From 50b89ef75881c8ead8fc58d4accddcef6aea2e85 Mon Sep 17 00:00:00 2001
From: Axel Niklasson Yun <axel@linear.app>
Date: Fri, 5 Jun 2026 10:07:12 +0200
Subject: [PATCH] Allow passing a GitHub token to authenticate CLI downloads
 (FEA-12043)

Unauthenticated downloads of the Linear Release CLI hit GitHub's
anonymous, per-IP rate limit, which fails on busy or shared CI runners.

Add a github_token input (defaulting to the workflow's automatic token)
that install.sh uses to authenticate the curl request for a higher rate
limit. curl drops the header on the cross-host redirect to the asset CDN,
so the token is only ever sent to github.com.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 README.md  | 1 +
 action.yml | 5 +++++
 install.sh | 9 ++++++++-
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 712beb9..65ea875 100644
--- a/README.md
+++ b/README.md
@@ -71,6 +71,7 @@ Once installed, run it from your AI agent with `/linear-release-setup` (or just
 | `log_level`     | No       |          | Log verbosity: `quiet` or `verbose`. Omit for default output.                                                                                                                                                                 |
 | `timeout`       | No       | `60`     | Maximum time in seconds to wait for the command to complete                                                                                                                                                                   |
 | `cli_version`   | No       | `v0.14.0` | Linear Release CLI version to install                                                                                                                                                                                         |
+| `github_token`  | No       | `${{ github.token }}` | GitHub token used to authenticate the CLI download. Authenticating avoids the low anonymous rate limit that can fail on busy or shared runners. Defaults to the workflow's automatic token; pass your own token to use a higher rate limit. |
 
 ## Outputs
 
diff --git a/action.yml b/action.yml
index aac6136..21ff6aa 100644
--- a/action.yml
+++ b/action.yml
@@ -58,6 +58,10 @@ inputs:
     description: Linear Release CLI version to install (e.g., "v0.14.0"). Set to "latest" to always use the newest CLI.
     required: false
     default: v0.14.0
+  github_token:
+    description: GitHub token used to authenticate release downloads through the GitHub CLI. Defaults to the workflow's automatic token. Pass a personal access token or GitHub App token when downloading from another repository or when you need higher rate limits than the default token provides.
+    required: false
+    default: ${{ github.token }}
 
 outputs:
   release-id:
@@ -81,6 +85,7 @@ runs:
       run: bash "${{ github.action_path }}/install.sh"
       env:
         CLI_VERSION: ${{ inputs.cli_version }}
+        GITHUB_TOKEN: ${{ inputs.github_token }}
 
     - name: Run Linear Release
       id: run
diff --git a/install.sh b/install.sh
index 6c35e07..daa8cb7 100644
--- a/install.sh
+++ b/install.sh
@@ -41,7 +41,14 @@ else
 fi
 
 echo "Downloading Linear Release CLI from $URL"
-curl -fsSL "$URL" -o "$BIN_PATH"
+
+curl_args=(-fsSL)
+# Authenticate when a token is set for a higher rate limit; curl drops the header on the cross-host redirect to the asset CDN, so it's only sent to github.com.
+if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+  curl_args+=(-H "Authorization: Bearer ${GITHUB_TOKEN}")
+fi
+
+curl "${curl_args[@]}" "$URL" -o "$BIN_PATH"
 chmod +x "$BIN_PATH"
 
 echo "Linear Release CLI installed at $BIN_PATH"