Consistently use retriable HTTP client

go.mod

@@ -14,7 +14,6 @@ require (
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.12.1
 	golang.org/x/mod v0.40.0
-	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.22.0
 	gopkg.in/yaml.v3 v3.0.1
 )

go.sum

@@ -66,8 +66,6 @@ golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
 golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
 golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
 golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=

internal/cmd/fetcher/main.go

@@ -109,12 +109,12 @@ func newRootCommand(name string) *appcmd.Command {
 		Short: "Fetches latest plugin versions from external sources.",
 		Args:  appcmd.MaximumNArgs(1),
 		Run: builder.NewRunFunc(func(ctx context.Context, container appext.Container) error {
-			client := fetchclient.New(ctx)
+			client := fetchclient.New()
 			created, err := run(ctx, container, client, f)
 			if err != nil {
 				return fmt.Errorf("failed to fetch versions: %w", err)
 			}
-			if err := postProcessCreatedPlugins(ctx, container.Logger(), http.DefaultClient, created); err != nil {
+			if err := postProcessCreatedPlugins(ctx, container.Logger(), fetchclient.NewHTTPClient(), created); err != nil {
 				return fmt.Errorf("failed to run post-processing on plugins: %w", err)
 			}
 			if err := writeGitHubOutput("pr_title", generatePRTitle(created)); err != nil {

internal/fetchclient/fetchclient.go

@@ -15,7 +15,6 @@ import (
 	"github.com/google/go-github/v72/github"
 	"github.com/hashicorp/go-retryablehttp"
 	"golang.org/x/mod/semver"
-	"golang.org/x/oauth2"
 
 	"github.com/bufbuild/plugins/internal/source"
 )
@@ -26,7 +25,7 @@ const (
 	dartFlutterAPIURL = "https://pub.dev/api/packages"
 	goProxyURL        = "https://proxy.golang.org"
 	npmRegistryURL    = "https://registry.npmjs.org"
-	mavenURL          = "https://repo1.maven.org/maven2"
+	mavenURL          = "https://repo.maven.apache.org/maven2"
 	// docs: https://packaging.python.org/en/latest/specifications/simple-repository-api/
 	pypiURL = "https://pypi.org/simple"
 )
@@ -44,25 +43,26 @@ type Client struct {
 }
 
 // New returns a new client.
-func New(ctx context.Context) *Client {
-	var client *http.Client
+func New() *Client {
+	httpClient := NewHTTPClient()
+	ghClient := github.NewClient(httpClient)
 	if ghToken := os.Getenv("GITHUB_TOKEN"); ghToken != "" {
-		ts := oauth2.StaticTokenSource(
-			&oauth2.Token{AccessToken: ghToken},
-		)
-		client = oauth2.NewClient(ctx, ts)
-	} else {
-		retryableClient := retryablehttp.NewClient()
-		retryableClient.Logger = nil
-		client = retryableClient.StandardClient()
+		ghClient = ghClient.WithAuthToken(ghToken)
 	}
 	return &Client{
-		httpClient:  client,
-		ghClient:    github.NewClient(client),
+		httpClient:  httpClient,
+		ghClient:    ghClient,
 		pypiBaseURL: pypiURL,
 	}
 }
 
+// NewHTTPClient returns an HTTP client which retries transient failures.
+func NewHTTPClient() *http.Client {
+	retryableClient := retryablehttp.NewClient()
+	retryableClient.Logger = nil
+	return retryableClient.StandardClient()
+}
+
 // Fetch fetches new versions based on the given config and returns a valid semver version
 // that can be used with the Go semver package. The version is guaranteed to contain a "v" prefix.
 func (c *Client) Fetch(ctx context.Context, config *source.Config) (string, error) {