this is wrong IMO. Packagist is not tied to github. The import through the API should validate the url in the same way than the UI form instead of providing a different validation