[fleizean]

Summary

NuGet and pub.dev packages keep the GitHub repository they already had, and find it in more places: the nuspec, a GitHub project URL, and the pubspec through the pub.dev API.

Why

On production, 14 of 325 cached packages have no GitHub repository, so the package page shows no "View on GitHub" and their release notes are never looked for on GitHub. Several of them clearly have one:

Package	Registry has	Stored
Newtonsoft.Json	nuspec <repository> JamesNK/Newtonsoft.Json	empty, although its notes source is "GitHub"
System.Text.Json	nuspec <repository> dotnet/dotnet	empty
uuid (NuGet)	nuspec <repository> git://github.com/Taiizor/UUID	empty
Bogus	project URL github.com/bchavez/Bogus	empty
Duende.IdentityServer (+ .AspNetIdentity)	project URL github.com/duendesoftware/products	empty
hive (pub.dev)	pubspec homepage github.com/hivedb/hive/tree/master/hive	empty

Changes

• PackageCacheService.SaveFreshMetadataToCache: a metadata refresh no longer replaces a stored repository with null. NuGet metadata never had one, so a repository found while scraping was wiped on every refresh.
• NugetService.GetPackageMetadataAsync: reads <repository url> from the latest version's nuspec in the flat container (one small CDN request, not nuget.org's rate-limited pages), falling back to a GitHub project URL. URLs are normalized by GitHubUrls.FromRepositoryField (git://, .git).
• PubDevService.GetPackageExtraInfoAsync: when the page links no repository, the pubspec repository, then homepage, is taken from https://pub.dev/api/packages/{id} if it is on GitHub. pub.dev shows no link at all for a homepage-only pubspec.
• LiveRegistrySmokeTests: passes the HTTP client factory NugetService now takes.

Notes for reviewers

• The rows already wiped are filled again by their next metadata refresh. After deploy I will set the repositories above directly in the database (backup first) so they do not wait for a visit.
• Correctly empty and left as they are: beautifulsoup4 (not on GitHub), nestjs (an unrelated 0.0.1 package, not @nestjs/core), LINQPad.Reference, Plugin.Maui.Barkoder and EasyDotnet (no repository in their metadata).
• selenium (PyPI) names only selenium.dev; fix(pypi): find the repository in the README when project_urls has none #1 (repository from the README) covers it once deployed.

Checklist

• The pull request targets develop and is about one thing
• Commit messages follow Conventional Commits (feat(scope): ..., fix(scope): ...)
• CI is green (backend tests, frontend build and tests, dependency gate)
• Schema changes are EF Core migrations generated by the tool, not hand-edited
• A changed backend DTO has its TypeScript twin updated in src/frontend/src/app/core/models
• New dependencies are justified and their lock files are updated in the same commit
• No secrets, tokens or personal data in code, logs or this description
• Code comments are kept to a minimum; the reasoning lives in this description