Load public GitHub repositories by URL through a Cloudflare Worker

[valuecodes]

What

• Completes Phase 7: paste github.com/owner/repo (or …/tree/<ref>/<folder>) on the landing page to walk a public repository. ?repo= fills the field in for reloads and shared links.
• One request to GitHub per load: codeload sends no CORS headers, so a new Worker route (GET /api/github/zip) fetches the zip and streams it back. The page reads it with the existing filesFromZip, so the filter, caps and parse worker are reused.
• Abuse protection: a Cloudflare Turnstile check (loaded only once a valid URL is typed), a per-IP rate limit of 5 a minute, a 10-minute edge cache, a 64 MB cap, and a codeload URL built only from validated names (not an open proxy).
• wrangler.jsonc gains main, run_worker_first: ["/api/*"] and the rate-limit binding. The CSP allows the Turnstile script and iframe. Deploy settings for Workers Builds (PNPM_VERSION, NODE_VERSION, VITE_TURNSTILE_SITE_KEY build var, TURNSTILE_SECRET runtime secret) are documented in apps/web/AGENTS.md.

How to test

pnpm typecheck
pnpm lint
pnpm knip
pnpm test
pnpm build
pnpm --filter web dev
pnpm --filter web dev:worker

Security review

• New public endpoint /api/github/zip: GET only, owner/repo/ref validated against GitHub's name rules before anything is contacted, rate-limited per IP, then Turnstile siteverify (fails closed, 503 without a secret), then exactly one codeload fetch.
• The Turnstile secret is a Cloudflare runtime secret and a gitignored .dev.vars locally; only the public site key is a build variable. Production builds without a site key hide the field instead of using the test key.
• CSP widened only for https://challenges.cloudflare.com in script-src and frame-src.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T08:02:53.139438Z	7d81e79	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7d81e790e5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".