[install] fix GitHub dependency bugs (#5941)

* handle branches with slashes

* handle empty repo string

2 files changed, 21 insertions, 10 deletions

diff --git a/src/install/dependency.zig b/src/install/dependency.zig
index 3a9ee6b54..9c7bcf479 100644
--- a/src/install/dependency.zig
+++ b/src/install/dependency.zig
@@ -189,24 +189,28 @@ pub inline fn isGitHubRepoPath(dependency: string) bool {
     if (dependency.len < 3) return false;
 
     var hash_index: usize = 0;
-    var slash_index: usize = 0;
+
+    // the branch could have slashes
+    // - oven-sh/bun#brach/name
+    var first_slash_index: usize = 0;
 
     for (dependency, 0..) |c, i| {
         switch (c) {
             '/' => {
                 if (i == 0) return false;
-                if (slash_index > 0) return false;
-                slash_index = i;
+                if (first_slash_index == 0) {
+                    first_slash_index = i;
+                }
             },
             '#' => {
                 if (i == 0) return false;
                 if (hash_index > 0) return false;
-                if (slash_index == 0) return false;
+                if (first_slash_index == 0) return false;
                 hash_index = i;
             },
             // Not allowed in username
             '.', '_' => {
-                if (slash_index == 0) return false;
+                if (first_slash_index == 0) return false;
             },
             // Must be alphanumeric
             '-', 'a'...'z', 'A'...'Z', '0'...'9' => {},
@@ -214,7 +218,7 @@ pub inline fn isGitHubRepoPath(dependency: string) bool {
         }
     }
 
-    return hash_index != dependency.len - 1 and slash_index > 0 and slash_index != dependency.len - 1;
+    return hash_index != dependency.len - 1 and first_slash_index > 0 and first_slash_index != dependency.len - 1;
 }
 
 // This won't work for query string params, but I'll let someone file an issue
diff --git a/src/install/install.zig b/src/install/install.zig
index 96f6f7b3e..10eaac1f4 100644
--- a/src/install/install.zig
+++ b/src/install/install.zig
@@ -2129,14 +2129,21 @@ pub const PackageManager = struct {
                 github_api_domain = api_domain;
             }
         }
+
+        const owner = this.lockfile.str(&repository.owner);
+        const repo = this.lockfile.str(&repository.repo);
+        const committish = this.lockfile.str(&repository.committish);
+
         return std.fmt.allocPrint(
             this.allocator,
-            "https://{s}/repos/{s}/{s}/tarball/{s}",
+            "https://{s}/repos/{s}/{s}{s}tarball/{s}",
             .{
                 github_api_domain,
-                this.lockfile.str(&repository.owner),
-                this.lockfile.str(&repository.repo),
-                this.lockfile.str(&repository.committish),
+                owner,
+                repo,
+                // repo might be empty if dep is https://github.com/... style
+                if (repo.len > 0) "/" else "",
+                committish,
             },
         ) catch unreachable;
     }