Resolve validated checkout ref before git clone

[bjk7119]

Summary by CodeRabbit

• Bug Fixes
  • Improved git clone checkout/ref resolution by using a single credential-aware URL path, and applying safer fallbacks when tags/branches can’t be resolved.
• Chores
  • Updated PR CI to run only the release tox environment.
  • Adjusted release testing to include flake8 linting before the existing test run.
  • Removed an unused development dependency.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 68c9c73d-553c-4440-8d1a-c1835a943396

📥 Commits

Reviewing files that changed from the base of the PR and between 9aae58f and 0a2d9c1.

📒 Files selected for processing (1)

• src/fosslight_util/download.py

🚧 Files skipped from review as they are similar to previous changes (1)

• src/fosslight_util/download.py

---

📝 Walkthrough

Walkthrough

Adds helper functions in download.py for credential-aware git URL handling and checkout ref resolution, then wires download_git_clone() to use them. Release CI and tox configuration are also adjusted so the release environment runs flake8 directly.

Changes

Credential and checkout ref resolution

Layer / File(s)	Summary
Helper functions for URL and ref handling src/fosslight_util/download.py	Adds _git_url_with_http_credentials() for URL-encoded HTTP credentials and _resolve_refs_to_checkout() for credential-aware ref resolution with fallback to checkout_to.
Use helpers in download_git_clone() src/fosslight_util/download.py	Updates download_git_clone() to use the new ref-resolution helper and the new HTTP credential URL helper instead of the prior inline logic.

Release tox and lint execution

Layer / File(s)	Summary
Release workflow and dev dependency update .github/workflows/pull-request.yml, requirements-dev.txt	The PR workflow now runs only tox -e release, and pytest-flake8 is removed from development dependencies.
Release tox commands include flake8 tox.ini	The tox allowlist includes flake8, and the release environment runs flake8 on src before pytest.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• fosslight/fosslight_util#264: Modifies the same download_git_clone ref-resolution flow and decide_checkout/clarified_version handling.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main code change: resolving and validating the checkout ref before cloning.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch checkout

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/fosslight_util/download.py`:
- Around line 579-607: The Ruff warnings come from the new git helper
signatures, where the parameter named id shadows the Python builtin and the
exception handler is too broad. Rename the internal helper parameter in
_git_url_with_http_credentials and _resolve_refs_to_checkout to a non-builtin
name, then keep download_git_clone(id=...) as the external API by passing that
value through under the new internal name. Also narrow the exception handling in
_git_url_with_http_credentials to the specific parsing/URL-related error types
used by urllib/re logic instead of catching Exception.
- Around line 618-625: The checkout resolution in download.py is bypassing
explicit tag/branch inputs whenever checkout_to is set, which breaks the
intended precedence. Update the checkout logic around decide_checkout and the
checkout_to handling so tag and branch are still passed through and evaluated
before checkout_to, preserving the documented tag → branch → checkout_to order
while keeping the existing resolved/clarified_version flow intact.

🪄 Autofix (Beta)

✅ Autofix completed

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 564be0cc-a6c7-4b84-a06d-e6d7868c9257

📥 Commits

Reviewing files that changed from the base of the PR and between cf51ea9 and aece888.

📒 Files selected for processing (1)

• src/fosslight_util/download.py

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Fixes Applied Successfully

Fixed 1 file(s) based on 2 unresolved review comments.

Files modified:

• src/fosslight_util/download.py

Commit: 9aae58f675ac1a6cdc0f8740bac8fe07025c1f7a

The changes have been pushed to the checkout branch.

Time taken: 9m 44s

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/pull-request.yml (1)

16-37: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low value

Consider adding explicit permissions: block.

Static analysis flags this workflow for using default (broad) permissions since no permissions: block is defined. This is pre-existing and not introduced by this diff, but worth tightening while touching this file.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pull-request.yml around lines 16 - 37, Add an explicit
permissions block to the pull request workflow so it does not rely on the
default broad GitHub token permissions. Update the workflow near the build job
setup in pull-request.yml and keep the existing checkout/setup-python/tox steps
unchanged; only scope the workflow’s permissions to the minimum needed for the
job.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/pull-request.yml:
- Around line 16-37: Add an explicit permissions block to the pull request
workflow so it does not rely on the default broad GitHub token permissions.
Update the workflow near the build job setup in pull-request.yml and keep the
existing checkout/setup-python/tox steps unchanged; only scope the workflow’s
permissions to the minimum needed for the job.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 35b1b66f-f394-42fb-b081-25ecd5739af8

📥 Commits

Reviewing files that changed from the base of the PR and between aece888 and 9aae58f.

📒 Files selected for processing (4)

• .github/workflows/pull-request.yml
• requirements-dev.txt
• src/fosslight_util/download.py
• tox.ini

💤 Files with no reviewable changes (1)

• requirements-dev.txt

🚧 Files skipped from review as they are similar to previous changes (1)

• src/fosslight_util/download.py

[soimkim]

#286 에서 flake8 commit 체리픽해서 가져갑니다.
참고. coderabbit auto fix commit 있길래 squash merge하실 것으로 보여 가져갑니다.