From cfd4ecb217776a9fcddaacaa0a464380587e12b3 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Tue, 14 Jul 2026 09:29:38 -0400
Subject: [PATCH] fix(release): use active gh authentication for evidence

---
 scripts/release-ci-summary.mjs          | 59 +++++++------------------
 test/scripts/release-ci-summary.test.ts | 15 +++++++
 2 files changed, 31 insertions(+), 43 deletions(-)

diff --git a/scripts/release-ci-summary.mjs b/scripts/release-ci-summary.mjs
index 5260627166be..7e9a83cee3b7 100755
--- a/scripts/release-ci-summary.mjs
+++ b/scripts/release-ci-summary.mjs
@@ -5,7 +5,7 @@
  */
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { mkdtempSync, readFileSync, rmSync, statSync } from "node:fs";
+import { mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import process from "node:process";
@@ -102,52 +102,25 @@ function jsonGh(args) {
   return JSON.parse(gh(args));
 }
 
+export function githubRestArgs(pathSuffix, repository = DEFAULT_REPO) {
+  return ["api", `repos/${repository}/${pathSuffix}`];
+}
+
 function githubRestJson(pathSuffix, repository = DEFAULT_REPO) {
-  const result = execFileSync(
-    "bash",
-    [
-      "-lc",
-      [
-        "set -euo pipefail",
-        'token="$("$OPENCLAW_PLAIN_GH_BIN" auth token)"',
-        'curl -fsS -H "Authorization: Bearer ${token}" -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" "${OPENCLAW_GITHUB_REST_URL}"',
-      ].join("\n"),
-    ],
-    {
-      encoding: "utf8",
-      env: {
-        ...plainGhEnv(),
-        OPENCLAW_PLAIN_GH_BIN: resolvePlainGhBin(),
-        OPENCLAW_GITHUB_REST_URL: `https://api.github.com/repos/${repository}/${pathSuffix}`,
-      },
-      maxBuffer: 16 * 1024 * 1024,
-      stdio: ["ignore", "pipe", "pipe"],
-    },
-  );
-  return JSON.parse(result);
+  return jsonGh(githubRestArgs(pathSuffix, repository));
+}
+
+export function artifactDownloadArgs(artifactId, repository = DEFAULT_REPO) {
+  return ["api", `repos/${repository}/actions/artifacts/${artifactId}/zip`];
 }
 
 function downloadArtifactZip(artifactId, destination, repository = DEFAULT_REPO) {
-  execFileSync(
-    "bash",
-    [
-      "-lc",
-      [
-        "set -euo pipefail",
-        'token="$("$OPENCLAW_PLAIN_GH_BIN" auth token)"',
-        'curl -fsSL -H "Authorization: Bearer ${token}" -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" --output "$OPENCLAW_GITHUB_ARTIFACT_DESTINATION" "$OPENCLAW_GITHUB_ARTIFACT_URL"',
-      ].join("\n"),
-    ],
-    {
-      env: {
-        ...plainGhEnv(),
-        OPENCLAW_GITHUB_ARTIFACT_DESTINATION: destination,
-        OPENCLAW_GITHUB_ARTIFACT_URL: `https://api.github.com/repos/${repository}/actions/artifacts/${artifactId}/zip`,
-        OPENCLAW_PLAIN_GH_BIN: resolvePlainGhBin(),
-      },
-      stdio: ["ignore", "ignore", "pipe"],
-    },
-  );
+  const archive = execFileSync(resolvePlainGhBin(), artifactDownloadArgs(artifactId, repository), {
+    env: plainGhEnv(),
+    maxBuffer: 16 * 1024 * 1024,
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  writeFileSync(destination, archive);
 }
 
 function rate() {
diff --git a/test/scripts/release-ci-summary.test.ts b/test/scripts/release-ci-summary.test.ts
index 87d886bb6d6c..89fd943af0b8 100644
--- a/test/scripts/release-ci-summary.test.ts
+++ b/test/scripts/release-ci-summary.test.ts
@@ -7,8 +7,10 @@ import { pathToFileURL } from "node:url";
 import { expectDefined } from "@openclaw/normalization-core";
 import { describe, expect, it } from "vitest";
 import {
+  artifactDownloadArgs,
   expectedChildDispatches,
   expectedSelectedChildDispatches,
+  githubRestArgs,
   manifestChildEntries,
   parseReleaseCiSummaryArgs,
   readManifestArtifactArchive,
@@ -36,6 +38,19 @@ const SCRIPT = "scripts/release-ci-summary.mjs";
 const MANIFEST_ARTIFACT_ENTRY = "full-release-validation-manifest.json";
 const hasUnzip = spawnSync("unzip", ["-v"], { stdio: "ignore" }).status === 0;
 
+describe("GitHub API commands", () => {
+  it("delegates authentication to gh for REST and artifact requests", () => {
+    expect(githubRestArgs("actions/runs/123", "owner/repo")).toEqual([
+      "api",
+      "repos/owner/repo/actions/runs/123",
+    ]);
+    expect(artifactDownloadArgs(456, "owner/repo")).toEqual([
+      "api",
+      "repos/owner/repo/actions/artifacts/456/zip",
+    ]);
+  });
+});
+
 function crc32(input: Buffer): number {
   let crc = 0xffffffff;
   for (const byte of input) {