fix: resolve "latest" CLI version using the action's own token, not an env var (#852)

* fix: resolve "latest" CLI version using the action's own token, not an env var

`resolveLatestTag()` only checked `process.env.GITHUB_TOKEN`/`GH_TOKEN` for
authenticating the GitHub API call that resolves `cliVersion: latest`. GitHub
Actions does not inject GITHUB_TOKEN into a JS action's process environment
automatically - a calling workflow has to set it explicitly via `env:` - and
essentially no consumer workflow had reason to do that before this action
started making its own API calls. So this was unauthenticated for effectively
every consumer, not just ones under unusual load, and the unauthenticated
limit (60 req/hour, shared across every job on the runner's IP) is easy to
exhaust.

Hit live via game-ci/unity-test-runner#328's consumer, whose six-version test
matrix failed simultaneously with "GitHub API returned 403" - this action
shares the identical resolveLatestTag/downloadCli pattern (copy-pasted, per
the original comments referencing each other) and is exposed to the exact same
gap.

This action had no `githubToken` input at all, unlike unity-test-runner, so
there was no way for a consumer to hand it a token even deliberately. Added
one, defaulting to `${{ github.token }}` - populated by GitHub Actions on
every run with no consumer action needed - and threaded it through
downloadCli -> resolveLatestTag, ahead of the env var fallback (kept for the
CLI/install.sh path, which has no Action input to read from).

2 new tests, confirmed to catch the regression: removing the parameter
threading fails exactly "sends an Authorization header from the githubToken
parameter" and "forwards its githubToken parameter to resolveLatestTag", and
nothing else in the existing 12.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

* fix: satisfy yarn format:check on download-cli.ts

Co-Authored-By: Claude Sonnet 5 <[email protected]>

* test: cover the GH_TOKEN fallback branch in resolveLatestTag

Co-Authored-By: Claude Sonnet 5 <[email protected]>

* test: verify explicit githubToken takes precedence over env fallbacks

Addresses a CodeRabbit nitpick on PR #852: the existing tests covered
the GITHUB_TOKEN and GH_TOKEN fallback paths individually but not the
precedence rule itself (githubToken > GITHUB_TOKEN > GH_TOKEN) when
more than one is present at once.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

---------

Co-authored-by: Claude Sonnet 5 <[email protected]>

src/download-cli.test.ts

@@ -76,6 +76,31 @@ describe('resolveLatestTag', () => {
     }
   });
 
+  // The githubToken parameter is the action's own `githubToken` input,
+  // which defaults to `${{ github.token }}` - populated by GitHub Actions on
+  // every run with no consumer action needed. process.env.GITHUB_TOKEN, by
+  // contrast, is NOT auto-injected into a JS action's environment - a
+  // calling workflow has to set it explicitly, which essentially none did.
+  // Confirmed live via game-ci/unity-test-runner#328: a consumer's six-
+  // version matrix failed simultaneously with "GitHub API returned 403"
+  // despite every job having a real, usable token the whole time.
+  it('sends an Authorization header from the githubToken parameter even when no env var is set', async () => {
+    const fetchFn = vi.fn(async () => ({
+      ok: true,
+      status: 200,
+      json: async () => ({ tag_name: 'v0.1.15' }),
+    })) as unknown as typeof fetch;
+
+    await resolveLatestTag(fetchFn, 'gha-token-from-input');
+
+    expect(fetchFn).toHaveBeenCalledWith(
+      expect.any(String),
+      expect.objectContaining({
+        headers: expect.objectContaining({ Authorization: 'Bearer gha-token-from-input' }),
+      }),
+    );
+  });
+
   it('sends an Authorization header from GITHUB_TOKEN when set, to avoid the unauthenticated rate limit', async () => {
     const original = process.env.GITHUB_TOKEN;
     process.env.GITHUB_TOKEN = 'test-token-123';
@@ -100,6 +125,61 @@ describe('resolveLatestTag', () => {
     }
   });
 
+  it('falls back to GH_TOKEN when GITHUB_TOKEN is unset', async () => {
+    const originalGithub = process.env.GITHUB_TOKEN;
+    const originalGh = process.env.GH_TOKEN;
+    delete process.env.GITHUB_TOKEN;
+    process.env.GH_TOKEN = 'gh-token-456';
+
+    const fetchFn = vi.fn(async () => ({
+      ok: true,
+      status: 200,
+      json: async () => ({ tag_name: 'v0.1.15' }),
+    })) as unknown as typeof fetch;
+
+    try {
+      await resolveLatestTag(fetchFn);
+      expect(fetchFn).toHaveBeenCalledWith(
+        expect.any(String),
+        expect.objectContaining({
+          headers: expect.objectContaining({ Authorization: 'Bearer gh-token-456' }),
+        }),
+      );
+    } finally {
+      if (originalGithub !== undefined) process.env.GITHUB_TOKEN = originalGithub;
+      if (originalGh === undefined) delete process.env.GH_TOKEN;
+      else process.env.GH_TOKEN = originalGh;
+    }
+  });
+
+  it('prefers the explicit githubToken parameter over GITHUB_TOKEN/GH_TOKEN when both are present', async () => {
+    const originalGithub = process.env.GITHUB_TOKEN;
+    const originalGh = process.env.GH_TOKEN;
+    process.env.GITHUB_TOKEN = 'env-github-token';
+    process.env.GH_TOKEN = 'env-gh-token';
+
+    const fetchFn = vi.fn(async () => ({
+      ok: true,
+      status: 200,
+      json: async () => ({ tag_name: 'v0.1.15' }),
+    })) as unknown as typeof fetch;
+
+    try {
+      await resolveLatestTag(fetchFn, 'explicit-input-token');
+      expect(fetchFn).toHaveBeenCalledWith(
+        expect.any(String),
+        expect.objectContaining({
+          headers: expect.objectContaining({ Authorization: 'Bearer explicit-input-token' }),
+        }),
+      );
+    } finally {
+      if (originalGithub === undefined) delete process.env.GITHUB_TOKEN;
+      else process.env.GITHUB_TOKEN = originalGithub;
+      if (originalGh === undefined) delete process.env.GH_TOKEN;
+      else process.env.GH_TOKEN = originalGh;
+    }
+  });
+
   it('throws with a clear message on a non-ok response', async () => {
     const fetchFn = vi.fn(async () => ({
       ok: false,
@@ -171,6 +251,33 @@ describe('downloadCli', () => {
     );
   });
 
+  // downloadCli is the only caller of resolveLatestTag in production code,
+  // so this is what actually exercises the wiring index.ts depends on - the
+  // resolveLatestTag-level test above only proves the function accepts the
+  // parameter, not that anything passes it one.
+  it('forwards its githubToken parameter to resolveLatestTag when resolving "latest"', async () => {
+    globalThis.fetch = vi.fn(async (url: string) => {
+      if (url.includes('/releases/latest')) {
+        return { ok: true, status: 200, json: async () => ({ tag_name: 'v0.1.33' }) };
+      }
+      return { ok: true, status: 200, text: async () => 'echo mock install.sh' };
+    }) as unknown as typeof fetch;
+
+    vi.mocked(exec.exec).mockImplementation(async (_cmd, _args, options) => {
+      options?.listeners?.stdout?.(Buffer.from('/tmp/game-ci\n'));
+      return 0;
+    });
+
+    await downloadCli('latest', 'gha-token-from-input');
+
+    expect(globalThis.fetch).toHaveBeenCalledWith(
+      'https://api.github.com/repos/game-ci/cli/releases/latest',
+      expect.objectContaining({
+        headers: expect.objectContaining({ Authorization: 'Bearer gha-token-from-input' }),
+      }),
+    );
+  });
+
   it('resolves "latest" to a concrete tag before fetching install.sh', async () => {
     globalThis.fetch = vi.fn(async (url: string) => {
       if (url.includes('/releases/latest')) {