Function resolveRefToSHAViaPublicAPI

pkg/parser/remote_fetch.go:567–601

resolveRefToSHAViaPublicAPI resolves a git ref to its commit SHA using an unauthenticated call to the public GitHub API. Used as a last-resort fallback when both authenticated API and git ls-remote fail.

(ctx context.Context, owner, repo, ref string)

// unauthenticated call to the public GitHub API. Used as a last-resort fallback
// when both authenticated API and git ls-remote fail.
func resolveRefToSHAViaPublicAPI(ctx context.Context, owner, repo, ref string) (string, error) {
	remoteLog.Printf("Attempting unauthenticated public API ref resolution for %s/%s@%s", owner, repo, ref)
	apiURL := fmt.Sprintf("https://api.github.com/repos/%s/%s/commits/%s",
		owner, repo, url.PathEscape(ref))
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, apiURL, nil)
	if err != nil {
		return "", err
	}
	req.Header.Set("Accept", "application/vnd.github+json")

	resp, err := publicAPIClient.Do(req)
	if err != nil {
		return "", err
	}
	defer resp.Body.Close()

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return "", err
	}
	if resp.StatusCode != http.StatusOK {
		return "", fmt.Errorf("unauthenticated public API failed for %s/%s@%s: HTTP %d: %s", owner, repo, ref, resp.StatusCode, strings.TrimSpace(string(body)))
	}

	var result struct {
		SHA string `json:"sha"`
	}
	if err := json.Unmarshal(body, &result); err != nil {
		return "", fmt.Errorf("failed to parse commit response: %w", err)
	}
	if result.SHA == "" || len(result.SHA) != 40 || !gitutil.IsHexString(result.SHA) {
		return "", fmt.Errorf("invalid SHA returned from public API: %q", result.SHA)
	}
	return result.SHA, nil
}

// downloadFileViaGit downloads a file from a Git repository using git commands
// This is a fallback for when GitHub API authentication fails