[DanhezCode]

Summary

Add a GitHub plugin that prepares repository-file references as reusable local Git checkouts and resolves their contents through Write Once's existing pipeline.

Supported reference forms:

• repo:owner/repository/path/to/file.ts — resolve the repository's actual default branch.
• repo:owner/repository@develop/path/to/file.ts — resolve an explicit branch or tag.
• repo:owner/repository@v1.0.0/path/to/file.ts — resolve an explicit tag.
• repo:owner/repository@<commit>/path/to/file.ts — resolve an explicit commit.

Design

• Let the preparer interpret references and pass resolved repository/ref/path metadata to the resolver; avoid independently re-parsing references in the resolver.
• Discover the repository's actual default branch with git ls-remote --symref rather than assuming a branch name.
• Resolve explicit refs against remote branches and tags, preferring a branch when the same name exists as both; support branch names containing slashes.
• Clone with --filter=blob:none, fetch only the requested ref/commit at depth 1, and check out the resolved commit detached.
• Reuse an existing checkout only when it is already at the requested commit and has a clean working tree.
• Deduplicate concurrent preparations for the same checkout and commit.
• Keep checkout state under the Write Once working directory, scoped by repository and resolved ref/commit.
• Authenticate private HTTPS repositories through GITHUB_TOKEN using Git's http.extraheader; do not parse .env files inside the plugin. SSH authentication remains delegated to the user's Git configuration.
• Reject absolute, traversal, empty, and backslash-containing paths, and reject paths that traverse symlinks.
• Reuse Write Once's existing extraction and selection behavior, including whole-file, named-fragment, and range selection.
• Leave temporary-resource cleanup to the write-once core.

Validation

• Test default-branch discovery, branch and tag references, commit references, names containing slashes, and branch/tag name collisions.
• Test checkout reuse and concurrent preparation deduplication.
• Test public access without a token and private HTTPS access with GITHUB_TOKEN.
• Test missing files/refs, authentication failures, path traversal, unsafe paths, symlinks, and non-file paths.
• Test that the core's existing selectors remain responsible for whole-file, named-fragment, and range extraction.

[github-actions]

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)

Your semantic-release bot 📦🚀