fix(github): correct ListContents error wrapping and move HTTPS guard before retry loop

github/client.go

@@ -159,6 +159,11 @@ func (c *Client) doRequest(ctx context.Context, method, url string, accept strin
 
 	const maxErrorBodyBytes = 64 * 1024
 
+	// Reject non-HTTPS URLs early since the URL is immutable across retries.
+	if c.token != "" && !c.allowInsecureHTTP && !strings.HasPrefix(url, "https://") {
+		return nil, fmt.Errorf("refusing to send credentials over non-HTTPS URL %q (use AllowInsecureHTTP option for trusted networks)", url)
+	}
+
 	var lastErr error
 	for attempt := 0; attempt < maxAttempts; attempt++ {
 		if attempt > 0 {
@@ -183,10 +188,6 @@ func (c *Client) doRequest(ctx context.Context, method, url string, accept strin
 			return nil, fmt.Errorf("create request: %w", err)
 		}
 		if c.token != "" {
-			// Refuse to send credentials over plaintext unless explicitly allowed.
-			if !c.allowInsecureHTTP && req.URL.Scheme != "https" {
-				return nil, fmt.Errorf("refusing to send credentials over non-HTTPS URL %q (use AllowInsecureHTTP option for trusted networks)", req.URL.Host)
-			}
 			req.Header.Set("Authorization", "Bearer "+c.token)
 		}
 		req.Header.Set("User-Agent", userAgent)