From f1637f84b56c1875269a4240c160258e62cccacd Mon Sep 17 00:00:00 2001
From: Valentin Maerten <maerten.valentin@gmail.com>
Date: Sun, 23 Aug 2026 13:18:05 +0200
Subject: [PATCH] refactor(remote): extract the fetch error translation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The same policy — keep TaskfileNotSecureError, make everything else a
generic download failure — was spelled out at each of the three call
sites, where copies of a security rule tend to drift apart.
---
 taskfile/node_http.go |  5 +----
 taskfile/taskfile.go  | 19 +++++++++++--------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/taskfile/node_http.go b/taskfile/node_http.go
index ce79fadb..cfcc9614 100644
--- a/taskfile/node_http.go
+++ b/taskfile/node_http.go
@@ -140,10 +140,7 @@ func (node *HTTPNode) ReadContext(ctx context.Context) ([]byte, error) {
 		if ctx.Err() != nil {
 			return nil, err
 		}
-		if notSecure, ok := errors.AsType[*errors.TaskfileNotSecureError](err); ok {
-			return nil, notSecure
-		}
-		return nil, errors.TaskfileFetchFailedError{URI: node.Location()}
+		return nil, taskfileFetchError(err, node.Location())
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusOK {
diff --git a/taskfile/taskfile.go b/taskfile/taskfile.go
index 5a8555d7..54d08945 100644
--- a/taskfile/taskfile.go
+++ b/taskfile/taskfile.go
@@ -51,10 +51,7 @@ func RemoteExists(ctx context.Context, u url.URL, client *http.Client) (*url.URL
 		if ctx.Err() != nil {
 			return nil, fmt.Errorf("checking remote file: %w", ctx.Err())
 		}
-		if notSecure, ok := errors.AsType[*errors.TaskfileNotSecureError](err); ok {
-			return nil, notSecure
-		}
-		return nil, errors.TaskfileFetchFailedError{URI: u.Redacted()}
+		return nil, taskfileFetchError(err, u.Redacted())
 	}
 	defer resp.Body.Close()
 
@@ -83,10 +80,7 @@ func RemoteExists(ctx context.Context, u url.URL, client *http.Client) (*url.URL
 		// Try the alternative URL
 		resp, err = client.Do(req)
 		if err != nil {
-			if notSecure, ok := errors.AsType[*errors.TaskfileNotSecureError](err); ok {
-				return nil, notSecure
-			}
-			return nil, errors.TaskfileFetchFailedError{URI: u.Redacted()}
+			return nil, taskfileFetchError(err, u.Redacted())
 		}
 		defer resp.Body.Close()
 
@@ -98,3 +92,12 @@ func RemoteExists(ctx context.Context, u url.URL, client *http.Client) (*url.URL
 
 	return nil, errors.TaskfileNotFoundError{URI: u.Redacted(), Walk: false}
 }
+
+// taskfileFetchError preserves redirect-policy errors wrapped by http.Client.
+// Other transport errors remain generic download failures.
+func taskfileFetchError(err error, uri string) error {
+	if notSecure, ok := errors.AsType[*errors.TaskfileNotSecureError](err); ok {
+		return notSecure
+	}
+	return errors.TaskfileFetchFailedError{URI: uri}
+}