Skip to content

Bug: GitHub imports can fetch stale default-branch packages #11

Description

@kchen0x

Reproduction

  1. Publish a new Room Package version to a repository's default branch.
  2. Paste the repository root URL into Parti's GitHub importer.
  3. Open the imported parti.room.json.

The importer can return an older package from jsDelivr's mutable branch cache, even though GitHub and the room-market issue already expose the newer manifest.

I reproduced this with https://github.com/kchen0x/parti-decrypto: the root URL imported 1.0.0, while the immutable tree/v1.0.2 URL imported 1.0.2 with all filesystem assets.

Cause

GitHubSourceClient resolves the branch name through GitHub but then lists and downloads files through jsDelivr at @main, which may be stale.

Expected behavior

After resolving a mutable branch, import should read an immutable commit snapshot so the downloaded files match the resolved branch state.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions