Add support for private repos using env var or netrc

[codyaray]

This adds support for using goreleaser against a private github repo. It authenticates using a personal access token. This token must have repo permissions to read the private repo. Note: this works for 2FA enabled as well.

It checks for either a GITHUB_TOKEN env var or the api.github.com machine in your ~/.netrc file. This supports the token in both the password or the login field of the github machine.

For example, both of these will work:

machine api.github.com
        login codyaray
        password xxxxxxxxxxxxxxxxxxxxxxxxxxx

machine api.github.com login xxxxxxxxxxxxxxxxxxxxxxxxxxx

I also updated the goreleaser version so godownloader supports gcflags, asmflags, and similar configuration.

Now you can do something like this:

curl -ns https://api.github.com/repos/YOU/YOURAPP/contents/godownloader.sh?ref=master -H Accept:application/vnd.github.raw | bash

You're still able to shorten the URL but the header is required. So you might just wrap that in another bash script just to add the header. Create a public gist with the following contents:

curl -ns https://api.github.com/repos/YOU/YOURAPP/contents/godownloader.sh?ref=master -H Accept:application/vnd.github.raw | bash -s -- $@

Now create a short URL pointing to your public gist. Your users still get a nice short one-liner like

curl -ns https://git.io/yourapp | bash

Fixes #69

[codyaray]

The test is failing because the API is rate limited unless you authenticate, and there's a lot of tests running in quick succession. So it might be useful to authenticate on CI for this reason.

You're allowed 60 requests per hour unauthenticated (per IP address) and 5000 requests per hour authenticated.

[caarlos0]

I'll take a look at this later today.

[caarlos0]

this change seems unrelated...

[caarlos0]

this will hit rate limits on travis & cia...

[caarlos0]

I'm not sure... we were not using the API on purpose to avoid rate limit errors on OSS projects...

maybe @client9 can give a better opinion...

[codyaray]

Yeah, that's my main concern as well. I don't think there's a way to support private repos without hitting the API endpoints though.

[github-actions]

Stale pull request message

[sysbot]

@caarlos0 @codyaray anything I can help with to get this moving and possibly merge? I'm also interested in this.

[polothy]

Would a flag be helpful?

• If no --private it uses current pattern that avoids API limits and generates the same install.sh as before.
• With --private it assumes you have a token and API limits are no longer a problem and we can use APIs, etc. It would generate an install.sh that requires a token.

[caarlos0]

@polothy I think that makes sense...

[codyaray]

@caarlos0 so can we do this? Can you wrap this up with the --private flag if you're ok with it.

We'd still need this to fully do the homebrew with a private github repo, even if we have goreleaser/goreleaser#507, right?

(I noticed that #69 was closed. 😢 )

[caarlos0]

Please see #161

[github-actions]

This pull-request seems be stale, will auto-close soon.