fix: harden upload resilience and contracts

lib/github.ts

@@ -19,17 +19,33 @@ function getOctokit(): Octokit {
 }
 
 function parseRepoUrl(): { owner: string; repo: string } {
-  const url = process.env.GIT_REPO_URL
+  const url = process.env.GIT_REPO_URL?.trim()
   if (!url) throw new Error('GIT_REPO_URL non configure')
 
-  const httpsMatch = url.match(/github\.com\/([^/]+)\/([^/.]+)/)
-  const sshMatch = url.match(/github\.com:([^/]+)\/([^/.]+)/)
-  const shortMatch = url.match(/^([^/]+)\/([^/]+)$/)
+  const cleanRepoName = (repo: string) => repo.replace(/\/+$/, '').replace(/\.git$/, '')
+  const shortMatch = url.match(/^([^/\s:]+)\/([^/\s]+)$/)
+  if (shortMatch) {
+    return { owner: shortMatch[1], repo: cleanRepoName(shortMatch[2]) }
+  }
 
-  const match = httpsMatch || sshMatch || shortMatch
-  if (!match) throw new Error(`Format GIT_REPO_URL invalide: "${url}"`)
+  const sshMatch = url.match(/github\.com:([^/\s]+)\/(.+)$/)
+  if (sshMatch) {
+    return { owner: sshMatch[1], repo: cleanRepoName(sshMatch[2]) }
+  }
 
-  return { owner: match[1], repo: match[2] }
+  if (URL.canParse(url)) {
+    const parsed = new URL(url)
+    const pathParts = parsed.pathname
+      .replace(/^\/+|\/+$/g, '')
+      .split('/')
+      .filter(Boolean)
+
+    if (parsed.hostname === 'github.com' && pathParts.length >= 2) {
+      return { owner: pathParts[0], repo: cleanRepoName(pathParts[1]) }
+    }
+  }
+
+  throw new Error(`Format GIT_REPO_URL invalide: "${url}"`)
 }
 
 function isLfsFile(filePath: string): boolean {
@@ -73,12 +89,17 @@ interface LfsObject {
   contentBase64: string
 }
 
+interface LfsBatchAction {
+  href: string
+  header?: Record<string, string>
+}
+
 interface LfsBatchObject {
   oid: string
   size: number
   actions?: {
-    upload?: { href: string; header?: Record<string, string> }
-    verify?: { href: string; header?: Record<string, string> }
+    upload?: LfsBatchAction
+    verify?: LfsBatchAction
   }
   error?: { code: number; message: string }
 }
@@ -87,7 +108,7 @@ function isStringRecord(value: unknown): value is Record<string, string> {
   return isRecord(value) && Object.values(value).every((entry) => typeof entry === 'string')
 }
 
-function parseLfsAction(value: unknown) {
+function parseLfsAction(value: unknown): LfsBatchAction | undefined {
   if (!isRecord(value) || typeof value.href !== 'string') return undefined
   return {
     href: value.href,