Allow configuring the github-token used (#60)

* Allow configuring the github-token used

* Pass inputs.github-token via env

Interpolating inputs directly is an injection vector; passing through
environment variables is a security best-practice[^1].

[^1]: https://docs.github.com/en/enterprise-cloud@latest/enterprise-onboarding/github-actions-for-your-enterprise/security-hardening-for-github-actions#using-an-intermediate-environment-variable

---------

Co-authored-by: Luigi Operoso <40476330+brokenpip3@users.noreply.github.com>

Author: pbrisbin

action.yaml

@@ -81,6 +81,10 @@ inputs:
     description: "Bats-file: clean temp files"
     required: false
     default: true
+  github-token:
+    description: "GitHub token to use to download the releases"
+    required: false
+    default: ${{ github.token }}
 outputs:
   bats-installed:
     description: "True/False if bats has been installed"
@@ -138,21 +142,23 @@ runs:
 
         # From https://github.com/fluxcd/flux2/blob/44d69d6fc0c353e79c1bad021a4aca135033bce8/action/action.yml#L35
         if [[ -z "$VERSION" ]] || [[ "$VERSION" = "latest" ]]; then
-          VERSION=$(curl -fsSL --retry 4 --retry-connrefused -H "Authorization: token ${{ github.token }}" https://api.github.com/repos/bats-core/bats-core/releases/latest | grep tag_name | cut -d '"' -f 4)
+          VERSION=$(curl -fsSL --retry 4 --retry-connrefused -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/repos/bats-core/bats-core/releases/latest | grep tag_name | cut -d '"' -f 4)
         fi
         [[ $VERSION == v* ]] && VERSION="${VERSION:1}"
 
         mkdir -p ${TEMPDIR}
         mkdir -p ${DESTDIR}
 
-        curl -sL --retry 4 --retry-connrefused -H "Authorization: token ${{ github.token }}" ${URL}/archive/refs/tags/v${VERSION}.tar.gz | tar xz -C ${TEMPDIR} --strip-components 1 && cd ${TEMPDIR}
+        curl -sL --retry 4 --retry-connrefused -H "Authorization: token $GITHUB_TOKEN" ${URL}/archive/refs/tags/v${VERSION}.tar.gz | tar xz -C ${TEMPDIR} --strip-components 1 && cd ${TEMPDIR}
 
         ./install.sh ${DESTDIR}
         echo "Bats v${VERSION} installed in ${DESTDIR}"
         echo "${DESTDIR}/bin" >> "$GITHUB_PATH"
         echo "bats-installed=true" >> $GITHUB_OUTPUT
 
         rm -rf ${TEMPDIR} || exit 0
+      env:
+        GITHUB_TOKEN: ${{ inputs.github-token }}
 
     - name: Set paths and commands for libraries
       shell: bash