Budibase/budibase · error · Error

The plugin origin must be from Github

Error message

The plugin origin must be from Github

What it means

Budibase plugin installation only accepts plugin sources hosted on github.com. parseGithubUrl parses the supplied URL and rejects anything whose protocol is not https: or whose hostname is not exactly 'github.com'. This enforces a security whitelist so plugin code cannot be pulled from arbitrary hosts.

Source

Thrown at packages/server/src/api/controllers/plugin/github.ts:17

import { utils as coreUtils } from "@budibase/backend-core"
import {
  deleteFolderFileSystem,
  getPluginMetadata,
} from "../../../utilities/fileSystem"
import { downloadUnzipTarball } from "./utils"

function parseGithubUrl(url: string): URL {
  let parsed: URL
  try {
    parsed = new URL(url)
  } catch {
    throw new Error("Invalid Github URL")
  }

  if (parsed.protocol !== "https:" || parsed.hostname !== "github.com") {
    throw new Error("The plugin origin must be from Github")
  }

  return parsed
}

export async function request(
  url: string,
  headers: Record<string, string> = {},
  err: string
) {
  const response = await coreUtils.fetchWithBlacklist(url, { headers })
  if (response.status >= 300) {
    const respErr = await response.text()
    throw new Error(`Error: ${err} - ${respErr}`)
  }
  return response.json()
}

View on GitHub (pinned to a81a902e9a)

Solutions

1. Use the standard https://github.com/owner/repo URL of the plugin repository
2. Strip sub-paths like /blob/... or raw file URLs and point at the repository root
3. Replace http:// with https://
4. Host the plugin on github.com or switch the source to NPM if applicable

Example fix

// before
await installPlugin({ source: 'GITHUB', url: 'http://github.com/org/plugin' })
// after
await installPlugin({ source: 'GITHUB', url: 'https://github.com/org/plugin' })

const u = new URL(url)
if (u.protocol !== 'https:' || u.hostname !== 'github.com') {
  throw new Error('Use a https://github.com/owner/repo URL')
}

function isGithubRepoUrl(url: string): boolean {
  try {
    const u = new URL(url)
    return u.protocol === 'https:' && u.hostname === 'github.com'
  } catch {
    return false
  }
}

try {
  await installPlugin({ source: 'GITHUB', url })
} catch (err) {
  if (err.message === 'The plugin origin must be from Github') {
    // surface a UI hint to correct the URL to github.com
  }
}

When it happens

Trigger: Calling githubUpload (via the plugin create API with source=GITHUB) with a URL using http:// instead of https://, or a hostname other than github.com such as gist.github.com, gitlab.com, raw.githubusercontent.com, or an enterprise GitHub host.

Common situations: Pasting a raw.githubusercontent.com or codeload URL instead of the repo URL; using an on-prem GitHub Enterprise instance; linking to GitLab/Bitbucket repos; copying an http:// link from old docs.

Related errors

• Invalid Github URL
• Invalid URL.
• Only HTTP(S) URLs are allowed.
• package.json is missing one of 'name', 'version' or 'descrip
• File is not valid - cannot upload.

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/eb833589beee8af6. Report an issue: GitHub.