Skip the automatic GitHub token on GitHub Enterprise runners

README.md

@@ -74,7 +74,7 @@ Once installed, run it from your AI agent with `/linear-release-setup` (or just
 | `log_level`     | No       |          | Log verbosity: `quiet` or `verbose`. Omit for default output.                                                                                                                                                                 |
 | `timeout`       | No       | `60`     | Maximum time in seconds to wait for the command to complete                                                                                                                                                                   |
 | `cli_version`   | No       | `v0.18.0` | Linear Release CLI version to install                                                                                                                                                                                         |
-| `github_token`  | No       | `${{ github.token }}` | GitHub token used to authenticate the CLI download. Authenticating avoids the low anonymous rate limit that can fail on busy or shared runners. Defaults to the workflow's automatic token; pass your own token to use a higher rate limit. |
+| `github_token`  | No       | `${{ github.token }}` on github.com | github.com token used to authenticate the CLI download. Authenticating avoids the low anonymous rate limit that can fail on busy or shared runners. Defaults to the workflow's automatic token; pass your own token to use a higher rate limit. On GitHub Enterprise the automatic token isn't valid for github.com, so the download is anonymous unless you pass a github.com token. If anonymous requests hit the rate limit, pass a fine-grained personal access token with no permissions. |
 
 ## Outputs
 

action.yml

@@ -69,9 +69,9 @@ inputs:
     required: false
     default: v0.18.0
   github_token:
-    description: GitHub token used to authenticate release metadata and downloads. Defaults to the workflow's automatic token, which avoids the lower anonymous API rate limit.
+    description: github.com token used to authenticate release metadata and downloads. Defaults to the workflow's automatic token on github.com, which avoids the lower anonymous API rate limit. On GitHub Enterprise the automatic token is not valid for github.com, so requests are anonymous unless you pass a github.com token.
     required: false
-    default: ${{ github.token }}
+    default: ${{ github.server_url == 'https://github.com' && github.token || '' }}
 
 outputs:
   release-id:

install.sh

@@ -26,7 +26,10 @@ fetch_release() {
   if [[ -n "${GITHUB_TOKEN:-}" ]]; then
     api_curl_args+=(-H "Authorization: Bearer ${GITHUB_TOKEN}")
   fi
-  curl "${api_curl_args[@]}" "${RELEASES_API}/${endpoint}"
+  if ! curl "${api_curl_args[@]}" "${RELEASES_API}/${endpoint}"; then
+    error "Could not fetch CLI release metadata from api.github.com. A 401 means github_token isn't valid for github.com; a 403 usually means the anonymous rate limit. Set github_token to a github.com token, such as a fine-grained personal access token with no permissions."
+    return 1
+  fi
 }
 
 release_asset_url() {

tests/install.test.sh

@@ -174,6 +174,17 @@ test_invalid_metadata() {
   assert_not_installed
 }
 
+test_metadata_fetch_failure() {
+  new_case "metadata-fetch-failure"
+  printf 'verified-binary\n' >"$MOCK_BINARY"
+  : >"$MOCK_CHECKSUMS"
+  write_release "v0.17.0" true "linear-release-linux-x64" true
+  MOCK_CURL_FAIL_PATTERN="api.github.com" invoke_installer "v0.17.0" "Linux" "x86_64"
+  assert_failure
+  assert_contains "${CASE_DIR}/output.log" "Set github_token to a github.com token"
+  assert_not_installed
+}
+
 test_unsupported_platform() {
   new_case "unsupported-platform"
   printf 'binary\n' >"$MOCK_BINARY"
@@ -194,6 +205,7 @@ tests=(
   test_verified_release
   test_tampered_release
   test_invalid_metadata
+  test_metadata_fetch_failure
   test_unsupported_platform
 )