Function downloadFileViaRawURL

pkg/parser/remote_fetch.go:652–682

downloadFileViaRawURL fetches a file using the raw.githubusercontent.com URL. This requires no authentication for public repositories and no git installation.

(ctx context.Context, owner, repo, filePath, ref string)

// downloadFileViaRawURL fetches a file using the raw.githubusercontent.com URL.
// This requires no authentication for public repositories and no git installation.
func downloadFileViaRawURL(ctx context.Context, owner, repo, filePath, ref string) ([]byte, error) {
	rawURL := fmt.Sprintf("https://raw.githubusercontent.com/%s/%s/%s/%s", owner, repo, ref, filePath)
	remoteLog.Printf("Attempting raw URL download: %s", rawURL)

	// Use a client with a timeout to prevent indefinite hangs on slow/unresponsive hosts.
	rawClient := &http.Client{Timeout: constants.DefaultHTTPClientTimeout}

	// #nosec G107 -- rawURL is constructed from workflow import configuration authored by
	// the developer; the owner, repo, filePath, and ref are user-supplied workflow spec fields.
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, rawURL, nil)
	if err != nil {
		return nil, fmt.Errorf("raw URL request failed for %s: %w", rawURL, err)
	}
	resp, err := rawClient.Do(req)
	if err != nil {
		return nil, fmt.Errorf("raw URL request failed for %s: %w", rawURL, err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return nil, fmt.Errorf("raw URL returned HTTP %d for %s", resp.StatusCode, rawURL)
	}

	content, err := io.ReadAll(resp.Body)
	if err != nil {
		return nil, fmt.Errorf("failed to read raw URL response body for %s: %w", rawURL, err)
	}

	remoteLog.Printf("Successfully downloaded file via raw URL: %s", rawURL)
	return content, nil
}

// downloadFileViaGitClone downloads a file by shallow cloning the repository
// This is used as a fallback when git archive doesn't work