Optional
keep only paths the predicate accepts, after stripping
leading path components to drop; a GitHub tarball wraps everything in one directory
for a private template, or to lift the unauthenticated rate limit
keep only paths the predicate accepts, after stripping