fix: Add GitHub token auth and cross-platform support to downloader script

[devin-ai-integration]

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues

The downloader script's resolve_version() function calls the GitHub releases API without authentication, causing 403 rate-limit failures on shared CI runners. This was discovered while debugging contract test failures in launchdarkly/swift-eventsource#95. The equivalent script in sdk-test-harness already has token support.

Describe the solution you've provided

Rewrites downloader/run.sh to fix the auth bug and add observability and cross-platform support:

1. GitHub token auth — passes GITHUB_TOKEN (via Authorization header) to all API and download requests, avoiding rate limiting.
2. Cross-platform support — adds Windows detection (MSYS/MINGW/CYGWIN) with zip extraction, .exe extension handling, and normalizes aarch64 → arm64.
3. HTTP request logging — new do_curl() helper logs the request URL, HTTP status line, content-type, and x-ratelimit-remaining for every request.
4. Version resolution logging — lists all available versions and the resolved version during partial version resolution.
5. Platform info — outputs OS type, architecture, and archive name at startup.
6. Bug fix — changes exit → return in resolve_version() so it doesn't kill the entire script when called from a $() subshell.
7. Download-only mode — PARAMS is now optional. When omitted, the script downloads and extracts the binary without executing it.

Adds a new test-downloader.yml CI workflow that verifies the script on Linux x64, Linux arm64, macOS, and Windows — testing partial (v2) and full (v2.31.0) version resolution in download-only mode, plus a step that invokes the actual launchdarkly/gh-actions/actions/contract-tests action (with continue-on-error since no test service is running).

Suggested review checklist:

• The do_curl() function uses eval to construct curl commands (needed for proper header quoting). This matches the sdk-test-harness pattern — verify this is acceptable.
• On Windows, the [ ! -x "${EXECUTABLE}" ] check may always be true since MSYS doesn't set Unix execute bits on extracted .exe files — this would cause re-downloads but is not harmful. Worth considering.
• The continue-on-error: true on the gh-actions/contract-tests CI step means a download failure there won't fail CI. The direct download steps (partial + full version) are the strict verification; the action step just confirms compatibility.
• Making PARAMS optional is a behavioral change. Existing callers (like gh-actions/contract-tests) always pass PARAMS, so this should be safe, but confirm no consumers rely on the old error behavior.
• All informational output goes to stderr (via log()). This is correct for command substitution but means CI logs interleave stderr/stdout.

Describe alternatives you've considered

Could have forked the gh-actions/contract-tests action to call a fixed downloader script, but that would leave the bug in this repo for anyone using the script directly.

Additional context

• Devin session: https://app.devin.ai/sessions/2da8679d630649d4be8984e8cab6c980
• Requested by: rlamb@launchdarkly.com

---

---

Note

Medium Risk
Touches the release download/execution path and introduces OS-specific branching plus eval-based curl invocation, which could break downloads on some runners if edge cases were missed.

Overview
Fixes the downloader/run.sh release downloader to be more reliable on CI by supporting optional GITHUB_TOKEN auth for GitHub API and asset downloads and adding verbose HTTP logging (status, content-type, rate-limit remaining).

Expands the script to support Windows shells (MSYS/MINGW/CYGWIN) via OS/arch detection, zip extraction and .exe handling, normalizes aarch64→arm64, and changes behavior so PARAMS is optional (download-only mode) while also fixing resolve_version() to return instead of exiting the whole script.

Adds a new GitHub Actions workflow test-downloader.yml that runs the downloader on Linux x64/arm64, macOS, and Windows, testing both partial (v2) and full (v2.31.0) version resolution, plus a best-effort compatibility check via launchdarkly/gh-actions/actions/contract-tests@main.

^{Written by Cursor Bugbot for commit 2a29832. This will update automatically on new commits. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[semgrep-code-launchdarkly]

Semgrep identified an issue in your code:
An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

To resolve this comment:

✨ Commit Assistant fix suggestion

Suggested change

	uses: launchdarkly/gh-actions/actions/contract-tests@main
	uses: launchdarkly/gh-actions/actions/contract-tests@5a43cd7f346ee16b21969c8cb0f1b2d6b7b6b498 # main branch as of 2024-06-28

View step-by-step instructions

1. Replace uses: launchdarkly/gh-actions/actions/contract-tests@main with a reference pinned to a specific commit SHA.
2. Find the latest commit SHA for launchdarkly/gh-actions/actions/contract-tests that corresponds to the main branch or the desired release (you can get this from https://github.com/launchdarkly/gh-actions/commits/main or by running: $ git ls-remote https://github.com/launchdarkly/gh-actions.git refs/heads/main).
3. Update the line to: uses: launchdarkly/gh-actions/actions/contract-tests@<commit-sha>, replacing <commit-sha> with the full 40-character SHA from the previous step.
4. Optionally, add a comment next to the SHA noting which branch or version it corresponds to for future maintainability, e.g., # main.

Pinning the action to a full commit SHA ensures that only that exact version of the action will be used and cannot be modified upstream.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by third-party-action-not-pinned-to-commit-sha.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[kinyoklion]

/ar This is testing our own action and needs to use the main branch.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 6 additional findings.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}