fix(ci): use GitHub API + curl for private repo release asset downloads

CMake file(DOWNLOAD) doesn't forward Authorization headers on HTTP 302
redirects, which breaks private repo release asset downloads (GitHub
redirects to S3). Changed vmouse download to use GitHub REST API with
curl to properly authenticate.

- Rewrite _fetch_vmouse() to query release API and download via asset
  endpoint with Accept: application/octet-stream
- Use curl (with -L) for all authenticated downloads
- Add curl to MSYS2 install list for CI reliability

Author: qiin2333

.github/workflows/main.yml

@@ -107,6 +107,7 @@ jobs:
           update: true
           install: >-
             wget
+            curl
 
       - name: Update Windows dependencies
         env:

cmake/packaging/FetchDriverDeps.cmake

@@ -51,6 +51,8 @@ endif()
 
 # ---------------------------------------------------------------------------
 # Helper: download a single file (skip if already cached)
+# Uses curl for authenticated requests to handle GitHub's 302 redirects
+# properly (CMake file(DOWNLOAD) doesn't forward auth headers on redirect).
 # ---------------------------------------------------------------------------
 function(_driver_download url output_path)
   if(EXISTS "${output_path}")
@@ -63,41 +65,137 @@ function(_driver_download url output_path)
   message(STATUS "  Downloading: ${url}")
 
   if(GITHUB_TOKEN)
-    file(DOWNLOAD "${url}" "${output_path}"
-      HTTPHEADER "Authorization: token ${GITHUB_TOKEN}"
-      STATUS _status
-      TLS_VERIFY ON)
+    # Use curl to handle GitHub's 302 redirects for private repo assets.
+    # CMake's file(DOWNLOAD) won't send auth headers after redirect to S3.
+    find_program(_CURL curl REQUIRED)
+    execute_process(
+      COMMAND "${_CURL}" -fsSL
+        -H "Authorization: token ${GITHUB_TOKEN}"
+        -H "Accept: application/octet-stream"
+        -o "${output_path}"
+        "${url}"
+      RESULT_VARIABLE _code
+      ERROR_VARIABLE _err)
+    if(NOT _code EQUAL 0)
+      message(WARNING "  curl download failed (${_code}): ${_err}")
+      file(REMOVE "${output_path}")
+      return()
+    endif()
   else()
     file(DOWNLOAD "${url}" "${output_path}"
       STATUS _status
       TLS_VERIFY ON)
+    list(GET _status 0 _code)
+    if(NOT _code EQUAL 0)
+      list(GET _status 1 _msg)
+      message(WARNING "  Download failed (${_code}): ${_msg}")
+      file(REMOVE "${output_path}")
+      return()
+    endif()
   endif()
 
-  list(GET _status 0 _code)
-  if(NOT _code EQUAL 0)
-    list(GET _status 1 _msg)
-    message(WARNING "  Download failed (${_code}): ${_msg}")
-    file(REMOVE "${output_path}")
-    return()
-  endif()
-
-  file(SIZE "${output_path}" _size)
-  if(_size EQUAL 0)
-    message(WARNING "  Downloaded file is empty: ${output_path}")
-    file(REMOVE "${output_path}")
+  if(EXISTS "${output_path}")
+    file(SIZE "${output_path}" _size)
+    if(_size EQUAL 0)
+      message(WARNING "  Downloaded file is empty: ${output_path}")
+      file(REMOVE "${output_path}")
+    endif()
   endif()
 endfunction()
 
 # ---------------------------------------------------------------------------
-# ZakoVirtualMouse  (individual release assets)
+# ZakoVirtualMouse  (private repo — use GitHub API for authenticated downloads)
+# For private repos, browser_download_url returns 302→S3 which rejects
+# forwarded auth headers. We must use the GitHub REST API asset endpoint
+# with Accept: application/octet-stream.
 # ---------------------------------------------------------------------------
 function(_fetch_vmouse)
   message(STATUS "Fetching ZakoVirtualMouse ${VMOUSE_DRIVER_VERSION} ...")
-  set(_base "https://github.com/${_VMOUSE_REPO}/releases/download/${VMOUSE_DRIVER_VERSION}")
 
-  foreach(_f ZakoVirtualMouse.dll ZakoVirtualMouse.inf ZakoVirtualMouse.cat)
-    _driver_download("${_base}/${_f}" "${VMOUSE_DRIVER_DIR}/${_f}")
+  set(_files ZakoVirtualMouse.dll ZakoVirtualMouse.inf ZakoVirtualMouse.cat)
+
+  # Check if all files already cached
+  set(_all_cached TRUE)
+  foreach(_f ${_files})
+    if(NOT EXISTS "${VMOUSE_DRIVER_DIR}/${_f}")
+      set(_all_cached FALSE)
+      break()
+    endif()
   endforeach()
+  if(_all_cached)
+    message(STATUS "  All vmouse files already cached")
+    return()
+  endif()
+
+  if(NOT GITHUB_TOKEN)
+    message(WARNING "  GITHUB_TOKEN required for private repo ${_VMOUSE_REPO}")
+    return()
+  endif()
+
+  find_program(_CURL curl REQUIRED)
+  file(MAKE_DIRECTORY "${VMOUSE_DRIVER_DIR}")
+
+  # Query release assets via GitHub API
+  set(_api_url "https://api.github.com/repos/${_VMOUSE_REPO}/releases/tags/${VMOUSE_DRIVER_VERSION}")
+  set(_json "${DRIVER_DEPS_CACHE}/_vmouse_release.json")
+  execute_process(
+    COMMAND "${_CURL}" -fsSL
+      -H "Authorization: token ${GITHUB_TOKEN}"
+      -H "Accept: application/vnd.github+json"
+      -o "${_json}"
+      "${_api_url}"
+    RESULT_VARIABLE _rc
+    ERROR_VARIABLE _err)
+  if(NOT _rc EQUAL 0)
+    message(WARNING "  Failed to query vmouse release API (${_rc}): ${_err}")
+    return()
+  endif()
+
+  # For each required file, find its asset id and download via API
+  foreach(_f ${_files})
+    if(EXISTS "${VMOUSE_DRIVER_DIR}/${_f}")
+      continue()
+    endif()
+
+    # Extract asset download URL from JSON using regex
+    # The API JSON contains entries like:
+    #   "name": "ZakoVirtualMouse.dll", ... "url": "https://api.github.com/repos/.../assets/12345"
+    file(READ "${_json}" _json_content)
+
+    # Find block for this asset: locate "name": "<filename>" then extract nearest "url"
+    # We use string(REGEX) to find the asset API url
+    string(REGEX MATCH "\"url\"[^}]*\"name\":[ ]*\"${_f}\"" _match_after "${_json_content}")
+    string(REGEX MATCH "\"name\":[ ]*\"${_f}\"[^}]*\"url\"" _match_before "${_json_content}")
+
+    set(_asset_api_url "")
+    # Try to extract the url from the assets array
+    # GitHub API returns assets like: { "url": "https://api.github.com/repos/.../assets/ID", ... "name": "file" }
+    string(REGEX MATCH "\"url\":[ ]*\"(https://api\\.github\\.com/repos/[^\"]+/assets/[0-9]+)\"[^}]*\"name\":[ ]*\"${_f}\"" _m "${_json_content}")
+    if(_m)
+      set(_asset_api_url "${CMAKE_MATCH_1}")
+    endif()
+
+    if(NOT _asset_api_url)
+      message(WARNING "  Could not find asset URL for ${_f} in release JSON")
+      continue()
+    endif()
+
+    message(STATUS "  Downloading ${_f} via API: ${_asset_api_url}")
+    execute_process(
+      COMMAND "${_CURL}" -fsSL
+        -H "Authorization: token ${GITHUB_TOKEN}"
+        -H "Accept: application/octet-stream"
+        -o "${VMOUSE_DRIVER_DIR}/${_f}"
+        "${_asset_api_url}"
+      RESULT_VARIABLE _rc
+      ERROR_VARIABLE _err)
+    if(NOT _rc EQUAL 0)
+      message(WARNING "  Download failed for ${_f} (${_rc}): ${_err}")
+      file(REMOVE "${VMOUSE_DRIVER_DIR}/${_f}")
+    endif()
+  endforeach()
+
+  file(REMOVE "${_json}")
 endfunction()
 
 # ---------------------------------------------------------------------------