Function attachImportAuthHeader

pkg/cli/import_url_fetcher.go:211–242

(req *http.Request, rawURL string)

)

func attachImportAuthHeader(req *http.Request, rawURL string) {
	parsed, err := url.Parse(rawURL)
	if err != nil || parsed.Host == "" {
		return
	}

	// Never send credentials over plaintext HTTP — HTTPS is required.
	if !strings.EqualFold(parsed.Scheme, "https") {
		importURLFetcherLog.Printf("Skipping auth header for non-HTTPS URL: scheme=%s", parsed.Scheme)
		return
	}

	host := strings.ToLower(parsed.Hostname())

	// Authoritative GitHub hosts to which the token may be sent.
	if _, ok := defaultImportAuthHosts[host]; !ok && host != importAuthGHHost() {
		importURLFetcherLog.Printf("Skipping auth header for non-GitHub host: %s", host)
		return
	}

	token, err := parser.GetGitHubToken()
	if err != nil {
		importURLFetcherLog.Printf("No GitHub token available: %v", err)
		return
	}

	importURLFetcherLog.Printf("Attaching auth header for host: %s", host)
	req.Header.Set("Authorization", "Bearer "+token)
	if isCopilotAutomationImportURL(parsed) {
		req.Header.Set("Copilot-Integration-Id", copilotIntegrationHeaderValue)
	}
}

// isCopilotAutomationImportURL reports whether u targets a Copilot automation API route
// with exactly six path segments: /agents/repos/{owner}/{repo}/automations/{id}.