GitHub Accelerator

Archive source packages: CI artifacts, offline builds and pinned versions

Branch, tag or commit — pick the right granularity and your builds stay reproducible.

2026-09-06 · Engineering

Archives and the codeload mechanism

The “Download ZIP” button on GitHub is served by codeload.github.com, which packages repository contents into a zip or tar.gz on the fly. There are three granularities:

Branch snapshot: https://github.com/owner/repo/archive/refs/heads/main.zip
Tag snapshot:    https://github.com/owner/repo/archive/refs/tags/v1.0.0.tar.gz
Commit snapshot: https://github.com/owner/repo/archive/.zip

Prefix the accelerated domain to get the accelerated link, e.g. https://ghclone.com/https://github.com/owner/repo/archive/refs/tags/v1.0.0.tar.gz.

Which snapshot to choose

  • Branch snapshot: always the latest commit on the branch — good for trying things out, but the same URL yields different content over time, so it is unsuitable for reproducible builds
  • Tag snapshot: points at a release; content is normally stable and fits most build and deploy scenarios
  • Commit snapshot: locked to a specific commit (content-addressed), the best choice when reproducibility matters most

Pinning and verifying in CI

When downloading archives in build scripts, pin the tag and verify the checksum:

curl -fL -o src.tar.gz "https://ghclone.com/https://github.com/owner/repo/archive/refs/tags/v1.0.0.tar.gz"
echo "expected-sha256  src.tar.gz" | sha256sum -c -
tar -xzf src.tar.gz

Obtain hashes from official channels (release notes, signature files or checksum manifests). Abort the build on mismatch so inconsistent sources never reach your artifacts.

Offline builds and internal mirrors

When internal build environments cannot reach the internet, download archives once on a connected machine and ship them with the build image or artifact repository. Builds then depend only on the local network for both speed and stability; upgrades follow the same download-verify-publish cycle.

FAQ

  • No .git directory inside the archive? Expected: snapshots do not include version-control metadata, so git describe and friends are unavailable. Inject version info at build time instead.
  • Submodules missing? Archives do not include submodule contents; download their snapshots separately.
  • Archive larger than expected? Some repositories ship large files; evaluate size from the actual download.

← Back to blog