From 1e572d59a91a564f03c728518212012a86151b9a Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Fri, 30 Oct 2026 16:55:52 +0100
Subject: [PATCH] egress: a github link also derives raw, codeload and objects
 hosts

---
 docs/networking/network.md          |  5 +++--
 swarm-controller/src/link_egress.rs | 22 +++++++++++++++++++---
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/docs/networking/network.md b/docs/networking/network.md
index e0483fd5..92bd3fd4 100644
--- a/docs/networking/network.md
+++ b/docs/networking/network.md
@@ -368,8 +368,9 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
   like any other.
   Linking a GitHub token, an external matrix account or an external forge
   account adds a derived entry for that agent per host it reaches, and
-  deleting the account removes it: `github.com` and `api.github.com` for
-  GitHub, and the host of the matrix account's `homeserver` or the forge
+  deleting the account removes it: `github.com`, `api.github.com`,
+  `raw.githubusercontent.com`, `codeload.github.com` and
+  `objects.githubusercontent.com` for GitHub, and the host of the matrix account's `homeserver` or the forge
   account's `url`. Each entry's `source` (`link:github`,
   `link:matrix:<account>`, `link:forge:<label>`) keeps it apart from the
   environment's, which a save of the environment leaves alone; an entry
diff --git a/swarm-controller/src/link_egress.rs b/swarm-controller/src/link_egress.rs
index a967be65..e6f5a524 100644
--- a/swarm-controller/src/link_egress.rs
+++ b/swarm-controller/src/link_egress.rs
@@ -34,8 +34,15 @@ use crate::linked_accounts::{AccountKind, AccountStore, linked_accounts};
 use crate::routes::{AppState, error_problem, wanted_error_status};
 use crate::schedules::queue;
 
-/// What the GitHub token is used against: `gh`'s API and git over HTTPS.
-const GITHUB_HOSTS: [&str; 2] = ["github.com", "api.github.com"];
+/// What the GitHub token is used against: `gh`'s API, git over HTTPS, and the
+/// raw file, archive and release-asset downloads.
+const GITHUB_HOSTS: [&str; 5] = [
+    "github.com",
+    "api.github.com",
+    "raw.githubusercontent.com",
+    "codeload.github.com",
+    "objects.githubusercontent.com",
+];
 
 /// An account the operator links to an agent.
 pub(crate) enum Link<'a> {
@@ -325,6 +332,13 @@ mod tests {
             [
                 entry("github.com", "atlas", Some("link:github")),
                 entry("api.github.com", "atlas", Some("link:github")),
+                entry("raw.githubusercontent.com", "atlas", Some("link:github")),
+                entry("codeload.github.com", "atlas", Some("link:github")),
+                entry(
+                    "objects.githubusercontent.com",
+                    "atlas",
+                    Some("link:github")
+                ),
             ]
         );
         // A port, a path, a trailing slash and a scheme-less value all reduce
@@ -521,7 +535,7 @@ mod tests {
         crate::linked_accounts::delete_backend_env(State(state.clone()), path("atlas"))
             .await
             .expect("deleted");
-        assert_eq!(list_of(&client).await.len(), 4);
+        assert_eq!(list_of(&client).await.len(), 2 + GITHUB_HOSTS.len());
 
         crate::linked_accounts::delete_github_account(State(state.clone()), path("atlas"))
             .await
@@ -564,6 +578,8 @@ mod tests {
         );
         modify(&client, |mut list| {
             list.entries.extend([
+                // A link from before the host list grew: the pass adds the rest.
+                entry("github.com", "atlas", Some("link:github")),
                 // An orphan: iris has no leaf for it.
                 entry("github.com", "iris", Some("link:github")),
                 // An orphan on a live agent whose forge leaf is gone.