, branch-commit fallback) see unchanged error strings.
Confirmed callers needing structured info (remote_resolve_sha.go, remote_client.go) correctly recover StatusCode/Body via errors.As(err, &statusErr) and still produce the original caller-specific wrapped messages.
Confirmed errorutil.IsNotFoundError's substring-based 404 detection still matches, since the formatted error string retains "404".
Confirmed named-return resultErr / defer finish(resultErr) wiring in both refactored call sites still captures the correct error after the switch to return body, err.
GetPublic closes the response body on every path (success, read error, status error) — correctly consolidates three previously-duplicated close/read/validate blocks into one deep, simple interface.

Positive Highlights

✅ Strong interface: GetPublic(ctx, client, url) ([]byte, error) hides header-setting, body handling, and status validation behind a single call — a good example of a deep module per /codebase-design.
✅ Typed HTTPStatusError preserves backward-compatible string formatting while giving callers that need it structured access to StatusCode/Body.
✅ Comprehensive new test coverage, including edge cases often missed (cancellation, invalid URL, body-read failure before/after status validation).

Minor, non-blocking note

The resp.Body.Close() error-logging branch in public_get.go isn't exercised by any test. Trivial and not worth blocking on, but a quick io.Reader + close-erroring body test would close the last coverage gap.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · ~64 AIC · ⌖ ~15 AIC · ⊞ 10.2K
_{Comment /matt to run again}

Copilot

🟢 Approval recommended

The bounded refactor preserves existing caller behavior and adds focused regression coverage, with no blocking issues identified.

No open issues 🎉

What changed in this PR

Consolidates unauthenticated GitHub GET handling in pkg/githubapi for CLI update and parser fallbacks, addressing #71713 while keeping caller-specific behavior in place.

Changes:

Adds a shared, context-aware GET helper with response cleanup and typed HTTP status errors.
Migrates three fallbacks while preserving error messages, logging, URL construction, and parsing.
Adds transport and caller regression coverage and updates package documentation.

File	Description
`pkg/parser/remote_resolve_sha.go`	Uses shared transport while retaining SHA parsing and contextual errors.
`pkg/parser/remote_public_api_test.go`	Covers parser fallback responses, URLs, and operation reporting.
`pkg/parser/remote_client.go`	Delegates contents requests while preserving status logging.
`pkg/githubapi/README.md`	Documents the shared helper and response contract.
`pkg/githubapi/public_get.go`	Implements shared request, body, and status handling.
`pkg/githubapi/public_get_test.go`	Covers success, failures, cancellation, and body closure.
`pkg/cli/update_workflows.go`	Delegates public GET transport while retaining operation timing.
`pkg/cli/update_public_api_test.go`	Checks CLI fallback responses and operation reporting.

_{Review effort: Max}

gh-aw-bot · 2026-10-25T13:58:51Z

@copilot address the following outstanding work in one pass:

Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
Review (pkg/githubapi/public_get.go:44): Reading the entire public response with io.ReadAll leaves every caller exposed to unbounded memory use if GitHub (or a test/custom transport) returns a very large body. - Consolidate public GitHub API GET fallback transport #71893 (comment)

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: 672c4d5
Sous-chef work: eb850618a070d2bacd6cc5c9e294ab862d014eea7e7d97ee8c91b24fd04f1821
Sous-chef state: 0f7d1b8cc854ad05a048791e0b575339a912a9c2e924852a5b31285e71314206

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · ~8 AIC · ⌖ ~8 AIC · ⊞ 1.1K · ◷
_{Comment /souschef to run again}

…e-fix-github-api-get-fallback Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-10-25T14:35:53Z

@copilot address the following outstanding work in one pass:

Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes....

Merged latest main with make merge-main and pushed the fixes in 6ba63dc and 5bf3450. The inline size-limit thread has been addressed; local validation passed. As requested, I did not retrigger CI.

github-actions · 2026-10-25T17:21:15Z

🎉 This pull request is included in a new release.

Release: v0.93.5

Initial plan

bff8dd7

Copilot AI assigned Copilot and pelikhan Oct 25, 2026

Copilot started work on behalf of pelikhan October 25, 2026 12:47

View session

Copilot AI linked an issue Oct 25, 2026 that may be closed by this pull request

[duplicate-code] Duplicate Code: Public GitHub API GET fallback repeated across CLI and parser #71713

Closed

1 of 5 tasks

Extract shared public GitHub GET transport and preserve fallback beha…

0abce53

…vior Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Refactor duplicate GitHub API GET fallback code~~ Oct 25, 2026

Copilot finished work on behalf of pelikhan October 25, 2026 13:10

Copilot AI requested a review from pelikhan October 25, 2026 13:10

pelikhan marked this pull request as ready for review October 25, 2026 13:20

Copilot AI max review requested due to automatic review settings October 25, 2026 13:20

Copilot started reviewing on behalf of pelikhan October 25, 2026 13:21

View session

github-actions Bot reviewed Oct 25, 2026

View reviewed changes

docs(adr): add draft ADR-71893 for shared public GitHub API GET trans…

672c4d5

…port

github-actions Bot approved these changes Oct 25, 2026

View reviewed changes

Copilot AI reviewed Oct 25, 2026

View reviewed changes

github-actions Bot mentioned this pull request Oct 25, 2026

[pr-sous-chef] PR Sous Chef Progress: 1 nudged, 3 skipped #71795

Closed

Copilot started work on behalf of gh-aw-bot October 25, 2026 13:59

View session

Copilot AI and others added 3 commits October 25, 2026 14:06

Merge remote-tracking branch 'origin/main' into copilot/duplicate-cod…

24d87dc

…e-fix-github-api-get-fallback Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Bound public GitHub API response bodies

6ba63dc

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Satisfy bounds lint and cap public GET responses

5bf3450

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot October 25, 2026 14:37

Copilot AI requested a review from gh-aw-bot October 25, 2026 14:37

pelikhan merged commit 832e65a into main Oct 25, 2026
35 checks passed

pelikhan deleted the copilot/duplicate-code-fix-github-api-get-fallback branch October 25, 2026 16:24

Navigation Menu

Repository navigation

Consolidate public GitHub API GET fallback transport - #71893

Consolidate public GitHub API GET fallback transport#71893
pelikhan merged 6 commits into
mainfrom
copilot/duplicate-code-fix-github-api-get-fallback

Copilot AI commented Oct 25, 2026 •

edited

Loading

github-actions Bot commented Oct 25, 2026 •

edited

Loading

github-actions Bot commented Oct 25, 2026 •

edited

Loading

github-actions Bot commented Oct 25, 2026 •

edited

Loading

github-actions Bot commented Oct 25, 2026 •

edited

Loading

github-actions Bot commented Oct 25, 2026 •

edited

Loading

github-actions Bot commented Oct 25, 2026

github-actions Bot left a comment

github-actions Bot Oct 25, 2026

Copilot AI Oct 25, 2026

github-actions Bot commented Oct 25, 2026

github-actions Bot left a comment

Copilot AI left a comment

gh-aw-bot commented Oct 25, 2026

Copilot AI commented Oct 25, 2026

Uh oh!

github-actions Bot commented Oct 25, 2026

Uh oh!

Labels

4 participants

Conversation

Copilot AI commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

github-actions Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

github-actions Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

github-actions Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Ponytail Reviewer

github-actions Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Quality Sentinel

github-actions Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

github-actions Bot commented Oct 25, 2026

Comment Memory

github-actions Bot left a comment

Choose a reason for hiding this comment

Review summary

github-actions Bot Oct 25, 2026

Choose a reason for hiding this comment

Copilot AI Oct 25, 2026

Choose a reason for hiding this comment

github-actions Bot commented Oct 25, 2026

🏗️ Design Decision Gate — ADR Required

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Verification performed

Positive Highlights

Minor, non-blocking note

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

gh-aw-bot commented Oct 25, 2026

Copilot AI commented Oct 25, 2026

Uh oh!

github-actions Bot commented Oct 25, 2026

Uh oh!

Labels

4 participants

Copilot AI commented Oct 25, 2026 •

edited

Loading

github-actions Bot commented Oct 25, 2026 •

edited

Loading

github-actions Bot commented Oct 25, 2026 •

edited

Loading

github-actions Bot commented Oct 25, 2026 •

edited

Loading

github-actions Bot commented Oct 25, 2026 •

edited

Loading

github-actions Bot commented Oct 25, 2026 •

edited

Loading