ContributorMural

Kept equal to shard.yml by a spec, and to the git tag by the release workflow, which refuses to publish a tag that disagrees with it. Both guards exist because this string is what a run reports about itself — a version that lies is worse than no version at all.

Whether a name may stand as one segment of an API path.

GitHub logins are letters, digits and hyphens; repository names add dots and underscores. Anything outside that set either has no business in a name or changes what the path means once it is pasted into one: ? turns the rest of the route into a query string, # truncates it, and .. walks up out of it — all of which reach a real endpoint and come back as a puzzling error about GitHub rather than about the config that caused it.

Retry-After in the delta-seconds form, never longer than cap. The HTTP-date form is legal but rare in these APIs, and a clock-skewed runner would read it as a wait of hours; ignoring it falls back to the caller's own backoff, which is always bounded. Shared because both the avatar fetcher and the API client have to answer the same question.