fix(bootstrap): reject on non-2xx tarball response and handle zlib errors

streamRelease now throws GithubError for HTTP 4xx/5xx responses instead
of silently piping the error body (e.g. "404: Not Found") into the zlib
decompressor. This was the root cause of the Z_DATA_ERROR crash when the
cli-use branch was absent from a repo.

extract now attaches an error handler directly on the zlib.createUnzip()
stream. Node's pipe() does not forward stream errors, so without this
listener a zlib failure emitted an unhandled error event and crashed the
process rather than rejecting the Promise cleanly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: cs-raj

.talismanrc

@@ -39,4 +39,6 @@ fileignoreconfig:
   checksum: a64a4d396eddd936a63b799eff58c5c6660b5dcaa3a310fd8b09a027932f1789
 - filename: packages/contentstack-migration/README.md
   checksum: e96006c1a948f766c88ae972b29582fa58eaf8184606bf011eebddc5a06cd7b6
+- filename: packages/contentstack-bootstrap/test/github.test.js
+  checksum: b7badfcd3bbad0cb876364542bba26cdfd854f1b138be2896b5f84c219767040
 version: ""

packages/contentstack-bootstrap/src/bootstrap/github/client.ts

@@ -74,13 +74,23 @@ export default class GitHubClient {
     }
 
     const response = await HttpClient.create().options(options).get(url);
+
+    if (response.status >= 400) {
+      throw new GithubError(
+        messageHandler.parse('CLI_BOOTSTRAP_REPO_NOT_FOUND', `${this.repo.user}/${this.repo.name}`),
+        response.status,
+      );
+    }
+
     return response.data as Stream;
   }
 
   async extract(destination: string, stream: Stream): Promise<any> {
     return new Promise((resolve, reject) => {
+      const unzip = zlib.createUnzip();
+      unzip.on('error', reject);
       stream
-        .pipe(zlib.createUnzip())
+        .pipe(unzip)
         .pipe(
           tar.extract({
             cwd: destination,

packages/contentstack-bootstrap/test/github.test.js

@@ -1,5 +1,9 @@
 const { expect } = require('chai');
+const sinon = require('sinon');
+const { Readable } = require('stream');
+const { HttpClient } = require('@contentstack/cli-utilities');
 const GitHubClient = require('../lib/bootstrap/github/client').default;
+const GithubError = require('../lib/bootstrap/github/github-error').default;
 
 describe('Github Client', function () {
   it('Parse github url', () => {
@@ -16,4 +20,106 @@ describe('Github Client', function () {
       'https://api.github.com/repos/contentstack/contentstack-nextjs-react-universal-demo/tarball/cli-use',
     );
   });
+
+  describe('streamRelease', function () {
+    let sandbox;
+
+    beforeEach(() => {
+      sandbox = sinon.createSandbox();
+    });
+
+    afterEach(() => {
+      sandbox.restore();
+    });
+
+    it('should throw GithubError with status 404 when the branch does not exist', async () => {
+      const notFoundStream = new Readable({ read() {} });
+      notFoundStream.push(Buffer.from('404: Not Found'));
+      notFoundStream.push(null);
+
+      const httpStub = { get: sandbox.stub().resolves({ status: 404, data: notFoundStream }), options: sandbox.stub().returnsThis() };
+      sandbox.stub(HttpClient, 'create').returns(httpStub);
+
+      const client = new GitHubClient(GitHubClient.parsePath('contentstack/kickstart-next'));
+
+      try {
+        await client.streamRelease(client.gitTarBallUrl);
+        throw new Error('Expected GithubError to be thrown');
+      } catch (err) {
+        expect(err).to.be.instanceOf(GithubError);
+        expect(err.status).to.equal(404);
+      }
+    });
+
+    it('should throw GithubError with status 500 on server error', async () => {
+      const errStream = new Readable({ read() {} });
+      errStream.push(Buffer.from('Internal Server Error'));
+      errStream.push(null);
+
+      const httpStub = { get: sandbox.stub().resolves({ status: 500, data: errStream }), options: sandbox.stub().returnsThis() };
+      sandbox.stub(HttpClient, 'create').returns(httpStub);
+
+      const client = new GitHubClient(GitHubClient.parsePath('contentstack/kickstart-next'));
+
+      try {
+        await client.streamRelease(client.gitTarBallUrl);
+        throw new Error('Expected GithubError to be thrown');
+      } catch (err) {
+        expect(err).to.be.instanceOf(GithubError);
+        expect(err.status).to.equal(500);
+      }
+    });
+
+    it('should return the response stream when status is 200', async () => {
+      const mockStream = new Readable({ read() {} });
+      const httpStub = { get: sandbox.stub().resolves({ status: 200, data: mockStream }), options: sandbox.stub().returnsThis() };
+      sandbox.stub(HttpClient, 'create').returns(httpStub);
+
+      const client = new GitHubClient(GitHubClient.parsePath('contentstack/kickstart-next'));
+      const result = await client.streamRelease(client.gitTarBallUrl);
+
+      expect(result).to.equal(mockStream);
+    });
+
+    it('should pass Authorization header for private repos', async () => {
+      const mockStream = new Readable({ read() {} });
+      const httpStub = { get: sandbox.stub().resolves({ status: 200, data: mockStream }), options: sandbox.stub().returnsThis() };
+      sandbox.stub(HttpClient, 'create').returns(httpStub);
+
+      const client = new GitHubClient(GitHubClient.parsePath('contentstack/private-repo'), true, 'my-token');
+      await client.streamRelease(client.gitTarBallUrl);
+
+      const callOptions = httpStub.options.firstCall.args[0];
+      expect(callOptions.headers).to.deep.equal({ Authorization: 'token my-token' });
+    });
+
+    it('should throw GithubError immediately for private repos with no access token', async () => {
+      const client = new GitHubClient(GitHubClient.parsePath('contentstack/private-repo'), true, undefined);
+
+      try {
+        await client.streamRelease(client.gitTarBallUrl);
+        throw new Error('Expected GithubError to be thrown');
+      } catch (err) {
+        expect(err).to.be.instanceOf(GithubError);
+        expect(err.status).to.equal(1);
+      }
+    });
+  });
+
+  describe('extract', function () {
+    it('should reject (not crash the process) when the stream contains invalid gzip data', async () => {
+      const client = new GitHubClient(GitHubClient.parsePath('contentstack/kickstart-next'));
+
+      const badStream = new Readable({ read() {} });
+      badStream.push(Buffer.from('404: Not Found'));
+      badStream.push(null);
+
+      try {
+        await client.extract('/tmp', badStream);
+        throw new Error('Expected extraction error to be thrown');
+      } catch (err) {
+        expect(err.code).to.equal('Z_DATA_ERROR');
+      }
+    });
+  });
 });