licence_audit/repository

Provider-agnostic parsing of source-repository URLs and construction of the HTTP endpoints used to resolve a tag to an immutable commit SHA and to download a repository archive at that commit.

Only normalized HTTPS URLs for a small allow-list of hosts are accepted (github.com, codeberg.org, gitlab.com). Anything else — other hosts, userinfo, ports, query strings, fragments, non-HTTPS schemes, or extra path segments — is rejected. A trailing .git and/or / on the owner/repo path is tolerated and normalized away. The owner/repo segments must be literal, normalized names: percent escapes, backslashes, colons, control characters, and the ./.. dot segments are rejected, while ordinary names containing dots, hyphens, and underscores are accepted.

Types

Provider

</>

pub type Provider {
  GitHub
  GitLab
  Codeberg
}

Constructors

```
GitHub
```
```
GitLab
```
```
Codeberg
```

Repository

</>

pub type Repository {
  Repository(provider: Provider, owner: String, repo: String)
}

Constructors

Repository(provider: Provider, owner: String, repo: String)

Values

archive_request

</>

pub fn archive_request(
  repo: Repository,
  commit: String,
) -> request.Request(BitArray)

Build the request that downloads the gzip-compressed tar archive of repo at an immutable commit.

commit_request

</>

pub fn commit_request(
  repo: Repository,
  tag: String,
) -> request.Request(String)

Build the API request that resolves tag to a commit for repo.

decode_commit

</>

pub fn decode_commit(
  repo: Repository,
  body: String,
) -> Result(String, Nil)

Decode a commit-resolution response body into a commit SHA. Returns Error(Nil) when the body does not contain the provider’s SHA field (e.g. a 404 body or malformed JSON), which the caller treats as “tag not found”.

describe

</>

pub fn describe(repo: Repository) -> String

Human-readable provider owner/repo label for logs and cache keys.

parse

</>

pub fn parse(url: String) -> Result(Repository, Nil)

Parse a normalized HTTPS repository URL for a supported host. Returns Error(Nil) for any URL that is not exactly https://<host>/<owner>/<repo> (with optional trailing .git//) for one of the allow-listed hosts.

parse_github_source

</>

pub fn parse_github_source(
  url: String,
) -> Result(Repository, Nil)

Parse any GitHub source URL accepted by SBOM purl generation.

tag_candidates

</>

pub fn tag_candidates(version: String) -> List(String)

Candidate tag names to try, in order, for a package version. Prefer the conventional v-prefixed tag, then the bare version.