[fleizean]

Summary

pub.dev release notes are read from each version's own changelog page, and a GitHub repository is only used (for notes, the repository link and the trust lookup) when the API confirms it is public.

Why

• virusis_api_client_ng on pub.dev has a note for every version, but pkgdiff stored all of them empty. /packages/<name>/changelog renders only the CHANGELOG of the latest upload; older versions' notes live on /packages/<name>/versions/<version>/changelog.
• The same package declares a private GitHub repository, and its sibling virusis_api_client declares an organization URL (https://github.com/virusis-company/). The GitHub token may be able to read private repositories, so their release notes and changelog files could be scraped and published. A private repository can also become public later, so the decision cannot be made once and stored for good.

Changes

• PubDevService reads /versions/{version}/changelog first and falls back to the package changelog page. The heading must name the exact version (1.2.0 no longer matches 1.2.0+1 or 1.2.0-dev).
• GitHubScraperService checks GET /repos/{owner}/{repo} before reading releases, changelog files, release files or milestones. Only "private": false counts as public; 404 or a URL without owner/repo counts as not usable. The answer is cached for 6 hours. When the check fails and a token is configured, nothing is read for now. Without a token, nothing private is reachable, so no check is made.
• PackageCacheService stores a GitHub URL only when it is not known to be private or missing. This applies to new packages, to every metadata refresh (so a repository that turns public comes back) and to repositories found while scraping (PackageAnalysisService). With no stored URL, the package page hides the repository link and "View on GitHub", and the trust lookup falls back to the project URL.
• Updated the two pub.dev tests that pin the requested URLs.

Notes for reviewers

• One extra GitHub API call per repository every 6 hours, from the shared budget.
• Registries that do not publish notes (npm, PyPI) need a repository URL for a complete cache entry. A package whose repository is private is therefore refetched from the registry on each visit, the same as a package without a repository today.
• Existing rows change only on their next metadata refresh. The stored virusis_api_client_ng rows are corrected with a separate one-off SQL update.
• Not built or tested locally; CI is the check.

Checklist

• The pull request targets develop and is about one thing
• Commit messages follow Conventional Commits (feat(scope): ..., fix(scope): ...)
• CI is green (backend tests, frontend build and tests, dependency gate)
• Schema changes are EF Core migrations generated by the tool, not hand-edited
• A changed backend DTO has its TypeScript twin updated in src/frontend/src/app/core/models
• New dependencies are justified and their lock files are updated in the same commit
• No secrets, tokens or personal data in code, logs or this description
• Code comments are kept to a minimum; the reasoning lives in this description