Implement the github package client with Retry-After header parsing that
supports both integer seconds (e.g. "Retry-After: 120") and HTTP-date
format (e.g. "Retry-After: Thu, 01 Dec 2025 16:00:00 GMT") per RFC 7231
§7.1.3.

Key design decisions:
- Use http.ParseTime which handles RFC 1123, RFC 850, and ASCTIME formats
- Cap maximum retry delay at 60s (maxRetryAfter) to prevent stalling
- If HTTP-date is in the past, use delay of 0 (retry immediately)
- Inject time.Now via c.now field for deterministic testing

Closes #94

@@ -0,0 +158,4 @@
+// It respects the Retry-After header when present, supporting both integer
+// seconds and HTTP-date formats (capped at maxRetryAfter).
+func (c *Client) doRequest(ctx context.Context, method, reqURL string, accept string) ([]byte, error) {
+	backoff := c.retryBackoff

@@ -0,0 +188,4 @@
+		req.Header.Set("Authorization", "Bearer "+c.token)
+		if accept != "" {
+			req.Header.Set("Accept", accept)
+		} else {

@@ -0,0 +194,4 @@
+
+		resp, err := c.http.Do(req)
+		if err != nil {
+			return nil, fmt.Errorf("do request: %w", err)

@@ -0,0 +4,4 @@
+	"errors"
+	"context"
+	"net/http"
+	"net/http/httptest"

@@ -0,0 +54,4 @@
+			return
+		}
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte("success"))

@@ -0,0 +218,4 @@
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		attempts++
+		if attempts == 1 {
+			w.Header().Set("Retry-After", "not-a-number-or-date")

@@ -0,0 +39,4 @@
+// contain sensitive details from the upstream server.
+type APIError struct {
+	StatusCode int
+	Body       string

@@ -0,0 +128,4 @@
+
+// parseRetryAfter parses a Retry-After header value, supporting both integer
+// seconds (e.g. "120") and HTTP-date format (e.g. "Thu, 01 Dec 2025 16:00:00 GMT")
+// as specified in RFC 7231 §7.1.3.

@@ -0,0 +168,4 @@
+		if attempt > 0 {
+			var delay time.Duration
+			if attempt-1 < len(backoff) {
+				delay = backoff[attempt-1]

@@ -0,0 +108,4 @@
+	}
+	return &Client{
+		baseURL: strings.TrimRight(baseURL, "/"),
+		token:   token,

@@ -0,0 +110,4 @@
+		baseURL: strings.TrimRight(baseURL, "/"),
+		token:   token,
+		http:    &http.Client{Timeout: 30 * time.Second},
+		now:     time.Now,

@@ -0,0 +128,4 @@
+
+// parseRetryAfter parses a Retry-After header value, supporting both integer
+// seconds (e.g. "120") and HTTP-date format (e.g. "Thu, 01 Dec 2025 16:00:00 GMT")
+// as specified in RFC 7231 §7.1.3.

@@ -0,0 +155,4 @@
+}
+
+// doRequest performs an HTTP request with retry on 429 rate limit responses.
+// It respects the Retry-After header when present, supporting both integer

@@ -0,0 +1,431 @@
+package github
+
+import (
+	"errors"

@@ -0,0 +76,4 @@
+func asAPIError(err error) (*APIError, bool) {
+	if err == nil {
+		return nil, false
+	}

@@ -0,0 +193,4 @@
+		req, err := http.NewRequestWithContext(ctx, method, reqURL, nil)
+		if err != nil {
+			return nil, fmt.Errorf("create request: %w", err)
+		}

@@ -0,0 +212,4 @@
+			if err != nil {
+				return nil, fmt.Errorf("read response body: %w", err)
+			}
+			return body, nil

@@ -0,0 +26,4 @@
+func TestDoRequest_Success(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("Authorization"); got != "Bearer test-token" {
+			t.Errorf("Authorization = %q, want Bearer test-token", got)

@@ -0,0 +57,4 @@
+		w.Write([]byte("success"))
+	}))
+	defer srv.Close()
+

@@ -0,0 +46,4 @@
+	Body       string
+}
+
+func (e *APIError) Error() string {

@@ -0,0 +48,4 @@
+
+func (e *APIError) Error() string {
+	body := e.Body
+	if len(body) > 200 {

@@ -0,0 +89,4 @@
+// SetHTTPClient and SetRetryBackoff are intended for test setup only and must
+// be called before any goroutines issue requests; they have no synchronization.
+type Client struct {
+	baseURL string

@@ -0,0 +144,4 @@
+
+	// Try integer seconds first (most common from GitHub).
+	// RFC 7231 allows delta-seconds of 0 to indicate immediate retry.
+	if seconds, err := strconv.Atoi(value); err == nil && seconds >= 0 {

@@ -0,0 +194,4 @@
+		if err != nil {
+			return nil, fmt.Errorf("create request: %w", err)
+		}
+		req.Header.Set("Authorization", "Bearer "+c.token)

@@ -0,0 +1,391 @@
+package github

@@ -0,0 +36,4 @@
+// APIError represents an HTTP error response from the GitHub API.
+// It carries the status code so callers can distinguish between
+// different failure modes (e.g. 404 vs 500).
+//

@@ -0,0 +83,4 @@
+	}
+	return nil, false
+}
+

@@ -0,0 +148,4 @@
+// parsed time and now. If the date is in the past, it returns 0.
+//
+// Returns (0, false) if the value cannot be parsed as either format.
+func (c *Client) parseRetryAfter(value string) (time.Duration, bool) {

@@ -0,0 +189,4 @@
+				delay = backoff[attempt-1]
+			}
+			if delay > 0 {
+				timer := time.NewTimer(delay)

@@ -0,0 +212,4 @@
+
+		resp, err := c.http.Do(req)
+		if err != nil {
+			return nil, fmt.Errorf("do request: %w", err)

@@ -0,0 +34,4 @@
+	defer srv.Close()
+
+	c := NewClient("test-token", srv.URL)
+	body, err := c.doGet(context.Background(), srv.URL+"/test")

@@ -0,0 +117,4 @@
+	return &Client{
+		baseURL: strings.TrimRight(baseURL, "/"),
+		token:   token,
+		http:    &http.Client{Timeout: 30 * time.Second},

@@ -0,0 +173,4 @@
+// doRequest performs an HTTP request with retry on 429 rate limit responses.
+// It respects the Retry-After header when present, supporting both integer
+// seconds and HTTP-date formats (capped at maxRetryAfter).
+func (c *Client) doRequest(ctx context.Context, method, reqURL string, accept string) ([]byte, error) {

@@ -0,0 +85,4 @@
+}
+
+// Client interacts with the GitHub API.
+// A Client is safe for concurrent use by multiple goroutines.

@@ -0,0 +90,4 @@
+// be called before any goroutines issue requests; they have no synchronization.
+type Client struct {
+	// TODO: baseURL is populated by NewClient but not yet consumed by doRequest/doGet.
+	// Higher-level exported methods (GetPullRequest, etc.) will use it to

@@ -0,0 +185,4 @@
+	for attempt := 0; attempt < maxRetryAttempts; attempt++ {
+		if attempt > 0 {
+			var delay time.Duration
+			if attempt-1 < len(backoff) {

@@ -0,0 +219,4 @@
+		if resp.StatusCode >= 200 && resp.StatusCode < 300 {
+			body, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseBodyBytes))
+			resp.Body.Close()
+			if err != nil {

@@ -0,0 +35,4 @@
+
+	c := NewClient("test-token", srv.URL)
+	body, err := c.doGet(context.Background(), srv.URL+"/test")
+	if err != nil {

@@ -0,0 +262,4 @@
+	c.SetRetryBackoff([]time.Duration{10 * time.Second, 10 * time.Second})
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()

@@ -0,0 +95,4 @@
+	// accepting full URLs instead.
+	baseURL string
+	token   string
+	httpClient *http.Client

@@ -0,0 +103,4 @@
+	retryBackoff []time.Duration
+
+	// now returns the current time. Defaults to time.Now.
+	// Override in tests to control HTTP-date Retry-After calculations.

@@ -0,0 +117,4 @@
+	return &Client{
+		baseURL: strings.TrimRight(baseURL, "/"),
+		token:   token,
+		httpClient: &http.Client{Timeout: 30 * time.Second},

@@ -0,0 +152,4 @@
+	value = strings.TrimSpace(value)
+
+	// Try integer seconds first (most common from GitHub).
+	// RFC 7231 allows delta-seconds of 0 to indicate immediate retry.

@@ -0,0 +165,4 @@
+			delay = 0
+		}
+		return delay, true
+	}

@@ -0,0 +169,4 @@
+
+	return 0, false
+}
+

@@ -0,0 +133,4 @@
+//
+// Note: if an empty non-nil slice is provided, Retry-After delays parsed from
+// server responses will be computed and capped but not applied (because
+// attempt < len(backoff) is always false). This is acceptable for the