[abhinavgautam01]

Closes #85.

Problem

git-pkgs/manifests parses .github/workflows/*.yml into pkg:githubactions/<owner>/<repo>@<ref> dependencies, but NewFromPURL rejected the type:

unknown ecosystem "githubactions" (28 registered; import _ "github.com/git-pkgs/registries/all" or the specific ecosystem package)

Consumers that fetch artifacts, such as licenses --license-text or integrity verification, had to skip the whole ecosystem.

Change

New internal/githubactions registry, registered as githubactions with https://api.github.com as the default URL.

Names

NewFromPURL passes p.FullName() to the registry, so it receives actions/checkout or, for a subdirectory action, github/codeql-action/init. The first two segments are the owner and repo; anything after them is the subdirectory inside that repo.

PURL	Repository	Subdirectory
pkg:githubactions/actions/checkout@v4	actions/checkout	none
pkg:githubactions/github/codeql-action/init@v3	github/codeql-action	init

Registry methods

Method	Behaviour
FetchPackage	GET /repos/{owner}/{repo}: description, homepage (falls back to the repo page), repository, SPDX license (NOASSERTION dropped), topics as keywords, owner as namespace. Metadata carries full_name, default_branch, archived and the subdirectory path.
FetchVersions	GET /repos/{owner}/{repo}/tags, 100 per page until a short page. Each version keeps its commit SHA in metadata. Branches and SHAs are valid refs but are not enumerated.
FetchDependencies	error wrapping errors.ErrUnsupported
FetchMaintainers	error wrapping errors.ErrUnsupported

Requests send Accept: application/vnd.github+json. A 404 becomes NotFoundError.

The issue suggested returning nil from the Fetch* methods as a first cut. I implemented package and tag lookups instead, since both are single REST calls. The unsupported operations follow the existing swift convention of wrapping errors.ErrUnsupported, which avoids nil, nil results that callers could dereference.

URLs

Method	Example
Download	https://github.com/actions/checkout/archive/v4.tar.gz (empty without a ref)
Registry / Documentation	https://github.com/github/codeql-action/tree/v3/init
PURL	pkg:githubactions/github/codeql-action/init@v3

Download accepts tags, branches or 40-char SHAs. Refs containing slashes, such as releases/v1, keep their path structure. For subdirectory actions the tarball is the whole repository.

For GitHub Enterprise Server, an /api/v3 base URL also sets the web host used for page and archive links.

Wiring

• all/all.go imports the new package; the ecosystem list in its doc comment includes githubactions.
• TestSupportedEcosystems, TestNew and TestDefaultURL include the new ecosystem.
• The README ecosystem count goes from 28 to 29, with a PURL example, a supported ecosystems row and a short usage note.

Known limitations

• No integrity. /archive/<ref>.tar.gz is generated on demand and GitHub does not guarantee byte stability, so versions carry no Integrity. Stable release assets could be a follow-up for actions that publish them.
• Rate limit. Unauthenticated GitHub API requests are limited to 60 per hour. URLs().Download makes no API call, but bulk metadata lookups will hit the limit quickly. Token support could be a follow-up.
• Download filenames. fetch.Resolver names files from the last URL segment, so every action at v4 downloads as v4.tar.gz. Callers that cache by filename alone should key on the full name too.

Tests

internal/githubactions/githubactions_test.go covers:

• name parsing, including subdirectories, surrounding slashes and invalid names;
• FetchPackage field mapping and the Accept header, NOASSERTION handling, the homepage fallback, 404 to NotFoundError and invalid names;
• FetchVersions pagination across two pages (101 tags), an empty tag list and 404;
• ErrUnsupported from FetchDependencies and FetchMaintainers;
• a URL table for tags, SHAs, subdirectories, slash refs, missing refs and invalid names, plus the Enterprise web URL;
• core.NewFromPURL end to end for actions/checkout@v4 and github/codeql-action/init@v3.

Locally, gofmt -l . is clean. go vet ./..., go test -race ./... and golangci-lint run ./... pass, as do the js and wasip1 wasm builds and the tinygo tagged tests.