fix: enforce ARTIFACTORY_ONLY for virtual package types

[chkp-roniz]

Problem

ARTIFACTORY_ONLY=1 was only guarded on the main zip-archive download path. Virtual package types (file, collection, subdirectory) had no guard — they would silently bypass the proxy restriction and reach GitHub directly in air-gapped or proxy-only environments.

Fix

Hoist a single shared guard above the virtual-type dispatch:

if self._is_artifactory_only() and not dep_ref.is_artifactory() and not self._parse_artifactory_base_url():
    raise RuntimeError("ARTIFACTORY_ONLY is set but no Artifactory proxy is configured ...")

This replaces three copy-pasted per-type guards (one of which was also missing the not dep_ref.is_artifactory() bypass for explicit FQDN refs).

Behaviour matrix after fix:

Scenario	Before	After
ARTIFACTORY_ONLY=0, any dep	direct download	direct download (unchanged)
ARTIFACTORY_ONLY=1 + proxy URL set, file/collection	direct download via download_raw_file (proxy handled internally)	same (unchanged)
ARTIFACTORY_ONLY=1 + proxy URL set, subdirectory	routes to _download_subdirectory_from_artifactory	same (unchanged)
ARTIFACTORY_ONLY=1 + no proxy, file/collection	silent GitHub access (bug)	raises RuntimeError
ARTIFACTORY_ONLY=1 + no proxy, subdirectory	silent GitHub access (bug)	raises RuntimeError
ARTIFACTORY_ONLY=1, explicit Artifactory FQDN, any type	passes	passes (unchanged)

Tests

5 new unit tests in TestArtifactoryOnlyMode:

• test_virtual_{file,collection,subdirectory}_errors_without_base_url — each raises when no proxy is configured
• test_explicit_artifactory_fqdn_virtual_{file,collection}_passes — explicit FQDN refs are not blocked

Split from #401 — this fix is self-contained with no architectural dependencies.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR closes an enforcement gap where ARTIFACTORY_ONLY=1 did not block virtual package types (file/collection/subdirectory), allowing unintended direct GitHub access in proxy-only or air-gapped environments.

Changes:

• Add an ARTIFACTORY_ONLY/proxy guard to the virtual-package dispatch path in GitHubPackageDownloader.download_package().
• Add unit tests intended to cover virtual-package behavior under ARTIFACTORY_ONLY.
• Add a CHANGELOG.md entry describing the fix.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
src/apm_cli/deps/github_downloader.py	Adds a shared guard to prevent virtual packages from bypassing Artifactory-only mode.
tests/unit/test_artifactory_support.py	Adds tests for virtual package errors under ARTIFACTORY_ONLY and intended explicit-FQDN bypass cases.
CHANGELOG.md	Documents the enforcement fix under [Unreleased].