From 38c571841048e13ba1287efff8cb61f0bee63d9b Mon Sep 17 00:00:00 2001 From: Romain Cascino Date: Thu, 1 Oct 2026 13:37:17 -0400 Subject: [PATCH 1/3] Skip the automatic GitHub token on GitHub Enterprise runners --- README.md | 2 +- action.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 5f5a774..7a737f4 100644 --- a/README.md +++ b/README.md @@ -74,7 +74,7 @@ Once installed, run it from your AI agent with `/linear-release-setup` (or just | `log_level` | No | | Log verbosity: `quiet` or `verbose`. Omit for default output. | | `timeout` | No | `60` | Maximum time in seconds to wait for the command to complete | | `cli_version` | No | `v0.18.0` | Linear Release CLI version to install | -| `github_token` | No | `${{ github.token }}` | GitHub token used to authenticate the CLI download. Authenticating avoids the low anonymous rate limit that can fail on busy or shared runners. Defaults to the workflow's automatic token; pass your own token to use a higher rate limit. | +| `github_token` | No | `${{ github.token }}` on github.com | github.com token used to authenticate the CLI download. Authenticating avoids the low anonymous rate limit that can fail on busy or shared runners. Defaults to the workflow's automatic token; pass your own token to use a higher rate limit. On GitHub Enterprise the automatic token isn't valid for github.com, so the download is anonymous unless you pass a github.com token. | ## Outputs diff --git a/action.yml b/action.yml index 900bfaa..f818c2c 100644 --- a/action.yml +++ b/action.yml @@ -69,9 +69,9 @@ inputs: required: false default: v0.18.0 github_token: - description: GitHub token used to authenticate release metadata and downloads. Defaults to the workflow's automatic token, which avoids the lower anonymous API rate limit. + description: github.com token used to authenticate release metadata and downloads. Defaults to the workflow's automatic token on github.com, which avoids the lower anonymous API rate limit. On GitHub Enterprise the automatic token is not valid for github.com, so requests are anonymous unless you pass a github.com token. required: false - default: ${{ github.token }} + default: ${{ github.server_url == 'https://github.com' && github.token || '' }} outputs: release-id: From 12dddf963c196494fdc29c29d578a342ea422f52 Mon Sep 17 00:00:00 2001 From: Romain Cascino Date: Thu, 1 Oct 2026 13:43:45 -0400 Subject: [PATCH 2/3] Point to github_token when the release metadata fetch fails --- install.sh | 5 ++++- tests/install.test.sh | 12 ++++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/install.sh b/install.sh index 458844f..b58e238 100644 --- a/install.sh +++ b/install.sh @@ -26,7 +26,10 @@ fetch_release() { if [[ -n "${GITHUB_TOKEN:-}" ]]; then api_curl_args+=(-H "Authorization: Bearer ${GITHUB_TOKEN}") fi - curl "${api_curl_args[@]}" "${RELEASES_API}/${endpoint}" + if ! curl "${api_curl_args[@]}" "${RELEASES_API}/${endpoint}"; then + error "Could not fetch CLI release metadata from api.github.com. A 401 means github_token isn't valid for github.com; a 403 usually means the anonymous rate limit. Set github_token to a github.com token, such as a fine-grained personal access token with no permissions." + return 1 + fi } release_asset_url() { diff --git a/tests/install.test.sh b/tests/install.test.sh index 7d62a0f..8a0c1b6 100644 --- a/tests/install.test.sh +++ b/tests/install.test.sh @@ -174,6 +174,17 @@ test_invalid_metadata() { assert_not_installed } +test_metadata_fetch_failure() { + new_case "metadata-fetch-failure" + printf 'verified-binary\n' >"$MOCK_BINARY" + : >"$MOCK_CHECKSUMS" + write_release "v0.17.0" true "linear-release-linux-x64" true + MOCK_CURL_FAIL_PATTERN="api.github.com" invoke_installer "v0.17.0" "Linux" "x86_64" + assert_failure + assert_contains "${CASE_DIR}/output.log" "Set github_token to a github.com token" + assert_not_installed +} + test_unsupported_platform() { new_case "unsupported-platform" printf 'binary\n' >"$MOCK_BINARY" @@ -194,6 +205,7 @@ tests=( test_verified_release test_tampered_release test_invalid_metadata + test_metadata_fetch_failure test_unsupported_platform ) From 1e3fb9d2c2bfd2ce20c8ade94763ca30889cb8da Mon Sep 17 00:00:00 2001 From: Romain Cascino Date: Thu, 1 Oct 2026 13:43:45 -0400 Subject: [PATCH 3/3] Document a github.com token for rate-limited Enterprise installs --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 7a737f4..12e6683 100644 --- a/README.md +++ b/README.md @@ -74,7 +74,7 @@ Once installed, run it from your AI agent with `/linear-release-setup` (or just | `log_level` | No | | Log verbosity: `quiet` or `verbose`. Omit for default output. | | `timeout` | No | `60` | Maximum time in seconds to wait for the command to complete | | `cli_version` | No | `v0.18.0` | Linear Release CLI version to install | -| `github_token` | No | `${{ github.token }}` on github.com | github.com token used to authenticate the CLI download. Authenticating avoids the low anonymous rate limit that can fail on busy or shared runners. Defaults to the workflow's automatic token; pass your own token to use a higher rate limit. On GitHub Enterprise the automatic token isn't valid for github.com, so the download is anonymous unless you pass a github.com token. | +| `github_token` | No | `${{ github.token }}` on github.com | github.com token used to authenticate the CLI download. Authenticating avoids the low anonymous rate limit that can fail on busy or shared runners. Defaults to the workflow's automatic token; pass your own token to use a higher rate limit. On GitHub Enterprise the automatic token isn't valid for github.com, so the download is anonymous unless you pass a github.com token. If anonymous requests hit the rate limit, pass a fine-grained personal access token with no permissions. | ## Outputs