Bug: opencode upgrade fails with 403 Forbidden due to GitHub API Rate Limit (lack of GITHUB_TOKEN/GH_TOKEN environment variable support)

[estudiochapunov]

Describe the bug

Running opencode upgrade fails with an unexpected 403 HTTP status code when the GitHub API Rate Limit for unauthenticated requests from the client IP address is exhausted.

This happens because the upgrade command queries https://api.github.com/repos/anomalyco/opencode/releases/latest using an unauthenticated request (without passing authorization headers).

To Reproduce

1. Exhaust the GitHub API rate limit for unauthenticated requests from your current IP (e.g., behind a residential CGNAT or a shared public gateway).
2. Run:

   opencode upgrade

3. Observe the output:

   ● Using method: curl
   Error: Unexpected error
   StatusCode: non 2xx status code (403 GET https://api.github.com/repos/anomalyco/opencode/releases/latest)
   

Expected behavior

The upgrade tool should check if standard industry environment variables GITHUB_TOKEN or GH_TOKEN are present in the shell environment. If found, it should inject them as an Authorization: token <TOKEN> header in its API requests to api.github.com.

This is standard practice for CLI utilities to leverage the higher authenticated rate limits (5,000 requests/hr) and avoid unauthenticated blockages on shared IPs.

Environment

• OS: Linux Mint 21.3 (x86-64)
• OpenCode Version: 1.17.15
• Connection Method: curl

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• opencode upgrade fails with 403 (doesn't respect GITHUB_TOKEN) #23461: opencode upgrade fails with 403 (doesn't respect GITHUB_TOKEN) — same root cause and expected fix

[estudiochapunov]

This issue might be a duplicate of existing issues. Please check:

• opencode upgrade fails with 403 (doesn't respect GITHUB_TOKEN) #23461: opencode upgrade fails with 403 (doesn't respect GITHUB_TOKEN) — same root cause and expected fix

Yes, and no. Is true that is the same root cause and expected fix, but, that bug report says:

"When running opencode upgrade from behind a proxy/VPN, the command frequently fails with a 403 error due to GitHub API rate limiting for unauthenticated requests (60 requests/hour/IP).".

And we are reporting here, some same situation but not being behind nor proxy nor VPN. As it happens when unauthenticated requests are made by the opencode upgrade official attempt, even if GitHub is authenticated in the local system and the GITHUB_TOKEN or GH_TOKEN are present in the shell environment, as available.

So, it is not a duplicate and should be addressed.

And there is also, I found there, another issue reported that is alike: #1491 (Upgrade hitting Github rate limits
#1491) but it is from Aug 1, 2025 and it is Closed...