Running on GHES tries to list releases on GHES instead of github.com

[msamendinger]

Hi,

I'm running the setup-spacectl action on a Github Enterprise Server and it fails to getLatestVersion() as it tries to read releases from the GHES API url https://git.example.org/api/v3/repos/spacelift-io/spacectl/releases.

Passing GITHUB_API_URL: https://api.github.com didn't work, I guess github.getOctokit() is not reading the env var.
Not sure how the GHES API url is then passed though.

For the moment I'm just downloading spacectl manually but would be great to see the action working for us.

If theres anything I can test, let me know.

Run spacelift-io/setup-spacectl@main
  with:
    version: latest
    github-token: ***
  env:
    GITHUB_API_URL: https://api.github.com
/home/runner/actions-runner/_work/_actions/spacelift-io/setup-spacectl/main/dist/index.js:7947
      const error = new import_request_error.RequestError(toErrorMessage(data), status, {
                    ^

RequestError [HttpError]: Not Found - https://docs.github.com/enterprise-server@3.15/rest/releases/releases#list-releases
    at /home/runner/actions-runner/_work/_actions/spacelift-io/setup-spacectl/main/dist/index.js:7947:21
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5) {
  status: 404,
  response: {
    url: 'https://git.example.org/api/v3/repos/spacelift-io/spacectl/releases',
    status: 404,
    headers: {
      'access-control-allow-origin': '*',
      'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
      connection: 'keep-alive',
      'content-encoding': 'gzip',
      'content-security-policy': "default-src 'none'",
      'content-type': 'application/json; charset=utf-8',
      date: 'Wed, 21 May 2025 09:17:07 GMT',
      'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
      server: 'nginx',
      'strict-transport-security': 'max-age=31536000; includeSubdomains',
      'transfer-encoding': 'chunked',
      'x-accepted-github-permissions': 'contents=read',
      'x-content-type-options': 'nosniff',
      'x-frame-options': 'deny',
      'x-github-api-version-selected': '2022-11-28',
      'x-github-enterprise-version': '3.15.6',
      'x-github-media-type': 'github.v3; format=json',
      'x-github-request-id': '36e73bb6-7172-420d-b4cf-02a747583800',
      'x-ratelimit-limit': '120000',
      'x-ratelimit-remaining': '119906',
      'x-ratelimit-reset': '1747821747',
      'x-ratelimit-resource': 'core',
      'x-ratelimit-used': '94',
      'x-xss-protection': '0'
    },
    data: {
      message: 'Not Found',
      documentation_url: 'https://docs.github.com/enterprise-server@3.15/rest/releases/releases#list-releases',
      status: '404'
    }
  },
  request: {
    method: 'GET',
    url: 'https://git.example.org/api/v3/repos/spacelift-io/spacectl/releases',
    headers: {
      accept: 'application/vnd.github.v3+json',
      'user-agent': 'octokit-core.js/5.2.1 Node.js/20.13.1 (linux; x64)',
      authorization: 'token [REDACTED]'
    },
    request: {
      agent: Agent {
        _events: [Object: null prototype] {
          free: [Function (anonymous)],
          newListener: [Function: maybeEnableKeylog]
        },
        _eventsCount: 2,
        _maxListeners: undefined,
        defaultPort: 443,
        protocol: 'https:',
        options: [Object: null prototype] {
          keepAlive: false,
          maxSockets: 100,
          noDelay: true,
          path: null
        },
        requests: [Object: null prototype] {},
        sockets: [Object: null prototype] {},
        freeSockets: [Object: null prototype] {},
        keepAliveMsecs: 1000,
        keepAlive: false,
        maxSockets: 100,
        maxFreeSockets: 256,
        scheduling: 'lifo',
        maxTotalSockets: Infinity,
        totalSocketCount: 0,
        maxCachedSessions: 100,
        _sessionCache: { map: {}, list: [] },
        [Symbol(shapeMode)]: false,
        [Symbol(kCapture)]: false
      },
      fetch: [Function: proxyFetch],
      hook: [Function: bound bound register]
    }
  }
}

[mbialon]

Hey @msamendinger, thank you for reporting the issue.

Would you be comfortable testing the fix from #37 using the branch?

      - name: Install spacectl
        uses: spacelift-io/setup-spacectl@fix-listing-versions

[msamendinger]

Hi @mbialon, thanks for the quick fix. While the API url works, the call is authenticated with the GHES token that is not valid on github.com and throws a 401 Bad credentials.

Run spacelift-io/setup-spacectl@fix-listing-versions
  with:
    version: latest
    github-token: ***
/home/runner/actions-runner/_work/_actions/spacelift-io/setup-spacectl/fix-listing-versions/dist/index.js:7947
      const error = new import_request_error.RequestError(toErrorMessage(data), status, {
                    ^

RequestError [HttpError]: Bad credentials - https://docs.github.com/rest
    at /home/runner/actions-runner/_work/_actions/spacelift-io/setup-spacectl/fix-listing-versions/dist/index.js:7947:21
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5) {
  status: 401,
  response: {
    url: 'https://api.github.com/repos/spacelift-io/spacectl/releases',
    status: 401,
    headers: {
      'access-control-allow-origin': '*',
      'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
      'content-length': '95',
      'content-security-policy': "default-src 'none'",
      'content-type': 'application/json; charset=utf-8',
      date: 'Wed, 21 May 2025 14:36:16 GMT',
      'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
      server: 'github.com',
      'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
      vary: 'Accept-Encoding, Accept, X-Requested-With',
      'x-content-type-options': 'nosniff',
      'x-frame-options': 'deny',
      'x-github-media-type': 'github.v3; format=json',
      'x-github-request-id': 'A048:C0818:B653BB8:BB31313:682DE4DF',
      'x-ratelimit-limit': '60',
      'x-ratelimit-remaining': '59',
      'x-ratelimit-reset': '1747841776',
      'x-ratelimit-resource': 'core',
      'x-ratelimit-used': '1',
      'x-xss-protection': '0'
    },
    data: {
      message: 'Bad credentials',
      documentation_url: 'https://docs.github.com/rest',
      status: '401'
    }
  },
  request: {
    method: 'GET',
    url: 'https://api.github.com/repos/spacelift-io/spacectl/releases',
    headers: {
      accept: 'application/vnd.github.v3+json',
      'user-agent': 'octokit-core.js/5.2.1 Node.js/20.13.1 (linux; x64)',
      authorization: 'token [REDACTED]'
    },
    request: {
      agent: Agent {
        _events: [Object: null prototype] {
          free: [Function (anonymous)],
          newListener: [Function: maybeEnableKeylog]
        },
        _eventsCount: 2,
        _maxListeners: undefined,
        defaultPort: 443,
        protocol: 'https:',
        options: [Object: null prototype] {
          keepAlive: false,
          maxSockets: 100,
          noDelay: true,
          path: null
        },
        requests: [Object: null prototype] {},
        sockets: [Object: null prototype] {},
        freeSockets: [Object: null prototype] {},
        keepAliveMsecs: 1000,
        keepAlive: false,
        maxSockets: 100,
        maxFreeSockets: 256,
        scheduling: 'lifo',
        maxTotalSockets: Infinity,
        totalSocketCount: 0,
        maxCachedSessions: 100,
        _sessionCache: { map: {}, list: [] },
        [Symbol(shapeMode)]: false,
        [Symbol(kCapture)]: false
      },
      fetch: [Function: proxyFetch],
      hook: [Function: bound bound register]
    }
  }
}

Node.js v20.13.1

[msamendinger]

I just saw in the README that github-token can be configured. Not everyone in our company has company access to github.com to create a token.
As the list releases endpoint doesn't need authentication for public resources could it be an option to not use a token if none is given?

This endpoint can be used without authentication or the aforementioned permissions if only public resources are requested.
https://docs.github.com/en/rest/releases/releases?apiVersion=2022-11-28

[msamendinger]

Thinking about it, that could most likely lead to being blocked by API rate limiting. Maybe we're too much of an edge case.