Fix vip-next GitHub release pagination

[rinatkhaziev]

Description

Fixes vip-next update --check failing with invalid release pagination.

GitHub accepts release-list requests at /repos/Automattic/vip-cli/releases, but its pagination Link header canonicalizes the next-page URL to /repositories/<numeric-id>/releases. The updater previously required the named-repository path exactly, so it rejected GitHub's valid response before requesting page 2.

This change accepts either release pagination path while preserving the existing safeguards:

• requests are still constructed against the original named-repository endpoint rather than following the supplied URL;
• pagination must remain on the configured scheme and host;
• repository IDs must be positive decimal integers;
• userinfo, malformed paths, backward pages, duplicate next links, and more than 100 pages remain rejected;
• duplicate next links are now also detected when delivered in separate Link header fields.

The change is limited to the Go vip-next updater. The Node CLI's existing update behavior is unchanged.

Changelog Description

Fixed

• VIP Next: Fixed update checks failing when GitHub returns numeric repository pagination URLs.

Pull request checklist

• No new environmental variables are introduced.
• No documentation changes are needed for this internal compatibility fix.
• Manually tested the check-only updater against the public GitHub Releases API.
• Followed the repository pull request checklist.
• Added automated regression coverage.

Steps to Test

1. Run go test ./internal/update -count=1.
2. Run make test.
3. Run make lint.
4. Run a vip-next binary built from this branch with update --check and verify it reports update status instead of invalid release pagination.

Manual verification used an isolated temporary cache/config and a binary stamped as 5.0.0-alpha.4; it traversed GitHub's live pagination and reported 5.0.0-alpha.5 as available on the preview channel.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

🔵 Needs a closer look

Two unresolved moderate findings remain in pagination validation.

Pull request overview

Fixes vip-next update --check failures when GitHub returns numeric repository URLs in release pagination.

Changes:

• Accepts named and numeric repository pagination paths.
• Detects duplicate next links across separate Link headers.
• Adds regression coverage for pagination validation.

File summaries

File	Description
internal/update/release_test.go	Adds regression tests for numeric paths and duplicate pagination links.
internal/update/github.go	Updates pagination path validation and multi-header link handling.

Review details

Suppressed comments (2)

internal/update/github.go:109

• strconv.ParseUint accepts a leading +, so a link such as /repositories/+1/releases passes this check even though the repository ID is not a decimal-digit path segment. That violates the pagination safeguard and lets malformed links through; validate that every byte in repositoryID is 0–9 before parsing.

	id, err := strconv.ParseUint(repositoryID, 10, 64)
	return err == nil && id > 0

internal/update/github.go:82

• u.Path is already percent-decoded, so a link such as /repositories/116313791%2Freleases?page=2 becomes /repositories/116313791/releases and passes isReleasePaginationPath even though its raw path is malformed. Validate the escaped path (or otherwise reject encoded separators) so the new numeric route only accepts the intended path shape.

				if err != nil || n <= page || u.Scheme != origin.Scheme || u.Host != origin.Host || !isReleasePaginationPath(u.Path) || u.User != nil || next != 0 {

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.