Serve release downloads from R2 instead of GitHub for IPv6 hosts

[admdly]

Summary

github.com and api.github.com have no AAAA record, so IPv6-only hosts (no NAT64) can check /versions/v1/latest for an update but can never download it. FOSSBilling/FOSSBilling now mirrors every release archive to R2 under download.fossbilling.org, which is IPv6-reachable.

• getReleases() now looks up each release's R2 mirror and prefers its download_url and digest over the GitHub asset.
• digest is read from R2 custom metadata set by CI from the exact uploaded file, rather than recomputed here.
• Releases without a mirror (published before this existed, or on a failed R2 lookup) fall back to the GitHub asset, unchanged from current behavior.
• stats/v1 skips the R2 lookup entirely since it never reads download_url/digest.
• The preview branch endpoint already returns a download.fossbilling.org URL and needed no change.

Fixes FOSSBilling/FOSSBilling#2479.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	api	09b394f	Commit Preview URL Branch Preview URL	Aug 30 2026, 07:15 PM

[cubic-dev-ai]

All reported issues were addressed across 4 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 1 file (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[admdly]

Addressed cubic's findings in 7edd9ff:

• stats/v1 cache-poisoning (P1) — real bug, fixed. getReleases writes to the same RELEASE_CACHE_KEY the versions service reads, so a stats-triggered refresh with no R2 bucket could overwrite that shared cache with GitHub-only URLs for up to 24h. downloadBucket is now a required param, and stats/v1 threads c.env.DOWNLOAD_BUCKET through instead of skipping the lookup.
• Test assertion mismatch (P2) — fixed; the digest assertion was out of sync with the mock value from the previous review round's manual edit.
• Stale README (P3) — updated: download_url/digest now documented as R2-preferred with a GitHub fallback, DOWNLOAD_BUCKET listed as a required binding.

Two items I'm not changing:

• Update.php allowlist (P1) — already handled client-side. FOSSBilling/FOSSBilling's Update.php already has https://download.fossbilling.org/releases/ in allowedDownloadPrefixes (confirmed on main), so this isn't blocking.
• getReleaseR2Object always returning null for now (P1) — expected, not a bug in this repo. The matching "Upload Release Archive to R2" step in FOSSBilling/FOSSBilling's create-release.yml is a separate change landing in that repo; until it ships, releases just fall back to the GitHub asset URL as before, which is the intended degrade-safe behavior.

[cubic-dev-ai]

All reported issues were addressed across 4 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[admdly]

Addressed both findings from the latest round in 09b394f:

• README example inconsistency (P3) — fixed. Swapped the GET / example from 0.5.0 to 0.6.0 so it's consistent with the fallback note (a pre-mirroring release wouldn't actually show an R2 URL).
• Missing regression test for the cache-poisoning fix (P2) — added test/services/stats/v1/index.test.ts's new "Shared release cache" test: it seeds DOWNLOAD_BUCKET, forces /stats/v1/data through a fresh fetch, and asserts the shared gh-fossbilling-releases cache entry it writes carries the R2 download_url/digest. Verified it actually catches the regression by reverting the fix locally and confirming the test fails, then restored the fix.

[cubic-dev-ai]

0 issues found across 2 files (changes from recent commits).

<sub>Requires human review: Auto-approval blocked by 1 unresolved issue from previous reviews.

Re-trigger cubic</sub>