🐛 [Bug]: Secure install action host handling

README.md

@@ -50,14 +50,15 @@ jobs:
 | ----- | -------- | ------- | ----------- |
 | `Version` | `false` | `latest` | Desired PowerShell Core version (e.g. `7.4.1`, `7.6.0-preview.6`). Use `latest` to install the newest stable release (or newest prerelease when `Prerelease` is `true`). |
 | `Prerelease` | `false` | `false` | Install a prerelease version. When `true` and `Version` is `latest`, resolves to the latest prerelease. Similar to `-Prerelease` on `Install-PSResource`. |
-| `Token` | `false` | `${{ github.token }}` | Token used for GitHub API requests. Set to an empty string (`''`) for anonymous API calls. |
-| `Host` | `false` | `github.com` | GitHub host used by the CLI/API path. Keep `github.com` for GitHub.com, or set your GHES hostname. |
+| `Token` | `false` | `${{ github.token }}` on GitHub.com; empty elsewhere | Token used for GitHub API requests to `github.com`. Set to an empty string (`''`) for anonymous API calls. |
+| `Host` | `false` | `github.com` | GitHub API host. Only `github.com` is supported because the action installs assets from the official `PowerShell/PowerShell` repository. |
 
 ## Secrets
 
-This action does **not** require custom secrets by default because it uses `${{ github.token }}`.
+This action does **not** require custom secrets on GitHub.com because it uses `${{ github.token }}`. On GitHub Enterprise Cloud with data residency, it defaults to anonymous access to avoid forwarding that instance's token to `github.com`.
 
-If needed, provide `Token` with a custom PAT. To force anonymous API access, set `Token: ''`.
+If needed, provide `Token` with a custom PAT for `github.com`. To force anonymous API access, set `Token: ''`.
+Release metadata and installation packages are always fetched from the official `PowerShell/PowerShell` repository on `github.com`.
 
 ## Outputs
 

action.yml

@@ -25,19 +25,16 @@ inputs:
     default: 'false'
   Token:
     description: |
-      Token used for GitHub API calls.
-      Defaults to github.token. Set to an empty string for anonymous API access.
+      Token used for GitHub API calls to github.com.
+      Defaults to github.token on GitHub.com. Set to an empty string for anonymous API access.
     required: false
-    default: ${{ github.token }}
+    default: ${{ github.server_url == 'https://github.com' && github.token || '' }}
   Host:
     description: |
-      GitHub host used by gh CLI for API calls.
-      Use github.com for GitHub.com or your GHES hostname.
+      GitHub API host. Only github.com is supported because PowerShell releases are hosted there.
     required: false
     default: github.com
 
-
-
 runs:
   using: composite
   steps:
@@ -50,7 +47,6 @@ runs:
         PRERELEASE: ${{ inputs.Prerelease }}
         GITHUB_TOKEN: ${{ inputs.Token }}
         GH_TOKEN: ${{ inputs.Token }}
-        GH_ENTERPRISE_TOKEN: ${{ inputs.Token }}
         GH_HOST: ${{ inputs.Host }}
       run: bash ./scripts/linux/install.sh
 
@@ -63,7 +59,6 @@ runs:
         PRERELEASE: ${{ inputs.Prerelease }}
         GITHUB_TOKEN: ${{ inputs.Token }}
         GH_TOKEN: ${{ inputs.Token }}
-        GH_ENTERPRISE_TOKEN: ${{ inputs.Token }}
         GH_HOST: ${{ inputs.Host }}
       run: bash ./scripts/macos/install.sh
 
@@ -75,7 +70,5 @@ runs:
         REQUESTED_VERSION: ${{ inputs.Version }}
         PRERELEASE: ${{ inputs.Prerelease }}
         GITHUB_TOKEN: ${{ inputs.Token }}
-        GH_TOKEN: ${{ inputs.Token }}
-        GH_ENTERPRISE_TOKEN: ${{ inputs.Token }}
         GH_HOST: ${{ inputs.Host }}
       run: ./scripts/windows/install.ps1

scripts/linux/install.sh

@@ -5,6 +5,11 @@ set -e
 echo "Requested version: [$REQUESTED_VERSION]"
 echo "Prerelease: [$PRERELEASE]"
 
+if [[ "$GH_HOST" != "github.com" ]]; then
+	echo "Error: Unsupported GitHub host '$GH_HOST'. PowerShell releases are fetched from github.com." >&2
+	exit 1
+fi
+
 github_api_get() {
 	local endpoint="$1"
 	if command -v gh >/dev/null 2>&1 && [[ -n "$GH_TOKEN" ]]; then
@@ -22,9 +27,6 @@ github_api_get() {
 	fi
 
 	local api_base="https://api.github.com"
-	if [[ -n "$GH_HOST" && "$GH_HOST" != "github.com" ]]; then
-		api_base="https://${GH_HOST}/api/v3"
-	fi
 
 	curl -s -f \
 		-H "Accept: application/vnd.github+json" \

scripts/macos/install.sh

@@ -5,6 +5,11 @@ set -e
 echo "Requested version: [$REQUESTED_VERSION]"
 echo "Prerelease: [$PRERELEASE]"
 
+if [[ "$GH_HOST" != "github.com" ]]; then
+	echo "Error: Unsupported GitHub host '$GH_HOST'. PowerShell releases are fetched from github.com." >&2
+	exit 1
+fi
+
 github_api_get() {
 	local endpoint="$1"
 	if command -v gh >/dev/null 2>&1 && [[ -n "$GH_TOKEN" ]]; then
@@ -22,9 +27,6 @@ github_api_get() {
 	fi
 
 	local api_base="https://api.github.com"
-	if [[ -n "$GH_HOST" && "$GH_HOST" != "github.com" ]]; then
-		api_base="https://${GH_HOST}/api/v3"
-	fi
 
 	curl -s -f \
 		-H "Accept: application/vnd.github+json" \

scripts/windows/install.ps1

@@ -6,6 +6,11 @@ param()
 Write-Host "Requested version: [$env:REQUESTED_VERSION]"
 Write-Host "Prerelease: [$env:PRERELEASE]"
 
+if ($env:GH_HOST -ne 'github.com') {
+    Write-Error "Unsupported GitHub host '$env:GH_HOST'. PowerShell releases are fetched from github.com."
+    exit 1
+}
+
 # GitHub API headers used throughout the script
 $headers = @{
     'Accept'               = 'application/vnd.github+json'
@@ -14,11 +19,7 @@ $headers = @{
 if ($env:GITHUB_TOKEN) {
     $headers['Authorization'] = "Bearer $($env:GITHUB_TOKEN)"
 }
-$apiBase = if ($env:GH_HOST -and $env:GH_HOST -ne 'github.com') {
-    "https://$($env:GH_HOST)/api/v3"
-} else {
-    'https://api.github.com'
-}
+$apiBase = 'https://api.github.com'
 
 # Resolve 'latest' -> concrete version
 $req = $env:REQUESTED_VERSION