@teambit/ci 1.0.632 → 1.0.634

package/sync/github-client.spec.ts

@@ -1,5 +1,5 @@
 import { expect } from 'chai';
-import { GitHubClient, isGitHubRemote, parseGitHubRepo } from './github-client';
+import { GitHubClient, GitHubHostProvider, gitHubApiUrl, isGitHubRemote, parseGitHubRepo } from './github-client';
 
 /**
  * A claimed remote the parse then fails on silently degrades the whole run to PR-less mode, so the two
@@ -332,3 +332,336 @@ describe('GitHubClient', () => {
     });
   });
 });
+
+/**
+ * GitHub Enterprise Server: Actions sets `GITHUB_SERVER_URL` and `GITHUB_API_URL` on every runner, and
+ * those two variables are all that turns a GHES remote into a GitHub one. On github.com Actions sets them
+ * to github.com's own values, which must read exactly like leaving them unset.
+ */
+describe('GitHub Enterprise Server', () => {
+  const GHES_SERVER = 'https://ghe.corp.example';
+  const GHES_API = 'https://ghe.corp.example/api/v3';
+  const envKeys = ['GITHUB_TOKEN', 'BIT_GITHUB_TOKEN', 'GITHUB_REPOSITORY', 'GITHUB_API_URL', 'GITHUB_SERVER_URL'];
+  const saved: Record<string, string | undefined> = {};
+
+  beforeEach(() => {
+    envKeys.forEach((key) => {
+      saved[key] = process.env[key];
+      delete process.env[key];
+    });
+    process.env.GITHUB_TOKEN = 'tok';
+  });
+
+  afterEach(() => {
+    envKeys.forEach((key) => {
+      if (saved[key] === undefined) delete process.env[key];
+      else process.env[key] = saved[key];
+    });
+  });
+
+  /** Records every request a client built from the environment makes, answering with `body`. */
+  function recordingFetch(body: unknown = []) {
+    const calls: Array<{ url: string; init: any }> = [];
+    const fetchImpl = (async (url: any, init: any) => {
+      calls.push({ url: String(url), init });
+      return new Response(JSON.stringify(body), { status: 200, headers: { 'content-type': 'application/json' } });
+    }) as typeof fetch;
+    return { calls, fetchImpl };
+  }
+
+  const PR = { number: 7, state: 'open', labels: [], head: { ref: 'lane-x' }, html_url: 'http://pr/7' };
+
+  describe('with neither variable set, or both naming github.com', () => {
+    const GITHUB_DOT_COM_ENVS: Array<[string, Record<string, string>]> = [
+      ['unset', {}],
+      [
+        'set by a github.com runner',
+        { GITHUB_API_URL: 'https://api.github.com', GITHUB_SERVER_URL: 'https://github.com' },
+      ],
+    ];
+
+    GITHUB_DOT_COM_ENVS.forEach(([name, env]) => {
+      it(`talks to api.github.com and claims github.com remotes only (${name})`, async () => {
+        Object.assign(process.env, env);
+        expect(gitHubApiUrl()).to.deep.equal({ url: 'https://api.github.com' });
+        REMOTES.forEach(([url, repo, isGitHub]) => {
+          expect(parseGitHubRepo(url), url).to.equal(repo);
+          expect(isGitHubRemote(url), url).to.equal(isGitHub);
+        });
+        expect(isGitHubRemote('https://ghe.corp.example/acme/store.git')).to.equal(false);
+        expect(GitHubClient.fromEnv('https://ghe.corp.example/acme/store.git')).to.equal(undefined);
+
+        const client = GitHubClient.fromEnv('git@github.com:acme/shop.git');
+        expect(client?.apiUrl).to.equal('https://api.github.com');
+        const { calls, fetchImpl } = recordingFetch(PR);
+        await new GitHubClient({ token: 'tok', repo: client!.repo, apiUrl: client!.apiUrl, fetchImpl }).createPr({
+          head: 'lane-x',
+          base: 'main',
+          title: 't',
+          body: 'b',
+        });
+        expect(calls[0].url).to.equal('https://api.github.com/repos/acme/shop/pulls');
+      });
+    });
+  });
+
+  it('a github.com repository always talks to api.github.com, whatever GITHUB_API_URL says', () => {
+    process.env.GITHUB_API_URL = 'https://evil.example/api/v3';
+    expect(gitHubApiUrl()).to.deep.equal({ url: 'https://api.github.com' });
+    expect(gitHubApiUrl('github.com')).to.deep.equal({ url: 'https://api.github.com' });
+    expect(GitHubClient.fromEnv('git@github.com:acme/shop.git')?.apiUrl).to.equal('https://api.github.com');
+  });
+
+  describe('on a GHES runner', () => {
+    beforeEach(() => {
+      process.env.GITHUB_API_URL = GHES_API;
+      process.env.GITHUB_SERVER_URL = GHES_SERVER;
+    });
+
+    /** url, parseGitHubRepo, isGitHubRemote — the GHES host joins github.com, and nothing else does. */
+    const GHES_REMOTES: Array<[string, string | undefined, boolean]> = [
+      ['https://ghe.corp.example/acme/store.git', 'acme/store', true],
+      ['https://ghe.corp.example/acme/store', 'acme/store', true],
+      ['git@ghe.corp.example:acme/store.git', 'acme/store', true],
+      ['ssh://git@ghe.corp.example/acme/store.git', 'acme/store', true],
+      ['https://x-access-token:tok@GHE.corp.example:443/acme/store.git', 'acme/store', true],
+      // github.com stays GitHub's on a GHES runner
+      ['git@github.com:acme/shop.git', 'acme/shop', true],
+      // the GHES host as a path segment, as a prefix of another host, or as userinfo is a look-alike
+      ['https://evil.example/ghe.corp.example/x.git', undefined, false],
+      ['https://ghe.corp.example.evil.com/x.git', undefined, false],
+      ['git@evil.example:ghe.corp.example/x.git', undefined, false],
+      ['https://ghe.corp.example@evil.example/acme/store.git', undefined, false],
+      ['https://corp.example/acme/store.git', undefined, false],
+    ];
+
+    it('claims and parses GHES remotes, and still rejects every look-alike', () => {
+      GHES_REMOTES.forEach(([url, repo, isGitHub]) => {
+        expect(parseGitHubRepo(url), url).to.equal(repo);
+        expect(isGitHubRemote(url), url).to.equal(isGitHub);
+      });
+      // the REMOTES table's verdicts hold unchanged alongside the GHES host
+      REMOTES.forEach(([url, repo, isGitHub]) => {
+        expect(parseGitHubRepo(url), url).to.equal(repo);
+        expect(isGitHubRemote(url), url).to.equal(isGitHub);
+      });
+    });
+
+    it('matchesRemote accepts the GHES remote in both url forms, and rejects look-alikes', () => {
+      const client = new GitHubClient({ token: 'tok', repo: 'acme/store' });
+      expect(client.matchesRemote('https://ghe.corp.example/acme/store.git')).to.equal(true);
+      expect(client.matchesRemote('git@ghe.corp.example:acme/store.git')).to.equal(true);
+      expect(client.matchesRemote('https://evil.example/ghe.corp.example/x.git')).to.equal(false);
+      expect(client.matchesRemote('https://ghe.corp.example.evil.com/x.git')).to.equal(false);
+    });
+
+    it('sends every pull-request call to the GHES API base', async () => {
+      const client = GitHubClient.fromEnv('git@ghe.corp.example:acme/store.git');
+      expect(client?.repo).to.equal('acme/store');
+      expect(client?.apiUrl).to.equal(GHES_API);
+
+      const { calls, fetchImpl } = recordingFetch(PR);
+      const wired = new GitHubClient({ token: 'tok', repo: client!.repo, apiUrl: client!.apiUrl, fetchImpl });
+      await wired.findPrByBranch('lane-x');
+      await wired.createPr({ head: 'lane-x', base: 'main', title: 't', body: 'b' });
+      await wired.addLabel(7, 'bit-sync-conflict');
+      await wired.closePr(7, 'bye');
+      expect(calls.map((c) => `${c.init.method} ${c.url}`)).to.deep.equal([
+        'GET https://ghe.corp.example/api/v3/repos/acme/store/pulls?state=open&head=acme%3Alane-x',
+        'POST https://ghe.corp.example/api/v3/repos/acme/store/pulls',
+        'POST https://ghe.corp.example/api/v3/repos/acme/store/issues/7/labels',
+        'POST https://ghe.corp.example/api/v3/repos/acme/store/issues/7/comments',
+        'PATCH https://ghe.corp.example/api/v3/repos/acme/store/pulls/7',
+      ]);
+    });
+
+    it('uses the client built from the environment, with no fetch override, against the GHES base', async () => {
+      const realFetch = globalThis.fetch;
+      const { calls, fetchImpl } = recordingFetch();
+      globalThis.fetch = fetchImpl;
+      try {
+        await GitHubClient.fromEnv('https://ghe.corp.example/acme/store.git')?.findPrByBranch('lane-x');
+      } finally {
+        globalThis.fetch = realFetch;
+      }
+      expect(calls).to.have.lengthOf(1);
+      expect(calls[0].url).to.match(/^https:\/\/ghe\.corp\.example\/api\/v3\/repos\/acme\/store\/pulls\?/);
+      expect(calls[0].init.headers.authorization).to.equal('Bearer tok');
+    });
+
+    it('a github.com remote on a GHES runner still talks to api.github.com', () => {
+      expect(GitHubClient.fromEnv('git@github.com:acme/shop.git')?.apiUrl).to.equal('https://api.github.com');
+      expect(gitHubApiUrl('github.com')).to.deep.equal({ url: 'https://api.github.com' });
+      expect(gitHubApiUrl('GHE.corp.example')).to.deep.equal({ url: GHES_API });
+      expect(gitHubApiUrl()).to.deep.equal({ url: GHES_API });
+    });
+
+    it('without GITHUB_API_URL, derives the GHES convention <server origin>/api/v3 — never api.github.com', () => {
+      delete process.env.GITHUB_API_URL;
+      expect(gitHubApiUrl()).to.deep.equal({ url: GHES_API });
+      expect(gitHubApiUrl('ghe.corp.example')).to.deep.equal({ url: GHES_API });
+      expect(GitHubClient.fromEnv('git@ghe.corp.example:acme/store.git')?.apiUrl).to.equal(GHES_API);
+      // the server's protocol and port carry over; its path does not
+      process.env.GITHUB_SERVER_URL = 'http://ghe.corp.example:8080/';
+      expect(gitHubApiUrl('ghe.corp.example')).to.deep.equal({ url: 'http://ghe.corp.example:8080/api/v3' });
+      // github.com is untouched by the enterprise default
+      expect(gitHubApiUrl('github.com')).to.deep.equal({ url: 'https://api.github.com' });
+    });
+
+    it('accepts a GITHUB_API_URL on api.<server host> (GHE.com data residency)', () => {
+      process.env.GITHUB_SERVER_URL = 'https://acme.ghe.com';
+      process.env.GITHUB_API_URL = 'https://api.acme.ghe.com';
+      expect(gitHubApiUrl('acme.ghe.com')).to.deep.equal({ url: 'https://api.acme.ghe.com' });
+      expect(GitHubClient.fromEnv('https://acme.ghe.com/acme/store.git')?.apiUrl).to.equal('https://api.acme.ghe.com');
+    });
+
+    it('refuses a GITHUB_API_URL on another host: no client, a warning naming both values, no request', async () => {
+      const MISMATCHED = [
+        'https://api.github.com',
+        'https://evil.example/api/v3',
+        'https://ghe.corp.example.evil.com/api/v3',
+        'https://api.ghe.corp.example.evil.com',
+        'not a url',
+      ];
+      for (const apiUrl of MISMATCHED) {
+        process.env.GITHUB_API_URL = apiUrl;
+        const result = gitHubApiUrl('ghe.corp.example');
+        expect(result, apiUrl).to.not.have.property('url');
+        expect((result as { error: string }).error, apiUrl)
+          .to.contain(apiUrl)
+          .and.contain(GHES_SERVER);
+
+        const warnings: string[] = [];
+        expect(
+          GitHubClient.fromEnv('git@ghe.corp.example:acme/store.git', (m) => warnings.push(m)),
+          apiUrl
+        ).to.equal(undefined);
+        // a repository from GITHUB_REPOSITORY alone lives on the enterprise instance too
+        process.env.GITHUB_REPOSITORY = 'acme/store';
+        expect(
+          GitHubClient.fromEnv(undefined, (m) => warnings.push(m)),
+          apiUrl
+        ).to.equal(undefined);
+        delete process.env.GITHUB_REPOSITORY;
+        expect(warnings, apiUrl).to.have.lengthOf(2);
+        warnings.forEach((w) => expect(w, apiUrl).to.contain(`"${apiUrl}"`).and.contain(`"${GHES_SERVER}"`));
+
+        // the provider reports "not configured", warns once across retries, and sends nothing
+        const realFetch = globalThis.fetch;
+        const { calls, fetchImpl } = recordingFetch();
+        globalThis.fetch = fetchImpl;
+        const providerWarnings: string[] = [];
+        try {
+          const provider = new GitHubHostProvider((m) => providerWarnings.push(m));
+          expect(provider.isConfigured('git@ghe.corp.example:acme/store.git'), apiUrl).to.equal(false);
+          expect(provider.isConfigured('git@ghe.corp.example:acme/store.git'), apiUrl).to.equal(false);
+          let thrown: unknown;
+          await provider.findPrByBranch('lane-x').catch((e) => {
+            thrown = e;
+          });
+          expect(thrown, apiUrl).to.be.instanceOf(Error);
+        } finally {
+          globalThis.fetch = realFetch;
+        }
+        expect(calls, apiUrl).to.have.lengthOf(0);
+        expect(providerWarnings, apiUrl).to.have.lengthOf(1);
+      }
+      // a github.com remote on the same misconfigured runner is unaffected
+      expect(GitHubClient.fromEnv('git@github.com:acme/shop.git')?.apiUrl).to.equal('https://api.github.com');
+    });
+
+    it('never lets an https server hand its token to a plaintext or non-web API', () => {
+      ['http://ghe.corp.example/api/v3', 'http://api.ghe.corp.example', 'ftp://ghe.corp.example/api/v3'].forEach(
+        (apiUrl) => {
+          process.env.GITHUB_API_URL = apiUrl;
+          const result = gitHubApiUrl('ghe.corp.example');
+          expect(result, apiUrl).to.not.have.property('url');
+          expect((result as { error: string }).error, apiUrl)
+            .to.contain(apiUrl)
+            .and.contain('is not https');
+          const warnings: string[] = [];
+          expect(
+            GitHubClient.fromEnv('git@ghe.corp.example:acme/store.git', (m) => warnings.push(m)),
+            apiUrl
+          ).to.equal(undefined);
+          expect(warnings, apiUrl).to.have.lengthOf(1);
+        }
+      );
+    });
+
+    it('lets an http server use an http or https API on its host, but no other protocol', () => {
+      process.env.GITHUB_SERVER_URL = 'http://ghe.corp.example';
+      process.env.GITHUB_API_URL = 'http://ghe.corp.example/api/v3';
+      expect(gitHubApiUrl('ghe.corp.example')).to.deep.equal({ url: 'http://ghe.corp.example/api/v3' });
+      process.env.GITHUB_API_URL = 'https://ghe.corp.example/api/v3';
+      expect(gitHubApiUrl('ghe.corp.example')).to.deep.equal({ url: 'https://ghe.corp.example/api/v3' });
+      process.env.GITHUB_API_URL = 'ftp://ghe.corp.example/api/v3';
+      expect(gitHubApiUrl('ghe.corp.example')).to.not.have.property('url');
+      // a non-web server URL derives no API at all
+      delete process.env.GITHUB_API_URL;
+      process.env.GITHUB_SERVER_URL = 'ftp://ghe.corp.example';
+      expect(gitHubApiUrl('ghe.corp.example')).to.not.have.property('url');
+    });
+
+    it('refuses a GITHUB_API_URL with a query or fragment, which would swallow the request path', () => {
+      ['https://ghe.corp.example/api/v3?x=1', 'https://ghe.corp.example/api/v3#frag'].forEach((apiUrl) => {
+        process.env.GITHUB_API_URL = apiUrl;
+        const result = gitHubApiUrl('ghe.corp.example');
+        expect(result, apiUrl).to.not.have.property('url');
+        expect((result as { error: string }).error, apiUrl)
+          .to.contain(apiUrl)
+          .and.contain('query or fragment');
+        expect(GitHubClient.fromEnv('git@ghe.corp.example:acme/store.git'), apiUrl).to.equal(undefined);
+      });
+    });
+
+    it('one provider reused for an enterprise origin and then a github.com origin talks to each one', async () => {
+      const realFetch = globalThis.fetch;
+      const { calls, fetchImpl } = recordingFetch();
+      globalThis.fetch = fetchImpl;
+      try {
+        const provider = new GitHubHostProvider();
+        // a PR call carries no remote: it follows the remote last selected
+        expect(provider.matchesRemote('git@ghe.corp.example:acme/store.git')).to.equal(true);
+        expect(provider.isConfigured('git@ghe.corp.example:acme/store.git')).to.equal(true);
+        await provider.findPrByBranch('lane-x');
+        expect(provider.isConfigured('git@github.com:acme/shop.git')).to.equal(true);
+        await provider.findPrByBranch('lane-x');
+      } finally {
+        globalThis.fetch = realFetch;
+      }
+      expect(calls.map((c) => c.url)).to.deep.equal([
+        `${GHES_API}/repos/acme/store/pulls?state=open&head=acme%3Alane-x`,
+        'https://api.github.com/repos/acme/shop/pulls?state=open&head=acme%3Alane-x',
+      ]);
+    });
+
+    it('drops a trailing slash from GITHUB_API_URL', () => {
+      process.env.GITHUB_API_URL = `${GHES_API}/`;
+      expect(gitHubApiUrl()).to.deep.equal({ url: GHES_API });
+    });
+
+    it('follows pagination on the GHES API, and refuses a next link that leaves it', async () => {
+      const calls: Array<{ url: string; init: any }> = [];
+      const fetchImpl = (async (url: any, init: any) => {
+        calls.push({ url: String(url), init });
+        const page2 = String(url).includes('page=2');
+        return new Response(JSON.stringify([{ id: page2 ? 2 : 1, body: 'unrelated' }]), {
+          status: 200,
+          headers: {
+            'content-type': 'application/json',
+            link: page2
+              ? '<https://api.github.com/repos/acme/store/issues/7/comments?page=3>; rel="next"'
+              : `<${GHES_API}/repos/acme/store/issues/7/comments?per_page=100&page=2>; rel="next"`,
+          },
+        });
+      }) as typeof fetch;
+      const client = new GitHubClient({ token: 'tok', repo: 'acme/store', apiUrl: GHES_API, fetchImpl });
+      await client.upsertComment(7, '<!-- marker -->', 'cleared', { createIfAbsent: false });
+      expect(calls.map((c) => c.url)).to.deep.equal([
+        `${GHES_API}/repos/acme/store/issues/7/comments?per_page=100`,
+        `${GHES_API}/repos/acme/store/issues/7/comments?per_page=100&page=2`,
+      ]);
+    });
+  });
+});

package/sync/github-client.ts

@@ -1,21 +1,79 @@
 import type { GitHostProvider, PrInfo } from './git-host-provider';
 
+const GITHUB_DOT_COM = 'github.com';
+const GITHUB_DOT_COM_API = 'https://api.github.com';
+const WEB_PROTOCOLS = ['http:', 'https:'];
+
+/** The GitHub instance `GITHUB_SERVER_URL` names, or undefined when it is unset or malformed. */
+function gitHubServerUrl(): URL | undefined {
+  try {
+    if (process.env.GITHUB_SERVER_URL) return new URL(process.env.GITHUB_SERVER_URL);
+  } catch {
+    // a malformed value names no instance
+  }
+  return undefined;
+}
+
 /**
- * The `owner/repo` out of a github.com remote URL, anchored to the URL authority. `:digits` is a port
- * only under a scheme; in the scp-like form (`git@github.com:12345/repo`) the colon starts the PATH
- * and an all-digits owner is a legal GitHub username.
+ * The host of the GitHub instance this run belongs to: the one `GITHUB_SERVER_URL` names (Actions sets
+ * it on every runner — `https://github.com`, or the GitHub Enterprise Server URL), else github.com.
  */
-export function parseGitHubRepo(remoteUrl: string): string | undefined {
-  const url = remoteUrl.trim();
-  const hasScheme = /^[a-z+]+:\/\//i.test(url);
-  const match = hasScheme
-    ? url.match(/(?:\/\/|@)github\.com(?::\d+)?\/([^/]+\/[^/]+?)(?:\.git)?$/i)
-    : url.match(/(?:^|@)github\.com[:/]([^/]+\/[^/]+?)(?:\.git)?$/i);
-  return match?.[1];
+export function gitHubServerHost(): string {
+  return gitHubServerUrl()?.hostname.toLowerCase() || GITHUB_DOT_COM;
+}
+
+/** The hosts whose remotes are GitHub's: github.com, plus a GitHub Enterprise Server host. */
+function gitHubHosts(): string[] {
+  const serverHost = gitHubServerHost();
+  return serverHost === GITHUB_DOT_COM ? [GITHUB_DOT_COM] : [GITHUB_DOT_COM, serverHost];
+}
+
+/** A resolved REST API base, or why the environment's API cannot be trusted with the repository's token. */
+export type GitHubApiUrl = { url: string } | { error: string };
+
+/**
+ * The REST API base for a repository on `host` (the `GITHUB_SERVER_URL` instance's host when omitted).
+ * Every request to it carries that instance's token, so:
+ * - github.com (and any host that is not the enterprise one) is always `https://api.github.com`.
+ * - the enterprise host takes `GITHUB_API_URL` only when it lives on that host or on `api.<host>`
+ *   (GHE.com data residency: `https://<sub>.ghe.com` serves its API at `https://api.<sub>.ghe.com`);
+ *   unset, it is the GHES convention `<GITHUB_SERVER_URL origin>/api/v3`. An https server's API must be
+ *   https too, so the token never travels in plaintext. Any other API is refused — never replaced by
+ *   api.github.com, which must not receive an enterprise token.
+ */
+export function gitHubApiUrl(host?: string): GitHubApiUrl {
+  const serverUrl = gitHubServerUrl();
+  const serverHost = gitHubServerHost();
+  if (!serverUrl || serverHost === GITHUB_DOT_COM || (host && host.toLowerCase() !== serverHost)) {
+    return { url: GITHUB_DOT_COM_API };
+  }
+  const refuse = (reason: string): GitHubApiUrl => ({
+    error: `${reason} — refusing to send the token of the GITHUB_SERVER_URL instance "${process.env.GITHUB_SERVER_URL}" to it`,
+  });
+  if (!WEB_PROTOCOLS.includes(serverUrl.protocol)) return refuse(`GITHUB_SERVER_URL is not an http(s) URL`);
+  const apiUrl = process.env.GITHUB_API_URL;
+  if (!apiUrl) return { url: `${serverUrl.origin}/api/v3` };
+  let api: URL | undefined;
+  try {
+    api = new URL(apiUrl);
+  } catch {
+    // a malformed value is refused below like any other foreign API
+  }
+  if (!api || ![serverHost, `api.${serverHost}`].includes(api.hostname.toLowerCase())) {
+    return refuse(`GITHUB_API_URL "${apiUrl}" is not on ${serverHost} or api.${serverHost}`);
+  }
+  // the token travels at least as securely as the server is reached: never in plaintext from an https server
+  const protocols = serverUrl.protocol === 'https:' ? ['https:'] : WEB_PROTOCOLS;
+  if (!protocols.includes(api.protocol)) {
+    return refuse(`GITHUB_API_URL "${apiUrl}" is not ${protocols.map((p) => p.slice(0, -1)).join(' or ')}`);
+  }
+  // the base is a path prefix: `/repos/...` appended after a query or fragment would never reach the API
+  if (api.search || api.hash) return refuse(`GITHUB_API_URL "${apiUrl}" carries a query or fragment`);
+  return { url: apiUrl.replace(/\/+$/, '') };
 }
 
 /** The host a git remote URL points at, lower-cased, or undefined when the URL has no authority. */
-function remoteHost(remoteUrl: string): string | undefined {
+export function remoteHost(remoteUrl: string): string | undefined {
   return remoteUrl
     .trim()
     .match(/^(?:[a-z+]+:\/\/)?(?:[^@/]+@)?([^:/]+)/i)?.[1]
@@ -23,27 +81,44 @@ function remoteHost(remoteUrl: string): string | undefined {
 }
 
 /**
- * Does this remote point at GitHub? A host test only — an unparseable github.com remote is still
- * GitHub's to claim. Host equality, not substring: `github.com` can be a path segment on another host.
+ * The `owner/repo` out of a GitHub remote URL, anchored to the URL authority. `:digits` is a port
+ * only under a scheme; in the scp-like form (`git@github.com:12345/repo`) the colon starts the PATH
+ * and an all-digits owner is a legal GitHub username.
  */
-export function isGitHubRemote(remoteUrl: string): boolean {
-  return remoteHost(remoteUrl) === 'github.com';
+export function parseGitHubRepo(remoteUrl: string): string | undefined {
+  const url = remoteUrl.trim();
+  const host = remoteHost(url);
+  if (!host || !gitHubHosts().includes(host)) return undefined;
+  const hostPattern = host.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const hasScheme = /^[a-z+]+:\/\//i.test(url);
+  const match = hasScheme
+    ? url.match(new RegExp(`(?:\\/\\/|@)${hostPattern}(?::\\d+)?\\/([^/]+\\/[^/]+?)(?:\\.git)?$`, 'i'))
+    : url.match(new RegExp(`(?:^|@)${hostPattern}[:/]([^/]+\\/[^/]+?)(?:\\.git)?$`, 'i'));
+  return match?.[1];
 }
 
-const API = 'https://api.github.com';
+/**
+ * Does this remote point at GitHub — github.com, or the GitHub Enterprise Server host `GITHUB_SERVER_URL`
+ * names? A host test only — an unparseable GitHub remote is still GitHub's to claim. Host equality, not
+ * substring: `github.com` can be a path segment on another host.
+ */
+export function isGitHubRemote(remoteUrl: string): boolean {
+  const host = remoteHost(remoteUrl);
+  return Boolean(host && gitHubHosts().includes(host));
+}
 
 /**
  * The `rel="next"` URL out of a GitHub `Link` response header, or undefined on the last page. The
  * header is response data, and `requestRaw` attaches the bearer token to whatever URL it is handed —
  * so a next link whose origin is not the API's reads as "last page", never as a request target.
  */
-function nextPageUrl(linkHeader: string | null): string | undefined {
+function nextPageUrl(linkHeader: string | null, apiUrl: string): string | undefined {
   if (!linkHeader) return undefined;
   const next = linkHeader.split(',').find((part) => part.includes('rel="next"'));
   const url = next?.match(/<([^>]+)>/)?.[1];
   if (!url) return undefined;
   try {
-    return new URL(url).origin === API ? url : undefined;
+    return new URL(url).origin === new URL(apiUrl).origin ? url : undefined;
   } catch {
     return undefined;
   }
@@ -60,11 +135,17 @@ export class GitHubClient implements GitHostProvider {
   private token: string;
   /** `owner/repo`. Readable so callers (and tests) can see *which* repository a resolved client speaks to. */
   readonly repo: string;
+  /**
+   * The REST API base, e.g. `https://api.github.com` (the default) or a GitHub Enterprise Server's
+   * `https://<host>/api/v3`; `fromEnv` resolves it for the remote's host.
+   */
+  readonly apiUrl: string;
   private fetchImpl: typeof fetch;
 
-  constructor(opts: { token: string; repo: string; fetchImpl?: typeof fetch }) {
+  constructor(opts: { token: string; repo: string; apiUrl?: string; fetchImpl?: typeof fetch }) {
     this.token = opts.token;
     this.repo = opts.repo;
+    this.apiUrl = opts.apiUrl ?? GITHUB_DOT_COM_API;
     this.fetchImpl = opts.fetchImpl ?? fetch;
   }
 
@@ -90,7 +171,13 @@ export class GitHubClient implements GitHostProvider {
           `"${repoFromRemote}" — using "${repoFromRemote}", the repository this run pushes its branches to.`
       );
     }
-    return new GitHubClient({ token, repo });
+    // Without a remote, the GITHUB_REPOSITORY repository lives on the GITHUB_SERVER_URL instance.
+    const api = gitHubApiUrl(gitRemoteUrl ? remoteHost(gitRemoteUrl) : undefined);
+    if ('error' in api) {
+      warn(`bit ci sync: ${api.error}. The GitHub provider is not configured.`);
+      return undefined;
+    }
+    return new GitHubClient({ token, repo, apiUrl: api.url });
   }
 
   matchesRemote(remoteUrl: string): boolean {
@@ -104,7 +191,7 @@ export class GitHubClient implements GitHostProvider {
 
   /** `pathOrUrl` may be a path relative to this repo, or an absolute URL (a `Link` header's next page). */
   private async requestRaw(method: string, pathOrUrl: string, body?: unknown): Promise<Response> {
-    const url = /^https?:\/\//i.test(pathOrUrl) ? pathOrUrl : `${API}/repos/${this.repo}${pathOrUrl}`;
+    const url = /^https?:\/\//i.test(pathOrUrl) ? pathOrUrl : `${this.apiUrl}/repos/${this.repo}${pathOrUrl}`;
     const res = await this.fetchImpl(url, {
       method,
       headers: {
@@ -177,7 +264,7 @@ export class GitHubClient implements GitHostProvider {
       const body = (await res.json()) as any[];
       const match = body.find((c: any) => (c.body ?? '').includes(marker));
       if (match) return { id: match.id };
-      next = nextPageUrl(res.headers.get('link'));
+      next = nextPageUrl(res.headers.get('link'), this.apiUrl);
     }
     return next ? 'unknown' : 'absent';
   }
@@ -217,17 +304,23 @@ export class GitHubClient implements GitHostProvider {
 
 /**
  * The registrable GitHub provider: resolves its `GitHubClient` from the environment lazily, since
- * registration happens at aspect load, before credentials are known. A resolved client is memoized;
- * an unresolved one is retried so a later call that does carry the remote URL can still succeed.
+ * registration happens at aspect load, before credentials are known. A resolved client is memoized per
+ * remote; an unresolved one is retried so a later call that does carry the remote URL can still succeed.
  */
 export class GitHubHostProvider implements GitHostProvider {
   readonly name = 'github';
 
   private client: GitHubClient | undefined;
 
+  /** The remote `client` was resolved for. */
+  private clientRemote: string | undefined;
+
   /** The last `origin` URL seen, so a PR method can still recover `owner/repo` from it. */
   private remoteHint: string | undefined;
 
+  /** Warnings already emitted: an unresolved client is retried on every call, its warning is not. */
+  private warned = new Set<string>();
+
   constructor(private onWarning: WarnFn = noopWarn) {}
 
   matchesRemote(remoteUrl: string): boolean {
@@ -279,16 +372,27 @@ export class GitHubHostProvider implements GitHostProvider {
   }
 
   private resolveClient(remoteUrl?: string): GitHubClient | undefined {
-    if (!this.client) this.client = GitHubClient.fromEnv(remoteUrl ?? this.remoteHint, this.onWarning);
+    const remote = remoteUrl ?? this.remoteHint;
+    // The client pins the remote's repository and API, so another remote needs its own client.
+    if (!this.client || this.clientRemote !== remote) {
+      this.client = GitHubClient.fromEnv(remote, this.warnOnce);
+      this.clientRemote = remote;
+    }
     return this.client;
   }
 
+  private warnOnce: WarnFn = (message) => {
+    if (this.warned.has(message)) return;
+    this.warned.add(message);
+    this.onWarning(message);
+  };
+
   private requireClient(): GitHubClient {
     const client = this.resolveClient();
     if (!client) {
       throw new Error(
         `the github host provider is not configured: set BIT_GITHUB_TOKEN (or GITHUB_TOKEN), and either ` +
-          `GITHUB_REPOSITORY or a github.com "origin" remote`
+          `GITHUB_REPOSITORY or a GitHub "origin" remote (github.com, or the GITHUB_SERVER_URL host)`
       );
     }
     return client;