--attach stack 4/8: Upload an asset to GitHub - #14180

Part of the pull request stack tracked in #14186.

Description

This is the fourth layer of the stack. It adds the uploader that posts a file to GitHub's user attachments endpoint and returns the asset URL, plus a small helper that builds the upload host for a given GitHub host. Nothing here is reachable from a command yet.

Three refusals happen before any request is made, in this order:

1. GitHub Enterprise Server, because the endpoint does not exist there.
2. A kind of credential the endpoint will not accept.
3. A role on the repository below write.

The host is checked first on purpose. On an enterprise server no token and no permission would ever make an upload work, so any other order would name a fault the user cannot fix.

How did you test this change?

The whole stack was built and files were uploaded to a private test repository from two accounts. One had write access and every upload succeeded. One had read only access, and every command refused before any request left the machine, which was confirmed by counting the requests rather than by trusting the message.

The upload host was also checked against a GitHub Enterprise Cloud tenant host, where it derives from the target host correctly.

Key points

The uploader never stores the token. It is told what kind of credential is active and nothing more, and the credential actually sent is chosen by the transport from the request host, like all gh requests.

The upload host is derived from the target host, so a tenant with data residency uploads to its own host rather than to github.com.

Refusing early matters more here than in most places, because an upload cannot be undone.

Notes for reviewers

Read the three refusals first, and the reason the host is checked before the rest.

A note in the code explains why the request is built by hand rather than through the usual REST client. The endpoint requires both a content type and a content length on every request, and the shared client sets neither.

Authorship and follow-up

Who wrote this:

• A human wrote it.
• An agent wrote it under close human direction.
• An agent wrote it independently, and no human has guided the implementation beyond the initial prompt.

Who answers review comments:

• @BagToad will read and reply directly. Name the account.
• An agent will draft replies and @BagToad will read them before they are posted.
• Nobody has explicitly committed to replying.