Description:
actions/setup-java@v6 and current main define the token input with ${{ github.token }} as its GitHub.com default, but the JetBrains Runtime installer reads only process.env.GITHUB_TOKEN when it paginates the GitHub Releases API. GitHub Actions does not automatically export github.token as that environment variable, so normal JetBrains Runtime setup requests are unauthenticated despite the action receiving its default token input.
This reduces the GitHub REST API limit from the authenticated allowance to the shared unauthenticated limit (typically 60 requests/hour per source IP). JetBrains release discovery can make multiple paginated requests, making rate-limit failures more likely. Existing end-to-end workflows that explicitly export GITHUB_TOKEN mask the default-input path.
The JetBrains installer should use the action token input first, retain GITHUB_TOKEN as a backward-compatible fallback, send no authorization header when both are empty, and preserve authentication across pagination. Its Releases API requests should use an appropriate JSON GitHub API Accept header rather than a Contents API raw-media header. The token must never be logged.
Task version:
actions/setup-java@v6 and current main
Platform:
Runner type:
Repro steps:
- Run
actions/setup-java@v6 with distribution: jetbrains and a Java version, without setting an env.GITHUB_TOKEN value and without overriding the action's token input.
- Observe the GitHub Releases API requests made while resolving JetBrains Runtime releases.
- The action has received its default
token: ${{ github.token }} input, but the JetBrains installer omits the Authorization header because it checks only process.env.GITHUB_TOKEN.
- Repeated runs or pagination can exhaust the unauthenticated API quota and return rate-limit failures.
Expected behavior:
JetBrains Runtime release requests authenticate with the token action input by default. An explicitly supplied input takes precedence over GITHUB_TOKEN; the environment variable remains a fallback; pagination retains the same authentication; requests negotiate JSON; and no authorization header is sent when neither source is set.
Actual behavior:
JetBrains Runtime release requests use only process.env.GITHUB_TOKEN. Without an explicitly exported environment variable, requests are unauthenticated even though the action's token input contains ${{ github.token }}, causing unnecessary exposure to GitHub's unauthenticated rate limit.
Description:
actions/setup-java@v6and currentmaindefine thetokeninput with${{ github.token }}as its GitHub.com default, but the JetBrains Runtime installer reads onlyprocess.env.GITHUB_TOKENwhen it paginates the GitHub Releases API. GitHub Actions does not automatically exportgithub.tokenas that environment variable, so normal JetBrains Runtime setup requests are unauthenticated despite the action receiving its default token input.This reduces the GitHub REST API limit from the authenticated allowance to the shared unauthenticated limit (typically 60 requests/hour per source IP). JetBrains release discovery can make multiple paginated requests, making rate-limit failures more likely. Existing end-to-end workflows that explicitly export
GITHUB_TOKENmask the default-input path.The JetBrains installer should use the action
tokeninput first, retainGITHUB_TOKENas a backward-compatible fallback, send no authorization header when both are empty, and preserve authentication across pagination. Its Releases API requests should use an appropriate JSON GitHub API Accept header rather than a Contents API raw-media header. The token must never be logged.Task version:
actions/setup-java@v6and currentmainPlatform:
Runner type:
Repro steps:
actions/setup-java@v6withdistribution: jetbrainsand a Java version, without setting anenv.GITHUB_TOKENvalue and without overriding the action'stokeninput.token: ${{ github.token }}input, but the JetBrains installer omits theAuthorizationheader because it checks onlyprocess.env.GITHUB_TOKEN.Expected behavior:
JetBrains Runtime release requests authenticate with the
tokenaction input by default. An explicitly supplied input takes precedence overGITHUB_TOKEN; the environment variable remains a fallback; pagination retains the same authentication; requests negotiate JSON; and no authorization header is sent when neither source is set.Actual behavior:
JetBrains Runtime release requests use only
process.env.GITHUB_TOKEN. Without an explicitly exported environment variable, requests are unauthenticated even though the action'stokeninput contains${{ github.token }}, causing unnecessary exposure to GitHub's unauthenticated rate limit.