diff --git a/README.md b/README.md index 12aae68..bca683b 100644 --- a/README.md +++ b/README.md @@ -50,14 +50,15 @@ jobs: | ----- | -------- | ------- | ----------- | | `Version` | `false` | `latest` | Desired PowerShell Core version (e.g. `7.4.1`, `7.6.0-preview.6`). Use `latest` to install the newest stable release (or newest prerelease when `Prerelease` is `true`). | | `Prerelease` | `false` | `false` | Install a prerelease version. When `true` and `Version` is `latest`, resolves to the latest prerelease. Similar to `-Prerelease` on `Install-PSResource`. | -| `Token` | `false` | `${{ github.token }}` | Token used for GitHub API requests. Set to an empty string (`''`) for anonymous API calls. | -| `Host` | `false` | `github.com` | GitHub host used by the CLI/API path. Keep `github.com` for GitHub.com, or set your GHES hostname. | +| `Token` | `false` | `${{ github.token }}` on GitHub.com; empty elsewhere | Token used for GitHub API requests to `github.com`. Set to an empty string (`''`) for anonymous API calls. | +| `Host` | `false` | `github.com` | GitHub API host. Only `github.com` is supported because the action installs assets from the official `PowerShell/PowerShell` repository. | ## Secrets -This action does **not** require custom secrets by default because it uses `${{ github.token }}`. +This action does **not** require custom secrets on GitHub.com because it uses `${{ github.token }}`. On GitHub Enterprise Cloud with data residency, it defaults to anonymous access to avoid forwarding that instance's token to `github.com`. -If needed, provide `Token` with a custom PAT. To force anonymous API access, set `Token: ''`. +If needed, provide `Token` with a custom PAT for `github.com`. To force anonymous API access, set `Token: ''`. +Release metadata and installation packages are always fetched from the official `PowerShell/PowerShell` repository on `github.com`. ## Outputs diff --git a/action.yml b/action.yml index d678911..d56e1d9 100644 --- a/action.yml +++ b/action.yml @@ -25,19 +25,16 @@ inputs: default: 'false' Token: description: | - Token used for GitHub API calls. - Defaults to github.token. Set to an empty string for anonymous API access. + Token used for GitHub API calls to github.com. + Defaults to github.token on GitHub.com. Set to an empty string for anonymous API access. required: false - default: ${{ github.token }} + default: ${{ github.server_url == 'https://github.com' && github.token || '' }} Host: description: | - GitHub host used by gh CLI for API calls. - Use github.com for GitHub.com or your GHES hostname. + GitHub API host. Only github.com is supported because PowerShell releases are hosted there. required: false default: github.com - - runs: using: composite steps: @@ -50,7 +47,6 @@ runs: PRERELEASE: ${{ inputs.Prerelease }} GITHUB_TOKEN: ${{ inputs.Token }} GH_TOKEN: ${{ inputs.Token }} - GH_ENTERPRISE_TOKEN: ${{ inputs.Token }} GH_HOST: ${{ inputs.Host }} run: bash ./scripts/linux/install.sh @@ -63,7 +59,6 @@ runs: PRERELEASE: ${{ inputs.Prerelease }} GITHUB_TOKEN: ${{ inputs.Token }} GH_TOKEN: ${{ inputs.Token }} - GH_ENTERPRISE_TOKEN: ${{ inputs.Token }} GH_HOST: ${{ inputs.Host }} run: bash ./scripts/macos/install.sh @@ -75,7 +70,5 @@ runs: REQUESTED_VERSION: ${{ inputs.Version }} PRERELEASE: ${{ inputs.Prerelease }} GITHUB_TOKEN: ${{ inputs.Token }} - GH_TOKEN: ${{ inputs.Token }} - GH_ENTERPRISE_TOKEN: ${{ inputs.Token }} GH_HOST: ${{ inputs.Host }} run: ./scripts/windows/install.ps1 diff --git a/scripts/linux/install.sh b/scripts/linux/install.sh index b07df88..383c844 100755 --- a/scripts/linux/install.sh +++ b/scripts/linux/install.sh @@ -5,6 +5,11 @@ set -e echo "Requested version: [$REQUESTED_VERSION]" echo "Prerelease: [$PRERELEASE]" +if [[ "$GH_HOST" != "github.com" ]]; then + echo "Error: Unsupported GitHub host '$GH_HOST'. PowerShell releases are fetched from github.com." >&2 + exit 1 +fi + github_api_get() { local endpoint="$1" if command -v gh >/dev/null 2>&1 && [[ -n "$GH_TOKEN" ]]; then @@ -22,9 +27,6 @@ github_api_get() { fi local api_base="https://api.github.com" - if [[ -n "$GH_HOST" && "$GH_HOST" != "github.com" ]]; then - api_base="https://${GH_HOST}/api/v3" - fi curl -s -f \ -H "Accept: application/vnd.github+json" \ diff --git a/scripts/macos/install.sh b/scripts/macos/install.sh index f1820f2..38d27ab 100755 --- a/scripts/macos/install.sh +++ b/scripts/macos/install.sh @@ -5,6 +5,11 @@ set -e echo "Requested version: [$REQUESTED_VERSION]" echo "Prerelease: [$PRERELEASE]" +if [[ "$GH_HOST" != "github.com" ]]; then + echo "Error: Unsupported GitHub host '$GH_HOST'. PowerShell releases are fetched from github.com." >&2 + exit 1 +fi + github_api_get() { local endpoint="$1" if command -v gh >/dev/null 2>&1 && [[ -n "$GH_TOKEN" ]]; then @@ -22,9 +27,6 @@ github_api_get() { fi local api_base="https://api.github.com" - if [[ -n "$GH_HOST" && "$GH_HOST" != "github.com" ]]; then - api_base="https://${GH_HOST}/api/v3" - fi curl -s -f \ -H "Accept: application/vnd.github+json" \ diff --git a/scripts/windows/install.ps1 b/scripts/windows/install.ps1 index d493d21..959587a 100644 --- a/scripts/windows/install.ps1 +++ b/scripts/windows/install.ps1 @@ -6,6 +6,11 @@ param() Write-Host "Requested version: [$env:REQUESTED_VERSION]" Write-Host "Prerelease: [$env:PRERELEASE]" +if ($env:GH_HOST -ne 'github.com') { + Write-Error "Unsupported GitHub host '$env:GH_HOST'. PowerShell releases are fetched from github.com." + exit 1 +} + # GitHub API headers used throughout the script $headers = @{ 'Accept' = 'application/vnd.github+json' @@ -14,11 +19,7 @@ $headers = @{ if ($env:GITHUB_TOKEN) { $headers['Authorization'] = "Bearer $($env:GITHUB_TOKEN)" } -$apiBase = if ($env:GH_HOST -and $env:GH_HOST -ne 'github.com') { - "https://$($env:GH_HOST)/api/v3" -} else { - 'https://api.github.com' -} +$apiBase = 'https://api.github.com' # Resolve 'latest' -> concrete version $req = $env:REQUESTED_VERSION