Support GitHub Enterprise hosts in PublicGitHubRepositorySource (#214)

## Description

Fixes #185. `PublicGitHubRepositorySource` accepted any HTTPS URL via
the host-agnostic `parseGitHubUrlAndRef()` parser, but internally
`_parseGitHubUrl()` only matched `github.com` and `_buildDownloadUrl()`
always constructed `codeload.github.com` URLs. GHE URLs were silently
accepted at parse time but failed at download time.

This PR adds real GHE support:

- **Host-agnostic URL parsing**: Renamed `_parseGitHubUrl()` →
`_parseRepoUrl()` with a generic regex that returns `{ host, owner, repo
}`
- **Host-aware download URLs**: `github.com` continues to use
`codeload.github.com`; other hosts use the GHE REST API
(`https://<host>/api/v3/repos/<owner>/<repo>/zipball/<ref>`)
- **Auth token support**: New optional `token` property on
`IPublicGitHubRepositorySourceOptions`, sent as `Authorization: token
<value>` header
- **CLI integration**: `GITHUB_TOKEN` env var is read and passed to all
`PublicGitHubRepositorySource` instances

## How was this tested

- `rush build` — all 22 projects build successfully
- `cd api/spfx-template-api && heft test --clean` — 267 tests pass (14
new snapshots for GHE URL parsing, GHE download URLs, auth header, token
constructor tests)
- `cd apps/spfx-cli && heft test --clean` — 96 tests pass (5 new
snapshots for `GITHUB_TOKEN` passthrough tests)

## Type of change

- [x] New feature (non-breaking change that adds functionality)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: nick-pape

api/spfx-template-api/README.md

@@ -58,7 +58,7 @@ await writer.writeAsync(templateFs, '/path/to/output');
 
 ### `PublicGitHubRepositorySource`
 
-Fetches templates from a public GitHub repository. Pin a specific SPFx version with an optional branch/tag ref.
+Fetches templates from a GitHub repository (github.com or GitHub Enterprise). Pin a specific SPFx version with an optional branch/tag ref. An optional `token` enables access to GitHub Enterprise instances or private repositories on github.com.
 
 ```typescript
 import { Terminal, ConsoleTerminalProvider } from '@rushstack/terminal';
@@ -71,6 +71,13 @@ new PublicGitHubRepositorySource({ repoUrl: 'https://github.com/SharePoint/spfx'
 
 // Specific version
 new PublicGitHubRepositorySource({ repoUrl: 'https://github.com/SharePoint/spfx', branch: 'version/1.22', terminal });
+
+// GitHub Enterprise with authentication
+new PublicGitHubRepositorySource({
+  repoUrl: 'https://github.mycompany.com/org/spfx-templates',
+  terminal,
+  token: process.env.GITHUB_TOKEN
+});
 ```
 
 ### `LocalFileSystemRepositorySource`
@@ -139,7 +146,7 @@ The writer uses these helpers internally. You can also import them directly for
 | `SPFxTemplate` | Single template — exposes `name`, `category`, `spfxVersion`, and `renderAsync()` |
 | `ITemplateOutputEntry` | A single file entry (text or binary contents) |
 | `TemplateOutput` | In-memory file system implementation backed by a `Map`, returned by `renderAsync()` |
-| `PublicGitHubRepositorySource` | Loads templates from a public GitHub repo |
+| `PublicGitHubRepositorySource` | Loads templates from a GitHub repo (github.com or GHE, with optional auth token) |
 | `LocalFileSystemRepositorySource` | Loads templates from the local filesystem |
 | `BaseSPFxTemplateRepositorySource` | Base class for building custom template sources |
 | `SPFxRepositorySource` | Interface implemented by all source types |

api/spfx-template-api/etc/spfx-template-api.api.md

@@ -49,6 +49,7 @@ export interface IPublicGitHubRepositorySourceOptions {
     branch?: string;
     repoUrl: string;
     terminal: ITerminal;
+    token?: string;
 }
 
 // @public (undocumented)

api/spfx-template-api/src/repositories/PublicGitHubRepositorySource.ts

@@ -97,7 +97,8 @@ export async function _createTemplateFromFileMapAsync(
  */
 export interface IPublicGitHubRepositorySourceOptions {
   /**
-   * The GitHub repository URL (e.g., https://github.com/owner/repo).
+   * The GitHub repository URL (e.g., https://github.com/owner/repo or
+   * https://github.mycompany.com/org/repo for GitHub Enterprise).
    */
   repoUrl: string;
 
@@ -110,11 +111,29 @@ export interface IPublicGitHubRepositorySourceOptions {
    * The Terminal instance for logging.
    */
   terminal: ITerminal;
+
+  /**
+   * An optional GitHub personal access token for authenticating requests.
+   * Required for most GitHub Enterprise instances and for private repositories
+   * on github.com. When provided, it is sent as an `Authorization: token <value>` header.
+   */
+  token?: string;
 }
 
+// Matches https://<host>/<owner>/<repo>[.git] — HTTPS only, host-agnostic for GHE support.
+const REPO_URL_REGEX: RegExp = /^https:\/\/([^/]+)\/([^/]+)\/([^/]+?)(\.git)?$/;
+
 /**
  * @public
- * A repository that is hosted on a public GitHub repository.
+ * A template source backed by a GitHub repository (github.com or GitHub Enterprise).
+ *
+ * For `github.com` hosts the archive is fetched from `codeload.github.com`.
+ * For GitHub Enterprise (GHE) hosts the archive is fetched via the GHE REST API
+ * (`https://<host>/api/v3/repos/<owner>/<repo>/zipball/<ref>`).
+ *
+ * An optional personal access token can be supplied via
+ * {@link IPublicGitHubRepositorySourceOptions.token} for GHE instances or
+ * private repositories on github.com.
  *
  * SECURITY NOTE: This class intentionally fetches from mutable branch references
  * (not pinned commit SHAs) to enable template updates independent of CLI releases.
@@ -136,13 +155,15 @@ export class PublicGitHubRepositorySource extends BaseSPFxTemplateRepositorySour
   private readonly _repoUrl: string;
   private readonly _ref: string;
   private readonly _terminal: ITerminal;
+  private readonly _token: string | undefined;
 
   public constructor(options: IPublicGitHubRepositorySourceOptions) {
     super('github');
-    const { repoUrl, branch, terminal } = options;
+    const { repoUrl, branch, terminal, token } = options;
     this._repoUrl = repoUrl;
     this._ref = branch || 'version/latest';
     this._terminal = terminal;
+    this._token = token;
   }
 
   /**
@@ -160,23 +181,32 @@ export class PublicGitHubRepositorySource extends BaseSPFxTemplateRepositorySour
   }
 
   private _buildDownloadUrl(): string {
-    const { owner, repo } = this._parseGitHubUrl();
-    return `https://codeload.github.com/${owner}/${repo}/zip/${this._ref}`;
+    const { host, owner, repo } = this._parseRepoUrl();
+    if (host === 'github.com') {
+      return `https://codeload.github.com/${owner}/${repo}/zip/${this._ref}`;
+    }
+    // GitHub Enterprise: use the REST API archive endpoint
+    return `https://${host}/api/v3/repos/${owner}/${repo}/zipball/${this._ref}`;
   }
 
-  private _parseGitHubUrl(): { owner: string; repo: string } {
-    // Parse URLs like: https://github.com/sharepoint/spfx or https://github.com/sharepoint/spfx.git
-    const match: RegExpMatchArray | null = this._repoUrl.match(/github\.com\/([^\/]+)\/([^\/]+?)(\.git)?$/);
+  private _parseRepoUrl(): { host: string; owner: string; repo: string } {
+    // Parse URLs like: https://github.com/owner/repo, https://github.mycompany.com/org/repo,
+    // or the same with a .git suffix. Only HTTPS is accepted.
+    const match: RegExpMatchArray | null = this._repoUrl.match(REPO_URL_REGEX);
     if (!match) {
       throw new Error(`Invalid GitHub repository URL: ${this._repoUrl}`);
     }
 
-    const [, owner, repo] = match as [string, string, string];
-    return { owner, repo };
+    const [, host, owner, repo] = match as [string, string, string, string, string?];
+    return { host: host.toLowerCase(), owner, repo };
   }
 
   private async _downloadAndExtractRepositoryAsync(downloadUrl: string): Promise<Map<string, Buffer>> {
-    const response: Response = await fetch(downloadUrl);
+    const fetchInit: RequestInit = {};
+    if (this._token) {
+      fetchInit.headers = { Authorization: `token ${this._token}` };
+    }
+    const response: Response = await fetch(downloadUrl, fetchInit);
     if (!response.ok) {
       throw new Error(`Failed to download repository: ${response.status} ${response.statusText}`);
     }