Function downloadFileViaGit

pkg/parser/remote_fetch.go:605–648

downloadFileViaGit downloads a file from a Git repository using git commands This is a fallback for when GitHub API authentication fails

(ctx context.Context, owner, repo, path, ref, host string)

// downloadFileViaGit downloads a file from a Git repository using git commands
// This is a fallback for when GitHub API authentication fails
func downloadFileViaGit(ctx context.Context, owner, repo, path, ref, host string) ([]byte, error) {
	remoteLog.Printf("Attempting git fallback for %s/%s/%s@%s", owner, repo, path, ref)

	// First, try via raw.githubusercontent.com — no auth required for public repos and
	// no dependency on git being installed.
	// Only attempt raw URL for github.com repos (not GHE) since raw.githubusercontent.com
	// only serves public GitHub content.
	if host == "" || host == "github.com" {
		content, rawErr := downloadFileViaRawURL(ctx, owner, repo, path, ref)
		if rawErr == nil {
			return content, nil
		}
		remoteLog.Printf("Raw URL download failed for %s/%s/%s@%s, trying git archive: %v", owner, repo, path, ref, rawErr)
	}

	// Use git archive to get the file content without cloning
	// This works for public repositories without authentication
	var githubHost string
	if host != "" {
		githubHost = "https://" + host
	} else {
		githubHost = GetGitHubHostForRepo(owner, repo)
	}
	repoURL := fmt.Sprintf("%s/%s/%s.git", githubHost, owner, repo)

	// git archive command: git archive --remote=<repo> <ref> <path>
	// #nosec G204 -- repoURL, ref, and path are from workflow import configuration authored by the
	// developer; exec.CommandContext with separate args (not shell execution) prevents shell injection.
	cmd := exec.CommandContext(ctx, "git", "archive", "--remote="+repoURL, ref, path)
	archiveOutput, err := cmd.Output()
	if err != nil {
		// If git archive fails, try with git clone + git show as a fallback
		return downloadFileViaGitClone(owner, repo, path, ref, host)
	}

	// Extract the file from the tar archive using Go's archive/tar (cross-platform)
	content, err := fileutil.ExtractFileFromTar(archiveOutput, path)
	if err != nil {
		return nil, fmt.Errorf("failed to extract file from git archive: %w", err)
	}

	remoteLog.Printf("Successfully downloaded file via git archive: %s/%s/%s@%s", owner, repo, path, ref)
	return content, nil
}

// downloadFileViaRawURL fetches a file using the raw.githubusercontent.com URL.
// This requires no authentication for public repositories and no git installation.