The REST API takes `Authorization: token <token>` as well as `Bearer <token>`, as GitHub does. Octokit, and so `@actions/github` and every action built on it, such as `actions/checkout` asking for a repository's default branch and `actions/github-script`, sends the job's token in that form, which g1t read as no token at all: a private repository answered 404 and rate limits counted the request by address. The API reference says so. · 3211ecc · flagon-io/g1t

127	127		request.json().await.unwrap_or(Value::Null)
128	128		}
129	129
130		−	/// Who a request's `Authorization: Bearer g1t_…` names. A missing token is
131		−	/// an anonymous viewer; a wrong one is refused, so that a typo does not
132		−	/// silently look signed out.
	130	+	/// Who a request's `Authorization: Bearer g1t_…` (or `token g1t_…`, as
	131	+	/// Octokit sends it) names. A missing token is an anonymous viewer; a
	132	+	/// wrong one is refused, so that a typo does not silently look signed out.
133	133		async fn authenticate(
134	134		request: &Request,
135	135		services: &Services,
136	136		) -> Result<std::result::Result<Viewer, Response>> {
137	137		let header = request.headers().get("authorization")?.unwrap_or_default();
138		−	let token = match header.split_once(' ') {
139		−	Some((scheme, token)) if scheme.eq_ignore_ascii_case("bearer") && !token.is_empty() => {
140		−	token.trim()
141		−	}
142		−	_ => return Ok(Ok(None)),
	138	+	let Some(token) = limits::bearer(&header) else {
	139	+	return Ok(Ok(None));
143	140		};
144	141		let viewer: Viewer = g1t_kit::call(
145	142		&services.identity,

55	55		Sha256::digest(token.as_bytes())[..8].iter().map(\|byte\| format!("{byte:02x}")).collect()
56	56		}
57	57
58		−	/// The bearer token of an `Authorization` header, if it has one.
	58	+	/// The access token of an `Authorization` header, if it has one: `Bearer
	59	+	/// <token>`, or `token <token>`, the form GitHub also takes and Octokit
	60	+	/// (`@actions/github`, so `actions/checkout` and `actions/github-script`)
	61	+	/// sends.
59	62		pub fn bearer(header: &str) -> Option<&str> {
60	63		match header.split_once(' ') {
61		−	Some((scheme, token)) if scheme.eq_ignore_ascii_case("bearer") => Some(token.trim()).filter(\|t\| !t.is_empty()),
	64	+	Some((scheme, token)) if scheme.eq_ignore_ascii_case("bearer") \|\| scheme.eq_ignore_ascii_case("token") => {
	65	+	Some(token.trim()).filter(\|t\| !t.is_empty())
	66	+	}
62	67		_ => None,
63	68		}
64	69		}
⋯
133	138		}
134	139
135	140		#[test]
136		−	fn only_bearer_tokens_are_read() {
	141	+	fn bearer_and_token_schemes_are_read() {
137	142		assert_eq!(bearer("Bearer g1t_abc "), Some("g1t_abc"));
138	143		assert_eq!(bearer("bearer g1t_abc"), Some("g1t_abc"));
	144	+	// Octokit's form, as `actions/checkout` sends it for a default branch.
	145	+	assert_eq!(bearer("token g1t_abc"), Some("g1t_abc"));
	146	+	assert_eq!(bearer("Token g1t_abc"), Some("g1t_abc"));
	147	+	assert_eq!(bearer("token "), None);
139	148		assert_eq!(bearer("Basic dXNlcjpwYXNz"), None);
140	149		assert_eq!(bearer("Bearer "), None);
141	150		assert_eq!(bearer(""), None);

47	47		-H "Authorization: Bearer $G1T_TOKEN"
48	48		```
49	49
	50	+	`Authorization: token $G1T_TOKEN`, the other form GitHub takes, works the
	51	+	same, so Octokit and the actions built on it, such as `actions/checkout`
	52	+	and `actions/github-script`, are signed in with the token they are given.
	53	+
50	54		Public data can be read without a token. A token that is not valid is
51	55		rejected with `401` rather than treated as anonymous. Each endpoint's page
52	56		says whether it needs a token.

flagon-io/g1t