krz/gitbay

import-issues: connect only to checked addresses !515

merged merged by cmc on 2026-09-29 02:59 UTC · krz/gitbay:import-issues-pin into main

Discussion

cmc

repo import-issues connects only to addresses it has checked.

  • The pull-head fetch resolves and checks the site's git host with gitpin, runs with the pin and a replaced environment, and carries the token only through askpass. FetchPullHeads takes pin args and a complete env like FetchMirror.
  • The API client dials only the checked addresses of --api-base (or api.github.com) through gitpin.Remote.DialContext, uses no environment proxy, keeps no idle connections, and follows no redirect. A renamed GitHub repository now fails with a hint to use its new name.
  • --api-base refuses credentials, a query or a fragment.
  • Architecture 09/10, Threat-Model, CHANGELOG.

Closes #301