download: restore artifact-domain fallback for GHCR bottles

[coder999999999]

Fixes #21892

---

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests (excluding integration tests) for your changes? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) with your changes locally?

---

• AI was used to generate or assist with generating this PR. Please specify below how you used AI to help you, and what steps you have taken to manually verify the changes.

---

This fixes HOMEBREW_ARTIFACT_DOMAIN fallback for GHCR bottle downloads. When an artifact mirror URL fails, Homebrew can now retry the original ghcr.io URL unless HOMEBREW_ARTIFACT_DOMAIN_NO_FALLBACK is set. The change also preserves existing authorization headers on artifact-mirror requests while still restoring GitHub Packages auth for real ghcr.io fallback requests.

I used Codex (GPT-5) to help draft and iterate on the patch and PR text. I manually reviewed the resulting changes, reproduced the original failure locally on macOS, verified both fallback and no-fallback brew fetch --force-bottle xz behaviour, ran targeted download-strategy tests and style checks, and ran bin/brew lgtm successfully on this branch.

[Copilot]

Pull request overview

This PR fixes HOMEBREW_ARTIFACT_DOMAIN behavior for GHCR bottle downloads by ensuring Homebrew can retry the original ghcr.io URL when an artifact mirror fails, and by restoring GitHub Packages auth headers for real ghcr.io fallback requests.

Changes:

• Precompute candidate download URLs so artifact-mirror failures can fall back to the original ghcr.io URL unless HOMEBREW_ARTIFACT_DOMAIN_NO_FALLBACK is set.
• Restore GitHub Packages auth headers for ghcr.io requests (while not adding them for artifact-mirror requests).
• Add regression tests covering fallback behavior and HOMEBREW_ARTIFACT_DOMAIN_NO_FALLBACK.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
Library/Homebrew/download_strategy.rb	Builds URL candidates up front for artifact-domain fallback; adds conditional GitHub Packages auth injection for ghcr.io requests.
Library/Homebrew/test/download_strategies/curl_spec.rb	Adds regression coverage for artifact-domain fallback vs. no-fallback behavior.
Library/Homebrew/test/download_strategies/curl_github_packages_spec.rb	Adds coverage ensuring auth is restored for ghcr.io requests but not added for artifact-mirror URLs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[MikeMcQuaid]

Will reopen when you're using the PR template.

[coder999999999]

Updated the PR body to use the repository template, added the required AI disclosure, and ran bin/brew lgtm successfully on this branch. If this now matches what you wanted, would you mind reopening the PR?

[MikeMcQuaid]

Thanks for the PR! A few comments.

[MikeMcQuaid]

Thanks!

CI is failing: https://github.com/Homebrew/brew/actions/runs/24467014618/job/71496786078?pr=22011

please ensure you are running brew lgtm before pushing.

[MikeMcQuaid]

I'm not sure I understand why this is required now and wasn't before? Can you explain?