[feature] Support private repositories for `extends` in `.moon/tasks[/**/*].{pkl,yml}` files

[gruffyn]

Is your feature request related to a problem? Please describe.

Currently using the task extends syntax appears to require the files to be hosted publicly. When bootstrapping various repos for our engineers, we need to copy a number of common tasks into each repository. Unfortunately, these tasks contain some internal business logic and will need to be updated periodically.

Describe the solution you'd like

Using tools like github or gitlab as a base, it should be sufficient to allow us to pass url parameters containing environment variables. For example:

extends: 'https://raw.githubusercontent.com/organization/repository/master/.moon/tasks.yml?token=${GITHUB_TOKEN}'

I have tested this locally with a hardcoded token, but currently it fails on validation as the url string does not end with .yml.

Describe alternatives you've considered

Additional context

[gruffyn]

Error returned when trying to use a github token:

[milesj]

Should be fixed in in v1.41.3

[gruffyn]

@milesj The error message has changed slightly but appears to be failing in a similar spot.

Also, attempting it with a environment variable in the url doesn't appear to be getting substituted.

[gruffyn]

Example usage:
path: ./.moon/tasks/tag-hw.yml

$schema: 'https://moonrepo.dev/schemas/tasks.json'

extends: "https://raw.githubusercontent.com/gruffyn/moon-remote-extends/main/.moon/tasks/tag-helloworld.yml?token=$GITHUB_RAW_TOKEN"

.prototools:

terraform = "1.13.0"
datasubst = "0.7.0"
golangci-lint= "2.4.0"
moon = "1.41.3"

[plugins]
terraform = "https://raw.githubusercontent.com/theomessin/proto-toml-plugins/master/terraform.toml"
golangci-lint = "https://raw.githubusercontent.com/b4nst/proto-plugins/refs/heads/main/toml/golangci-lint.toml"
datasubst = "https://raw.githubusercontent.com/gruffyn/proto-plugins/main/datasubst.toml"

[milesj]

That error means that whatever is being downloaded is not in YAML. Perhaps GitHub is sending an HTML response.

Also, config files do not support env interpolation, so $GITHUB_RAW_TOKEN will not work.

[gruffyn]

Looking at the content headers on curl, it's being returned as text/plain; charset=utf-8.

HTTP/2 200 
cache-control: max-age=300
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
content-type: text/plain; charset=utf-8
etag: "1468247e7d4f25a212dac4764ec86fb05453369c17bc4d0fb1e9ba4a943cf976"
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 1; mode=block
x-github-request-id: 8C55:1BB5CE:C17D:19BDA:68E69CE4
accept-ranges: bytes
date: Wed, 08 Oct 2025 17:18:30 GMT
via: 1.1 varnish
x-served-by: cache-lcy-egml8630069-LCY
x-cache: MISS
x-cache-hits: 0
x-timer: S1759943911.733562,VS0,VE183
vary: Authorization,Accept-Encoding
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
x-fastly-request-id: a8dad533fdac06f36c256b3f24cb75a325f68e0c
expires: Wed, 08 Oct 2025 17:23:30 GMT
source-age: 0
content-length: 106

That is unfortunate about the lack of environment interpolation as that largely renders the support for query parameters moot. We wouldn't want to commit a Github PAT as part of the config file given the security implications.

[milesj]

@gruffyn I think we cache the file in .moon/cache/temp, can you check what gets downloaded. I'm guessing its an error since the token doesn't work.

As for interpolation, that only works in tasks right now.

[gruffyn]

In all cases below the repository was set to private:

extends: "https://raw.githubusercontent.com/gruffyn/moon-remote-extends/refs/heads/main/.moon/tasks/tag-helloworld.yml"
results:
A file 4698260433731187179.yml was generated in the temp dir with the contents 404: Not Found

Valid token:
extends: "https://raw.githubusercontent.com/gruffyn/moon-remote-extends/refs/heads/main/.moon/tasks/tag-helloworld.yml?token=GH..."
results:
the error I attached before is show. No file was generated in the temp dir.

envvar placeholder:
extends: "https://raw.githubusercontent.com/gruffyn/moon-remote-extends/refs/heads/main/.moon/tasks/tag-helloworld.yml?token=${GITHUB_RAW_TOKEN}"
results:
the error I attached before is show. No file was generated in the temp dir. I would have expected this to be a 404 or 403 given that the authentication is invalid.

---

As an additional test, I swapped my example repo back to public.
If the repository is public then no error is returned for extends: "https://raw.githubusercontent.com/gruffyn/moon-remote-extends/refs/heads/main/.moon/tasks/tag-helloworld.yml". The project graph renders correctly and I can run moon task <projectid>:hello-world to inspect the task.

However extends: "https://raw.githubusercontent.com/gruffyn/moon-remote-extends/refs/heads/main/.moon/tasks/tag-helloworld.yml?token=GH..." still returns a formatting issue despite it returning the correct document with the same headers and content via browser and curl. The envvar placeholder version still returns the formatting error even though it should be receiving a 404.

[milesj]

It's interesting that even with the valid token it fails. Let me see if its a bug in our end.

[milesj]

Can you run with --log trace and paste the schematic log lines.

Edit: I think I found the bug.

[milesj]

Ok try 1.41.4