Update (after #2442 merged main): the original claim that the whole module is dead is no longer accurate. main added resolve_github_release_asset_api_url() to _github_http.py, which is now used by extensions, presets, and workflow URL resolution. The issue is narrowed below to the parts that are genuinely unused.
Problem Statement
src/specify_cli/_github_http.py mixes a live helper with dead code:
- Live:
resolve_github_release_asset_api_url() — used by extensions.py, presets.py, and __init__.py (workflow/preset URL resolution).
- Unused in production:
open_github_url() (no callers anywhere) and the _StripAuthOnRedirect redirect handler it relies on (referenced only by open_github_url and its tests). build_github_request() / GITHUB_HOSTS are likewise referenced only by tests.
$ git grep -n open_github_url -- 'src/*.py'
src/specify_cli/_github_http.py:...:def open_github_url(...) # definition only, no callers
The dead _github_http._StripAuthOnRedirect duplicates the live authentication/http._StripAuthOnRedirect: two implementations of the same "strip Authorization on cross-host redirect / reject non-HTTPS redirect" rule, which can drift.
Proposed Solution
Remove the unused open_github_url() and _StripAuthOnRedirect from _github_http.py, keeping the live resolve_github_release_asset_api_url(). Decide whether build_github_request() / GITHUB_HOSTS are worth keeping as a tested utility or should go too. Update tests/test_github_http.py accordingly. No runtime behavior change — the single live redirect/strip-auth path in authentication/http.py is untouched.
Alternatives Considered
Leave as-is: rejected — keeps a second redirect handler alive that a future hardening fix can silently miss.
Component
Specify CLI (initialization, commands)
AI Agent (if applicable)
Not applicable
Use Cases
Maintenance only: one redirect/strip-auth implementation to review and harden instead of two.
Acceptance Criteria
Additional Context
Surfaced during review of #2442. AI disclosure: this issue was drafted and revised by an AI agent (Claude) under my direction; I verified the grep evidence and the current usage of resolve_github_release_asset_api_url after the merge.
Problem Statement
src/specify_cli/_github_http.pymixes a live helper with dead code:resolve_github_release_asset_api_url()— used byextensions.py,presets.py, and__init__.py(workflow/preset URL resolution).open_github_url()(no callers anywhere) and the_StripAuthOnRedirectredirect handler it relies on (referenced only byopen_github_urland its tests).build_github_request()/GITHUB_HOSTSare likewise referenced only by tests.The dead
_github_http._StripAuthOnRedirectduplicates the liveauthentication/http._StripAuthOnRedirect: two implementations of the same "strip Authorization on cross-host redirect / reject non-HTTPS redirect" rule, which can drift.Proposed Solution
Remove the unused
open_github_url()and_StripAuthOnRedirectfrom_github_http.py, keeping the liveresolve_github_release_asset_api_url(). Decide whetherbuild_github_request()/GITHUB_HOSTSare worth keeping as a tested utility or should go too. Updatetests/test_github_http.pyaccordingly. No runtime behavior change — the single live redirect/strip-auth path inauthentication/http.pyis untouched.Alternatives Considered
Leave as-is: rejected — keeps a second redirect handler alive that a future hardening fix can silently miss.
Component
Specify CLI (initialization, commands)
AI Agent (if applicable)
Not applicable
Use Cases
Maintenance only: one redirect/strip-auth implementation to review and harden instead of two.
Acceptance Criteria
open_github_url()and its dedicated_StripAuthOnRedirectremovedresolve_github_release_asset_api_url()retained and still covered by testsbuild_github_request()/GITHUB_HOSTS(keep as tested utility or remove)tests/test_github_http.pyupdated; full test suite passesAdditional Context
Surfaced during review of #2442. AI disclosure: this issue was drafted and revised by an AI agent (Claude) under my direction; I verified the grep evidence and the current usage of
resolve_github_release_asset_api_urlafter the merge.