fix: Authenticate release asset downloads with GITHUB_TOKEN

[kinyoklion]

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues

Port of #415 (merged to main) and #416 (v2) to v3. The contract-tests action fetches run.sh from the v2 branch today, so this port keeps v3 from regressing when it becomes the branch CI uses.

Describe the solution you've provided

Previously GITHUB_TOKEN was only used for the releases-listing request in resolve_version, so any run that passed a full version string (as CI usually does) made no authenticated requests at all, and the asset download was always anonymous. The github.com/.../releases/download/... path is not a REST endpoint: GitHub publishes no rate limit for it and returns no x-ratelimit-* headers, and passing a token there is useless because curl -L drops Authorization on the cross-host redirect to the signed asset host.

This change routes the download through the documented release-assets API when a token is present:

• github_curl centralizes auth (Authorization: Bearer) plus -sS --retry 5 --retry-delay 2, replacing the previous eval-built command string that interpolated the token into a shell command.
• resolve_asset_url looks up the asset for the current OS/arch via GET /releases/tags/<version> and downloads it from GET /releases/assets/<id> with Accept: application/octet-stream. That lands in the documented authenticated rate limit bucket instead of an undocumented one.
• Without a token — or if the asset lookup fails — the token is cleared and it falls back to the previous anonymous releases/download URL, so external consumers are unaffected.

Docs referenced: rate limits for the REST API, release assets endpoints.

Describe alternatives you've considered

• Sending the token to the existing releases/download URL — verified that this has no effect on the actual byte transfer, since the header is dropped at the redirect.
• Retry-only (fix: Retry the test harness download and surface curl errors #411 on v2) — rides out transient failures, but leaves the download in the unauthenticated bucket.

How to test it

export VERSION=v3 PARAMS="-help"
GITHUB_TOKEN=<token> sh downloader/run.sh   # downloads from .../releases/assets/<id>
sh downloader/run.sh                        # falls back to .../releases/download/...
GITHUB_TOKEN=bogus sh downloader/run.sh     # prints the 401, then falls back anonymously

Also exercised full and partial version strings, the cached-binary path, and an unmatched version.

Additional context

Shell-script-only change used by CI, so no UI screenshots apply. This also brings the retry and error-surfacing behavior of #411 to v3, which never received it. The Windows zip path is unchanged apart from going through github_curl.

Link to Devin session: https://app.devin.ai/sessions/98e5024773d947509ad2575ae80bf31b
Requested by: @kinyoklion

---

Note

Overview
CI downloader (downloader/run.sh) now uses GITHUB_TOKEN for release asset downloads, not only when resolving partial version tags from the releases list.

A shared github_curl helper sends Authorization: Bearer with retries and replaces the old eval-built curl that only authenticated the releases list—and did not help downloads when CI passed a full version string.

When a token is set, resolve_asset_url fetches the OS/arch archive via the releases assets REST API (Accept: application/octet-stream), avoiding the public releases/download URL where curl -L drops auth on redirect. If asset lookup fails or no token is provided, behavior falls back to the anonymous download URL (token cleared on fallback so a bad token does not break public downloads).

^{Reviewed by Cursor Bugbot for commit 7a13940. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

@cursor review