Support case-insensitive lookup for GitHub-backed package names

[TyceHerrman]

Overview

aqua package lookup using exact-case strings for GitHub release-backed packages doesn't align with what I think is common expectation of case insensitivity for GitHub release-backed packages (i.e., GitHub owner/repo routing is case-insensitive.)

How to reproduce

RasKrebs/sonar exists in aqua-registry:

• pkgs/RasKrebs/sonar/pkg.yaml
• pkgs/RasKrebs/sonar/registry.yaml

But GitHub currently displays the repository as:

• raskrebs/sonar
• https://github.com/raskrebs/sonar

This can lead to situation where a user sees the lowercase GitHub URL and tries:

packages:
  - name: raskrebs/sonar@v0.3.0

(Another example as a mise user, something like mise use -g aqua:raskrebs/sonar for installing)

That fails because the aqua registry key is RasKrebs/sonar.

This also means extra registry maintenance if GitHub repo changes casing.

Expected behaviour

Proposal

Keep canonical package names case-sensitive, but add case-insensitive fallback lookup for GitHub-backed package names.

Suggested behavior:

1. Try exact package-name lookup first.
2. If exact lookup fails, and the requested package name looks like a GitHub owner/repo package, try case-insensitive matching against packages whose effective source is GitHub-backed, such as github_release and github_archive.
3. If exactly one package matches case-insensitively, resolve to that canonical package name internally.
4. If multiple packages or aliases match case-insensitively, return an ambiguity error.
5. Do not globally lowercase package names.

This would allow:

packages:
  - name: raskrebs/sonar@v0.3.0

to resolve to canonical package RasKrebs/sonar@v0.3.0.

Scoped To GitHub-Backed Packages

Package names in aqua are not only GitHub URLs. They are registry identifiers and can also represent:

• custom package names
• monorepo subpackages, such as owner/repo/tool
• aliases
• non-GitHub package sources
• policy allowlist entries
• Go import paths or other case-preserving identifiers

GitHub owner/repo lookup is different: GitHub already resolves owner/repo case-insensitively, and the API returns the canonical owner/repo casing. Supporting case-insensitive fallback for this specific case would match user expectations better imho without changing the canonical registry identity.

Compatibility Notes

This should be implementable without breaking existing configs if exact match remains first.

Important constraints:

• Exact match must continue to win.
• Canonical package name should be used after resolution for install/cache/policy behavior.
• Case-insensitive fallback should error on ambiguity rather than choosing an arbitrary package.
• Alias conflicts should be detected.
• For monorepo package names, only the GitHub owner/repo portion should be compared case-insensitively; the trailing aqua package suffix should remain exact unless there is a deliberate reason to relax it.
• Non-GitHub package names should remain exact-case.

Actual behaviour

See how to reproduce

Note

Written and researched with support from Codex but reviewed by me

[github-actions]

Dear mise users

This comment was posted because mise was mentioned.
If you use mise, please see the following issue first.

• Dear mise users aqua-registry#30430

If this is not related to mise, please ignore this comment.

Thank you.

---

workflow

[suzuki-shunsuke]

I transferred this issue from aqua-registry to aqua because this is about the feature of aqua itself rather than specific packages.