Fix: oxlint/oxfmt binaries are fetched from github.com, unlike ruff/ty which resolve via PyPI

[pullapprove5]

Reproduced the finding by installing uv (absent in this sandbox) and simulating a GitHub-blocked-but-PyPI-reachable environment (HTTPS_PROXY/HTTP_PROXY pointed at a closed port, since this container's real network could actually reach github.com). uv run plain-code fix . crashed with a raw httpx.ConnectError traceback when oxc's install step tried to hit api.github.com/github.com, and — unlike plain code check, which already has a --skip-oxc flag — plain code fix had no way to skip it and degrade gracefully.\n\nFixed plain-code/plain/code/oxc.py by wrapping the two GitHub-hitting calls (get_latest_version's httpx.get, download's httpx.stream) in try/except httpx.HTTPError, re-raising as click.ClickException with an actionable message pointing at --skip-oxc or pinning a version — Click renders just that message, no traceback. Added a --skip-oxc flag to the fix command in cli.py (mirroring the one check already had) so there's an actual escape hatch, not just a nicer error.\n\nRan the same simulated-block repro before/after: before, a full httpx traceback; after, a one-line Error: Couldn't download oxlint from github.com (...). ... pass --skip-oxc. and exit 1, with --skip-oxc now succeeding (exit 0) without any network access. Ran uv run plain-code check . and uv run plain-code fix plain-code unblocked afterward — ruff, ty, oxlint/oxfmt, and annotations all pass, confirming the normal path (including a real oxc download) still works. plain-code has no pytest suite (not in scripts/test's package list, no tests/ dir), so this check/fix run is the package's own validation.\n\nDid not pursue the finding's other suggested option (mirroring oxc binaries through PyPI wheels) — that's a much larger publishing/design change, not a minimal fix.

---

Opened by a PullApprove implementation run (implement-finding v5) for:

• PA-34 — oxlint/oxfmt binaries are fetched from github.com, unlike ruff/ty which resolve via PyPI

Merging this is what closes them as fixed.

[pullapprove5]

PENDING: 1 review scope pending

	Scope	Progress	Pending
⏳	code	0/1	davegaeddert

View in PullApprove

Next steps:

• pullapprove5[bot]: Waiting for reviews