Handle redirected plugin archive downloads in mirror-content

[Copilot]

The Mirror plugin content workflow was failing when a plugin archive URL returned an HTTP redirect instead of a direct 200 OK. In practice, GitHub release asset URLs such as bindiff caused fetch_plugin_archive() to raise and abort the entire mirroring pass.

• Root cause

  • scripts/mirror_plugin_archive_contents.py assumed plugin archive URLs were directly fetchable.
  • GitHub release downloads can respond with 302 Found before redirecting to the actual asset, which caused the mirror step to fail.

• Download fallback for redirected archives

  • Added a small wrapper around fetch_plugin_archive() to preserve the existing path for normal downloads.
  • If the fetch fails with an HTTP redirect status, the script now retries with redirect-following enabled.

• Security / correctness guardrails

  • Restricts fallback handling to redirect status codes only.
  • Enforces a request timeout on the retry path.
  • Verifies the final resolved URL remains https:// before reading the archive.

• Behavioral impact

  • Non-redirecting archive URLs continue through the existing code path unchanged.
  • Redirecting release asset URLs can now be mirrored instead of terminating the whole job.

def fetch_plugin_archive_with_redirects(url: str) -> bytes:
    try:
        return fetch_plugin_archive(url)
    except httpx.HTTPStatusError as e:
        if e.response.status_code not in {301, 302, 303, 307, 308}:
            raise

        with urllib.request.urlopen(url, timeout=30) as response:
            redirected_url = response.geturl()
            if not redirected_url.startswith("https://"):
                raise ValueError(f"redirected plugin archive URL is not HTTPS: {redirected_url}")
            return response.read()

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• releases.astral.sh
  • Triggering command: /home/REDACTED/.local/bin/uv /home/REDACTED/.local/bin/uv run scripts/mirror_plugin_archive_contents.py /tmp/plugin-repository-triage/bindiff.json /tmp/plugin-repository-triage/out (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Reference: https://github.com/HexRaysSA/plugin-repository/actions/runs/23647130124/job/68881993497

help me triage

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.