Access to asset binaries of a release draft with Authorization {PAT}

[Keith-CY]

Select Topic Area

General

Body

Hi there, I was trying to download assets of a release draft so their checksums can be programmatically appended in the release note before publication.

The main logic of the script is as follows:

1. get a release draft with PAT that is authorized as content: read and write;
2. get the asset list of the release draft. Each item has a browser_download_url;
3. use browser_download_url to download the binary of each asset.

The script is as follows:

const { pipeline } = require('node:stream/promises')
const { createWriteStream } = require('node:fs')
const { tmpdir } = require('node:os')
const { Octokit } = require('@octokit/rest')

const { PAT: TOKEN, OWNER, REPO } = process.env

const exec = async () => {
  const octokit = new Octokit({ auth: TOKEN })

  const releases = await octokit.repos.listReleases({
    owner: OWNER,
    repo: REPO,
  })

  const draft = releases.data.find((r) => r.draft) // find the release draft

  if (!draft) {
    throw new Error('No release draft found')
  }

  const assetList = await octokit.repos
    .listReleaseAssets({
      owner: OWNER,
      repo: REPO,
      release_id: draft.id,
    })
    .then((res) =>
      res.data.map(({ id, name, browser_download_url }) => ({ id, name, download: browser_download_url }))
    )

  const tmp = tmpdir()

  assetList.forEach(async ({ name, download }) => {
    const path = `${tmp}/DEMO/${name}`

    await pipeline(
      await fetch(download, {
        headers: {
          Authorization: `Bearer ${TOKEN}`,
          'Content-Type': 'application/octet-stream',
        },
      })
        .then(async (res) => {
          return res.body
        })
        .catch(() => {
          throw new Error('Fail to fetch asset')
        }),

      createWriteStream(path)
    )
    console.log('end')
  })
}

exec()

The problem is at fetch(browser_download_url) with Authorization {PAT}, it returns 404 instead of the binary.

But this script works if draft is replaced with a published one:

-  const draft = releases.data.find((r) => r.draft) // find the release draft
+  const draft = releases.data[0]

I also tried fetching browser_download_url in the console of GitHub page, and it worked with cookies.

So, it's a permission issue, PAT of content: read and write is able to access a release draft and its assets, but not their binaries. I also tried with a new PAT with all permissions but still got a 404 error.

I've searched issues in this repo and found a similar one at https://github.com/orgs/community/discussions/76392, it's about access to assets of a private repo. I'm not sure if it is caused by the same reason under the hood, so I open this one for access to assets of a release draft

My point:
It would be a great help if PAT could be authorized to download asset binaries of a release draft because it facilitates the workflow of a release.

[Keith-CY]

Oh.. I found another similar issue(https://github.com/orgs/community/discussions/47453) and got the point.

application/octet-stream should not only be set as Content-Type, but also be set as Accept when it's intended to download the binary.