Implement the GitHub API client with PRReader and FileReader interface
conformance for both github.com and GitHub Enterprise.

New files:
- github/client.go: Client struct, NewClient with configurable base URL,
  HTTP helpers with 429 retry and Retry-After support
- github/pr.go: GetPullRequest, GetPullRequestDiff (per-request Accept
  header), GetPullRequestFiles (paginated, populates Patch field),
  GetFileContentAtRef (base64 decode), GetCommitStatuses (merges commit
  statuses + check runs with conclusion mapping)
- github/files.go: GetFileContent (delegates to GetFileContentAtRef),
  ListContents, escapePath, decodeBase64Content helpers

Type changes:
- vcs/types.go: Add Patch field to ChangedFile struct

Tests cover: happy path, 404, 401, 429+retry, malformed response,
pagination, binary files, check run conclusion mapping, base64 decoding.

Compile-time checks:
  var _ vcs.PRReader = (*Client)(nil)
  var _ vcs.FileReader = (*Client)(nil)

Exit criteria met:
- go test ./github/... passes (all methods)
- NewClient with empty baseURL uses https://api.github.com
- NewClient with GHE URL targets correctly
- GetFileContent delegates to GetFileContentAtRef with empty ref
- GetPullRequestFiles paginates and populates Patch field
- GetCommitStatuses merges both commit statuses and check-runs

@@ -0,0 +61,4 @@
+// errorAs is a type-safe wrapper for errors.As to avoid import cycle issues.
+func errorAs(err error, target interface{}) bool {
+	switch t := target.(type) {
+	case **APIError:

@@ -0,0 +81,4 @@
+// Client interacts with the GitHub API.
+// A Client is safe for concurrent use by multiple goroutines.
+type Client struct {
+	baseURL string

@@ -0,0 +160,4 @@
+			body, err := io.ReadAll(resp.Body)
+			resp.Body.Close()
+			if err != nil {
+				return nil, fmt.Errorf("read response body: %w", err)

@@ -0,0 +12,4 @@
+)
+
+// GetFileContent fetches a file from the default branch of a repo.
+// Delegates to GetFileContentAtRef with an empty ref.

@@ -0,0 +207,4 @@
+// mapCheckRunStatus maps a check run conclusion+status to a vcs.CommitStatus status string.
+func mapCheckRunStatus(conclusion *string, status string) string {
+	if conclusion == nil {
+		// Still running or queued

@@ -0,0 +65,4 @@
+	baseURL string
+	token   string
+	http    *http.Client
+

@@ -0,0 +127,4 @@
+		}
+		req.Header.Set("Authorization", "Bearer "+c.token)
+		if accept != "" {
+			req.Header.Set("Accept", accept)

@@ -0,0 +167,4 @@
+}
+
+func TestIsNotFound(t *testing.T) {
+	err := &APIError{StatusCode: 404, Body: "not found"}

@@ -0,0 +14,4 @@
+// GetFileContent fetches a file from the default branch of a repo.
+// Delegates to GetFileContentAtRef with an empty ref.
+func (c *Client) GetFileContent(ctx context.Context, owner, repo, path, ref string) (string, error) {
+	return c.GetFileContentAtRef(ctx, owner, repo, path, ref)

@@ -0,0 +204,4 @@
+	return result, nil
+}
+
+// mapCheckRunStatus maps a check run conclusion+status to a vcs.CommitStatus status string.

@@ -0,0 +625,4 @@
+
+	c := NewClient("token", srv.URL)
+	c.SetHTTPClient(srv.Client())
+

@@ -0,0 +113,4 @@
+			if delay > 0 {
+				timer := time.NewTimer(delay)
+				select {
+				case <-timer.C:

@@ -0,0 +148,4 @@
+
+		errBody, _ := io.ReadAll(io.LimitReader(resp.Body, maxErrorBodyBytes))
+		resp.Body.Close()
+

@@ -0,0 +12,4 @@
+)
+
+// GetFileContent fetches a file from the default branch of a repo.
+// Delegates to GetFileContentAtRef with an empty ref.

@@ -0,0 +154,4 @@
+		// Retry on 429 rate limit
+		if resp.StatusCode == http.StatusTooManyRequests && attempt < maxAttempts-1 {
+			// Check for Retry-After header and override backoff if present
+			if ra := resp.Header.Get("Retry-After"); ra != "" {

@@ -0,0 +157,4 @@
+			if ra := resp.Header.Get("Retry-After"); ra != "" {
+				if seconds, err := strconv.Atoi(ra); err == nil && seconds > 0 {
+					if attempt < len(backoff) {
+						backoff[attempt] = time.Duration(seconds) * time.Second

@@ -0,0 +47,4 @@
+
+// escapePath escapes each segment of a relative file path for use in URLs.
+// Slashes are preserved as path separators; other special characters are escaped.
+func escapePath(p string) string {

@@ -0,0 +60,4 @@
+}
+
+// Client interacts with the GitHub API.
+// A Client is safe for concurrent use by multiple goroutines.

@@ -0,0 +83,4 @@
+		baseURL: strings.TrimRight(baseURL, "/"),
+		token:   token,
+		http:    &http.Client{Timeout: 30 * time.Second},
+	}

@@ -0,0 +150,4 @@
+			if err != nil {
+				return nil, fmt.Errorf("read response body: %w", err)
+			}
+			return body, nil

@@ -0,0 +15,4 @@
+// Delegates to GetFileContentAtRef with the provided ref.
+func (c *Client) GetFileContent(ctx context.Context, owner, repo, path, ref string) (string, error) {
+	return c.GetFileContentAtRef(ctx, owner, repo, path, ref)
+}

@@ -0,0 +186,4 @@
+		var checkResp checkRunsResponse
+		if err := json.Unmarshal(checkBody, &checkResp); err != nil {
+			return nil, fmt.Errorf("parse check runs JSON: %w", err)
+		}

@@ -0,0 +628,4 @@
+
+	_, err := c.GetCommitStatuses(context.Background(), "owner", "repo", "sha")
+	if err == nil {
+		t.Fatal("expected error for malformed JSON")

@@ -0,0 +11,4 @@
+	"net/http"
+	"strconv"
+	"strings"
+	"time"

@@ -0,0 +107,4 @@
+	}
+
+	const maxErrorBodyBytes = 64 * 1024
+

@@ -0,0 +133,4 @@
+		if c.token != "" {
+			req.Header.Set("Authorization", "Bearer "+c.token)
+		}
+		if accept != "" {

@@ -0,0 +58,4 @@
+		clean = append(clean, url.PathEscape(part))
+	}
+	return strings.Join(clean, "/")
+}

@@ -0,0 +100,4 @@
+		var files []changedFileResponse
+		if err := json.Unmarshal(body, &files); err != nil {
+			return nil, fmt.Errorf("parse PR files JSON: %w", err)
+		}

@@ -0,0 +63,4 @@
+// A Client is safe for concurrent use by multiple goroutines.
+type Client struct {
+	baseURL string
+	token   string

@@ -0,0 +67,4 @@
+	http    *http.Client
+
+	// RetryBackoff defines the delays between retry attempts for 429 responses.
+	// RetryBackoff[i] is the delay before attempt i+1 (after attempt i fails).

@@ -0,0 +127,4 @@
+		}
+
+		req, err := http.NewRequestWithContext(ctx, method, url, nil)
+		if err != nil {

@@ -0,0 +15,4 @@
+)
+
+const defaultBaseURL = "https://api.github.com"
+const userAgent = "review-bot/1.0"

@@ -0,0 +60,4 @@
+	if errors.As(err, &target) {
+		return target, true
+	}
+	return nil, false

@@ -0,0 +65,4 @@
+
+// Client interacts with the GitHub API.
+// A Client is safe for concurrent use by multiple goroutines.
+type Client struct {

@@ -0,0 +14,4 @@
+// GetFileContent fetches a file from a repo at the given ref.
+// Delegates to GetFileContentAtRef with the provided ref.
+func (c *Client) GetFileContent(ctx context.Context, owner, repo, path, ref string) (string, error) {
+	return c.GetFileContentAtRef(ctx, owner, repo, path, ref)

@@ -0,0 +194,4 @@
+				Description: derefString(cr.Conclusion),
+				TargetURL:   cr.HTMLURL,
+			})
+		}

@@ -0,0 +629,4 @@
+	_, err := c.GetCommitStatuses(context.Background(), "owner", "repo", "sha")
+	if err == nil {
+		t.Fatal("expected error for malformed JSON")
+	}

@@ -0,0 +71,4 @@
+	http    *http.Client
+
+	// RetryBackoff defines the delays between retry attempts for 429 responses.
+	// RetryBackoff[i] is the delay before attempt i+1 (after attempt i fails).

@@ -0,0 +80,4 @@
+// If baseURL is empty, it defaults to https://api.github.com.
+// For GitHub Enterprise, pass the API base URL (e.g. https://github.concur.com/api/v3).
+func NewClient(token, baseURL string) *Client {
+	if baseURL == "" {

@@ -0,0 +83,4 @@
+	}
+	return string(body), nil
+}
+

@@ -0,0 +137,4 @@
+		Encoding string `json:"encoding"`
+	}
+	if err := json.Unmarshal(body, &resp); err != nil {
+		return "", fmt.Errorf("parse file content JSON: %w", err)

@@ -0,0 +80,4 @@
+// If baseURL is empty, it defaults to https://api.github.com.
+// For GitHub Enterprise, pass the API base URL (e.g. https://github.concur.com/api/v3).
+func NewClient(token, baseURL string) *Client {
+	if baseURL == "" {

@@ -0,0 +98,4 @@
+				}
+				return nil
+			},
+		},

@@ -0,0 +38,4 @@
+	for i, e := range entries {
+		result[i] = vcs.ContentEntry{
+			Name: e.Name,
+			Path: e.Path,

@@ -0,0 +173,4 @@
+			TargetURL:   s.TargetURL,
+		})
+	}
+

@@ -0,0 +67,4 @@
+
+// Client interacts with the GitHub API.
+// A Client is safe for concurrent use by multiple goroutines.
+type Client struct {

@@ -0,0 +155,4 @@
+		req, err := http.NewRequestWithContext(ctx, method, url, nil)
+		if err != nil {
+			return nil, fmt.Errorf("create request: %w", err)
+		}

@@ -0,0 +292,4 @@
+func TestDoRequest_SkipsAuthWhenTokenEmpty(t *testing.T) {
+	var gotAuth string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAuth = r.Header.Get("Authorization")

@@ -0,0 +13,4 @@
+
+// GetFileContent fetches a file from a repo at the given ref.
+// Delegates to GetFileContentAtRef with the provided ref.
+func (c *Client) GetFileContent(ctx context.Context, owner, repo, path, ref string) (string, error) {

@@ -0,0 +85,4 @@
+}
+
+// maxPages is the upper bound on pagination loops to prevent unbounded iteration
+// in case the server returns a full page indefinitely.

@@ -0,0 +199,4 @@
+		if len(checkResp.CheckRuns) < 100 {
+			break
+		}
+	}

@@ -0,0 +631,4 @@
+		t.Fatal("expected error for malformed JSON")
+	}
+}
+

@@ -0,0 +86,4 @@
+		baseURL = defaultBaseURL
+	}
+	return &Client{
+		baseURL: strings.TrimRight(baseURL, "/"),

@@ -0,0 +96,4 @@
+				}
+				// Strip Authorization on cross-host redirect or protocol downgrade (https→http).
+				prev := via[len(via)-1]
+				if req.URL.Host != prev.URL.Host || (prev.URL.Scheme == "https" && req.URL.Scheme == "http") {

@@ -0,0 +62,4 @@
+	if errors.As(err, &target) {
+		return target, true
+	}
+	return nil, false

@@ -0,0 +145,4 @@
+				timer := time.NewTimer(delay)
+				select {
+				case <-timer.C:
+				case <-ctx.Done():

@@ -0,0 +176,4 @@
+			resp.Body.Close()
+			if err != nil {
+				return nil, fmt.Errorf("read response body: %w", err)
+			}

@@ -0,0 +35,4 @@
+		return nil, fmt.Errorf("parse contents JSON: %w", err)
+	}
+	result := make([]vcs.ContentEntry, len(entries))
+	for i, e := range entries {

@@ -0,0 +70,4 @@
+// however, SetHTTPClient and SetRetryBackoff must not be called concurrently with requests.
+type Client struct {
+	baseURL string
+	token   string

@@ -0,0 +158,4 @@
+		if err != nil {
+			return nil, fmt.Errorf("create request: %w", err)
+		}
+		if c.token != "" {

@@ -0,0 +281,4 @@
+}
+
+func TestDoRequest_LimitsResponseBody(t *testing.T) {
+	// Verify that responses are read through a limit reader.

@@ -0,0 +54,4 @@
+	for _, part := range parts {
+		if part == "." || part == ".." || part == "" {
+			continue
+		}

@@ -0,0 +59,4 @@
+	body, err := c.doGet(ctx, reqURL)
+	if err != nil {
+		return nil, fmt.Errorf("fetch PR: %w", err)
+	}

@@ -0,0 +193,4 @@
+				Context:     cr.Name,
+				Status:      mapCheckRunStatus(cr.Conclusion, cr.Status),
+				Description: derefString(cr.Conclusion),
+				TargetURL:   cr.HTMLURL,

@@ -0,0 +130,4 @@
+		backoff = make([]time.Duration, len(c.retryBackoff))
+		copy(backoff, c.retryBackoff)
+	} else {
+		backoff = []time.Duration{1 * time.Second, 2 * time.Second}

@@ -0,0 +143,4 @@
+				delay = backoff[attempt-1]
+			}
+			if delay > 0 {
+				timer := time.NewTimer(delay)

@@ -0,0 +174,4 @@
+		}
+
+		if resp.StatusCode >= 200 && resp.StatusCode < 300 {
+			body, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseBytes))

@@ -0,0 +17,4 @@
+	return c.GetFileContentAtRef(ctx, owner, repo, path, ref)
+}
+
+// ListContents lists files and directories at a given path in a repo.

@@ -0,0 +183,4 @@
+		checkBody, err := c.doGet(ctx, checkURL)
+		if err != nil {
+			return nil, fmt.Errorf("fetch check runs page %d: %w", checkPage, err)
+		}

@@ -0,0 +73,4 @@
+	token   string
+	httpClient *http.Client
+
+	// retryBackoff defines the delays between retry attempts for 429 responses.

@@ -0,0 +146,4 @@
+				timer := time.NewTimer(delay)
+				select {
+				case <-timer.C:
+					timer.Stop()

@@ -0,0 +101,4 @@
+// For GitHub Enterprise, pass the API base URL (e.g. https://github.concur.com/api/v3).
+// The baseURL must use HTTPS; pass AllowInsecureHTTP() as an option to permit HTTP
+// for trusted internal deployments (e.g. local testing).
+func NewClient(token, baseURL string, opts ...ClientOption) *Client {

@@ -0,0 +152,4 @@
+	var backoff []time.Duration
+	if c.retryBackoff != nil {
+		backoff = make([]time.Duration, len(c.retryBackoff))
+		copy(backoff, c.retryBackoff)

@@ -0,0 +165,4 @@
+			var delay time.Duration
+			if attempt-1 < len(backoff) {
+				delay = backoff[attempt-1]
+			}

@@ -0,0 +227,4 @@
+	}
+}
+
+func TestDoRequest_RetryAfterDoesNotMutateBackoff(t *testing.T) {

@@ -0,0 +41,4 @@
+	var entries []entry
+	if err := json.Unmarshal(body, &entries); err != nil {
+		var single entry
+		if err2 := json.Unmarshal(body, &single); err2 != nil {

@@ -0,0 +144,4 @@
+		return "", fmt.Errorf("unexpected encoding %q for file %s", resp.Encoding, path)
+	}
+	decoded, err := decodeBase64Content(resp.Content)
+	if err != nil {

@@ -0,0 +35,4 @@
+	if len(body) > 200 {
+		body = body[:200] + "...(truncated)"
+	}
+	return fmt.Sprintf("HTTP %d: %s", e.StatusCode, body)

@@ -0,0 +73,4 @@
+// ClientOption configures optional behavior of NewClient.
+type ClientOption func(*clientConfig)
+
+// AllowInsecureHTTP permits the client to use HTTP (non-TLS) base URLs.

@@ -0,0 +69,4 @@
+type clientConfig struct {
+	allowInsecureHTTP bool
+}
+

@@ -0,0 +128,4 @@
+			},
+		},
+	}
+}

@@ -0,0 +167,4 @@
+				delay = backoff[attempt-1]
+			}
+			if delay > 0 {
+				timer := time.NewTimer(delay)

@@ -0,0 +190,4 @@
+			req.Header.Set("Authorization", "Bearer "+c.token)
+		}
+		req.Header.Set("User-Agent", userAgent)
+		if accept != "" {

@@ -0,0 +56,4 @@
+		}
+	}
+	return result, nil
+}

@@ -0,0 +140,4 @@
+// In production the default {1s, 2s} applies.
+func (c *Client) SetRetryBackoff(d []time.Duration) {
+	c.retryBackoff = d
+}

@@ -0,0 +170,4 @@
+			var delay time.Duration
+			if attempt-1 < len(backoff) {
+				delay = backoff[attempt-1]
+			}

@@ -0,0 +127,4 @@
+
+func TestDoRequest_404NoRetry(t *testing.T) {
+	attempts := 0
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

@@ -0,0 +41,4 @@
+	var entries []entry
+	if err := json.Unmarshal(body, &entries); err != nil {
+		var single entry
+		if err2 := json.Unmarshal(body, &single); err2 != nil {

@@ -0,0 +79,4 @@
+	body, err := c.doRequest(ctx, http.MethodGet, reqURL, "application/vnd.github.diff")
+	if err != nil {
+		return "", fmt.Errorf("fetch diff: %w", err)
+	}

@@ -0,0 +193,4 @@
+				Status:      mapCheckRunStatus(cr.Conclusion, cr.Status),
+				Description: derefString(cr.Conclusion),
+				TargetURL:   cr.HTMLURL,
+			})

@@ -0,0 +28,4 @@
+type APIError struct {
+	StatusCode int
+	Body       string
+}

@@ -0,0 +104,4 @@
+func NewClient(token, baseURL string, opts ...ClientOption) *Client {
+	if baseURL == "" {
+		baseURL = defaultBaseURL
+	}

@@ -0,0 +109,4 @@
+	for _, o := range opts {
+		o(&cfg)
+	}
+	return &Client{

@@ -0,0 +118,4 @@
+			CheckRedirect: func(req *http.Request, via []*http.Request) error {
+				if len(via) >= 10 {
+					return fmt.Errorf("stopped after 10 redirects")
+				}

@@ -0,0 +134,4 @@
+// This is intended for testing to inject mock transports.
+func (c *Client) SetHTTPClient(hc *http.Client) {
+	c.httpClient = hc
+}

@@ -0,0 +159,4 @@
+
+	const maxErrorBodyBytes = 64 * 1024
+
+	// Reject non-HTTPS URLs early since the URL is immutable across retries.

@@ -0,0 +173,4 @@
+			}
+			if delay > 0 {
+				timer := time.NewTimer(delay)
+				select {

@@ -0,0 +91,4 @@
+	allowInsecureHTTP bool
+	httpClient        *http.Client
+
+	// retryBackoff defines the delays between retry attempts for 429 responses.

@@ -0,0 +182,4 @@
+			if attempt-1 < len(backoff) {
+				delay = backoff[attempt-1]
+			}
+			if delay > 0 {

@@ -0,0 +204,4 @@
+		req.Header.Set("User-Agent", userAgent)
+		if accept != "" {
+			req.Header.Set("Accept", accept)
+		} else {

@@ -0,0 +53,4 @@
+			Name: e.Name,
+			Path: e.Path,
+			Type: e.Type,
+		}

@@ -0,0 +98,4 @@
+		body, err := c.doGet(ctx, reqURL)
+		if err != nil {
+			return nil, fmt.Errorf("fetch PR files page %d: %w", page, err)
+		}

@@ -0,0 +153,4 @@
+// GetCommitStatuses fetches both commit statuses and check runs for a SHA,
+// merging them into a unified []vcs.CommitStatus slice.
+func (c *Client) GetCommitStatuses(ctx context.Context, owner, repo, sha string) ([]vcs.CommitStatus, error) {
+	var result []vcs.CommitStatus

@@ -0,0 +123,4 @@
+				// Strip Authorization on cross-host redirect or protocol downgrade (https→http).
+				prev := via[len(via)-1]
+				if req.URL.Host != prev.URL.Host || (prev.URL.Scheme == "https" && req.URL.Scheme == "http") {
+					req.Header.Del("Authorization")

@@ -0,0 +185,4 @@
+			if delay > 0 {
+				timer := time.NewTimer(delay)
+				select {
+				case <-timer.C:

@@ -0,0 +220,4 @@
+				return nil, fmt.Errorf("read response body: %w", err)
+			}
+			if int64(len(body)) >= maxResponseBytes {
+				return nil, fmt.Errorf("response body exceeded %d bytes (truncated)", maxResponseBytes)

@@ -0,0 +60,4 @@
+
+// escapePath escapes each segment of a relative file path for use in URLs.
+// Slashes are preserved as path separators; other special characters are escaped.
+// Dot-segments ("." and "..") are silently removed to prevent path traversal.

@@ -0,0 +147,4 @@
+				if req.URL.Host != prev.URL.Host || (prev.URL.Scheme == "https" && req.URL.Scheme == "http") {
+					req.Header.Del("Authorization")
+				}
+				return nil

@@ -0,0 +223,4 @@
+		} else {
+			req.Header.Set("Accept", "application/vnd.github+json")
+		}
+

@@ -0,0 +256,4 @@
+					if delay > maxRetryAfter {
+						delay = maxRetryAfter
+					}
+					if attempt < len(backoff) {

@@ -0,0 +41,4 @@
+	}
+
+	// The GitHub contents API returns an array for directories and an object
+	// for single files. Try array first (common case), then fall back to object.

@@ -0,0 +106,4 @@
+		if len(files) == 0 {
+			break
+		}
+		for _, f := range files {

@@ -0,0 +629,4 @@
+	_, err := c.GetCommitStatuses(context.Background(), "owner", "repo", "sha")
+	if err == nil {
+		t.Fatal("expected error for malformed JSON")
+	}

@@ -0,0 +30,4 @@
+	StatusCode int
+	Body       string
+}
+

@@ -0,0 +75,4 @@
+type ClientOption func(*clientConfig)
+
+// AllowInsecureHTTP permits the client to use HTTP (non-TLS) base URLs.
+// This should only be used for trusted internal deployments or testing.

@@ -0,0 +118,4 @@
+			Timeout: 30 * time.Second,
+			CheckRedirect: func(req *http.Request, via []*http.Request) error {
+				if len(via) >= 10 {
+					return fmt.Errorf("stopped after 10 redirects")

@@ -0,0 +47,4 @@
+func IsNotFound(err error) bool {
+	if apiErr, ok := asAPIError(err); ok {
+		return apiErr.StatusCode == http.StatusNotFound
+	}

@@ -0,0 +193,4 @@
+		if attempt > 0 {
+			var delay time.Duration
+			if attempt-1 < len(backoff) {
+				delay = backoff[attempt-1]

@@ -0,0 +232,4 @@
+		if resp.StatusCode >= 200 && resp.StatusCode < 300 {
+			body, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseBytes))
+			resp.Body.Close()
+			if err != nil {

@@ -0,0 +55,4 @@
+	}
+
+	result := make([]vcs.ContentEntry, len(entries))
+	for i, e := range entries {

@@ -0,0 +71,4 @@
+		Base:   vcs.BaseRef{Ref: resp.Base.Ref},
+	}, nil
+}
+

@@ -0,0 +427,4 @@
+	if err == nil {
+		t.Fatal("expected error for malformed JSON")
+	}
+}

@@ -0,0 +115,4 @@
+	}
+	return nil
+}
+

@@ -0,0 +214,4 @@
+		if c.token != "" {
+			// Bearer is the OAuth2 standard and is accepted by GitHub for both
+			// classic PATs and fine-grained tokens. The alternative "token" scheme
+			// is GitHub-specific and offers no additional compatibility.

@@ -0,0 +48,4 @@
+		if err2 := json.Unmarshal(body, &single); err2 != nil {
+			return nil, fmt.Errorf("parse contents JSON: %w", err2)
+		}
+		// Guard against empty objects ({}) or unexpected shapes that

@@ -0,0 +75,4 @@
+// ListContents) already handle missing-file errors from the API if the cleaned
+// path doesn't match what the caller intended.
+func escapePath(p string) string {
+	parts := strings.Split(p, "/")

@@ -0,0 +141,4 @@
+		Content  string `json:"content"`
+		Encoding string `json:"encoding"`
+	}
+	if err := json.Unmarshal(body, &resp); err != nil {

@@ -0,0 +188,4 @@
+			return nil, fmt.Errorf("fetch check runs page %d: %w", checkPage, err)
+		}
+		var checkResp checkRunsResponse
+		if err := json.Unmarshal(checkBody, &checkResp); err != nil {

@@ -0,0 +123,4 @@
+// for trusted internal deployments (e.g. local testing).
+func NewClient(token, baseURL string, opts ...ClientOption) *Client {
+	if baseURL == "" {
+		baseURL = defaultBaseURL

@@ -0,0 +218,4 @@
+			req.Header.Set("Authorization", "Bearer "+c.token)
+		}
+		req.Header.Set("User-Agent", userAgent)
+		if accept != "" {

@@ -0,0 +113,4 @@
+	// Strip Authorization on cross-host redirect or protocol downgrade (https→http).
+	prev := via[len(via)-1]
+	if req.URL.Host != prev.URL.Host || (prev.URL.Scheme == "https" && req.URL.Scheme == "http") {
+		req.Header.Del("Authorization")

@@ -0,0 +225,4 @@
+		}
+		if c.token != "" {
+			// Bearer is the OAuth2 standard and is accepted by GitHub for both
+			// classic PATs and fine-grained tokens. The alternative "token" scheme

@@ -0,0 +152,4 @@
+		attempts++
+		w.WriteHeader(401)
+		w.Write([]byte(`{"message":"bad credentials"}`))
+	}))

@@ -0,0 +61,4 @@
+	result := make([]vcs.ContentEntry, len(entries))
+	for i, e := range entries {
+		result[i] = vcs.ContentEntry{
+			Name: e.Name,

@@ -0,0 +144,4 @@
+		Encoding string `json:"encoding"`
+	}
+	if err := json.Unmarshal(body, &resp); err != nil {
+		return "", fmt.Errorf("parse file content JSON: %w", err)

@@ -0,0 +203,4 @@
+				TargetURL:   cr.HTMLURL,
+			})
+		}
+		if len(checkResp.CheckRuns) < 100 {

@@ -0,0 +41,4 @@
+	if len(body) > 200 {
+		body = body[:200] + "...(truncated)"
+	}
+	return fmt.Sprintf("HTTP %d: %s", e.StatusCode, body)

@@ -0,0 +106,4 @@
+// defaultCheckRedirect is the redirect policy used by NewClient and SetHTTPClient(nil).
+// It strips the Authorization header on cross-host redirects or protocol downgrades
+// (HTTPS→HTTP) to prevent credential leakage, while still following the redirect.
+func defaultCheckRedirect(req *http.Request, via []*http.Request) error {

@@ -0,0 +112,4 @@
+	}
+	// Strip Authorization on cross-host redirect or protocol downgrade (https→http).
+	prev := via[len(via)-1]
+	if req.URL.Host != prev.URL.Host || (prev.URL.Scheme == "https" && req.URL.Scheme == "http") {

@@ -0,0 +196,4 @@
+	// maxErrorBodyBytes limits how much of an error response body is stored.
+	// Kept small (4 KiB) to reduce the risk of sensitive data leakage if callers
+	// log APIError.Body directly. Error() further truncates to 200 bytes.
+	const maxErrorBodyBytes = 4 * 1024

@@ -0,0 +227,4 @@
+				}
+			}
+		}
+

@@ -0,0 +56,4 @@
+			return nil, fmt.Errorf("parse contents JSON: unexpected response format")
+		}
+		entries = []entry{single}
+	}

@@ -0,0 +53,4 @@
+}
+
+// GetPullRequest fetches PR metadata.
+func (c *Client) GetPullRequest(ctx context.Context, owner, repo string, number int) (*vcs.PullRequest, error) {

@@ -0,0 +124,4 @@
+}
+
+// GetFileContentAtRef fetches a file at a specific ref from a repo.
+// If ref is empty, the query parameter is omitted (uses default branch).

@@ -0,0 +113,4 @@
+func defaultCheckRedirect(req *http.Request, via []*http.Request) error {
+	if len(via) >= 10 {
+		return fmt.Errorf("stopped after 10 redirects")
+	}

@@ -0,0 +212,4 @@
+	var lastErr error
+	for attempt := 0; attempt < maxAttempts; attempt++ {
+		if attempt > 0 {
+			var delay time.Duration

@@ -0,0 +56,4 @@
+}
+
+// IsUnauthorized reports whether an error is an API 401 response.
+func IsUnauthorized(err error) bool {

@@ -0,0 +193,4 @@
+	var backoff []time.Duration
+	if c.retryBackoff != nil {
+		backoff = make([]time.Duration, len(c.retryBackoff))
+		copy(backoff, c.retryBackoff)

@@ -0,0 +243,4 @@
+			// is GitHub-specific and offers no additional compatibility.
+			req.Header.Set("Authorization", "Bearer "+c.token)
+		}
+		req.Header.Set("User-Agent", userAgent)

@@ -0,0 +76,4 @@
+	// The GitHub contents API returns an array for directories and an object
+	// for single files. Try array first (common case), then fall back to object.
+	// An empty array ([]) is valid — it represents an empty directory — and
+	// results in a zero-length slice returned without error.

@@ -0,0 +167,4 @@
+				Context:     cr.Name,
+				Status:      mapCheckRunStatus(cr.Conclusion),
+				Description: derefString(cr.Conclusion),
+				TargetURL:   cr.HTMLURL,

@@ -0,0 +192,4 @@
+	case "failure", "action_required", "timed_out":
+		return "failure"
+	case "cancelled", "skipped", "neutral":
+		return "success" // non-blocking

@@ -0,0 +625,4 @@
+
+	c := NewClient("token", srv.URL, AllowInsecureHTTP())
+	c.SetHTTPClient(srv.Client())
+

@@ -0,0 +217,4 @@
+	var lastErr error
+	for attempt := 0; attempt < maxAttempts; attempt++ {
+		if attempt > 0 {
+			var delay time.Duration

@@ -0,0 +230,4 @@
+					timer.Stop()
+					return nil, ctx.Err()
+				}
+			}

@@ -0,0 +240,4 @@
+		if c.token != "" {
+			// Bearer is the OAuth2 standard and is accepted by GitHub for both
+			// classic PATs and fine-grained tokens. The alternative "token" scheme
+			// is GitHub-specific and offers no additional compatibility.

@@ -0,0 +94,4 @@
+	result := make([]vcs.ContentEntry, len(entries))
+	for i, e := range entries {
+		result[i] = vcs.ContentEntry{
+			Name: e.Name,

@@ -0,0 +48,4 @@
+		Conclusion *string `json:"conclusion"`
+		Status     string  `json:"status"`
+		HTMLURL    string  `json:"html_url"`
+	} `json:"check_runs"`

@@ -0,0 +171,4 @@
+				Status:      mapCheckRunStatus(cr.Conclusion),
+				Description: derefString(cr.Conclusion),
+				TargetURL:   cr.HTMLURL,
+			})

@@ -0,0 +127,4 @@
+}
+
+func TestGetPullRequest_MalformedJSON(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

@@ -0,0 +233,4 @@
+			}
+		}
+
+		req, err := http.NewRequestWithContext(ctx, method, reqURL, nil)

@@ -0,0 +244,4 @@
+			req.Header.Set("Authorization", "Bearer "+c.token)
+		}
+		req.Header.Set("User-Agent", userAgent)
+		if accept != "" {

@@ -0,0 +260,4 @@
+			return body, err
+		}
+		lastErr = err
+

@@ -0,0 +71,4 @@
+		Name string `json:"name"`
+		Path string `json:"path"`
+		Type string `json:"type"`
+	}

@@ -0,0 +128,4 @@
+// If the commit statuses endpoint fails (e.g. 404 for an unknown SHA), the
+// function returns immediately without attempting the check-runs endpoint.
+// If the check-runs endpoint fails after statuses were fetched successfully,
+// the function returns an error (not a partial result) so callers always get

@@ -0,0 +629,4 @@
+	_, err := c.GetCommitStatuses(context.Background(), "owner", "repo", "sha")
+	if err == nil {
+		t.Fatal("expected error for malformed JSON")
+	}

@@ -0,0 +36,4 @@
+	Body       string
+}
+
+func (e *APIError) Error() string {

@@ -0,0 +142,4 @@
+		baseURL = defaultBaseURL
+	}
+	cfg := clientConfig{}
+	for _, o := range opts {