fix: Pass tokens to downloads

README.md

@@ -57,6 +57,7 @@ Sets environment variables: `NSS_DIR`, `NSS_PREBUILT`, `LD_LIBRARY_PATH`
     version-file: nss/min_version.txt # File containing the minimum version
     target: "" # Cross-compilation target (e.g. aarch64-linux-android)
     sccache: false # Whether to enable sccache for NSS compilation (default: false)
+    token: ${{ github.token }} # GitHub token to avoid API rate limits (needed for Android builds)
 ```
 
 If the `rust` action was called with `sccache: true` earlier in the same job, the `nss`

nss/action.yml

@@ -19,6 +19,9 @@ inputs:
   sccache:
     description: Whether to enable sccache for NSS compilation caching
     default: "false"
+  token:
+    description: "A GitHub PAT; used to avoid rate limits when fetching build scripts"
+    required: false
 
 runs:
   using: composite
@@ -243,6 +246,7 @@ runs:
       env:
         TARGET_PLATFORM: ${{ inputs.target }}
         RUNNER_OS: ${{ runner.os }}
+        GITHUB_TOKEN: ${{ inputs.token }}
       run: |
         # We want to do an optimized build for accurate CPU profiling, but
         # we also want debug symbols and frame pointers for that, which the normal optimized NSS
@@ -254,7 +258,9 @@ runs:
           # renovate: depName=mozilla/application-services datasource=github-releases
           VERSION="v150.0"
           for file in build-nss-android.sh build-android-common.sh; do
-            curl -o "$file" -sSf "https://raw.githubusercontent.com/mozilla/application-services/refs/tags/$VERSION/libs/$file"
+            curl -o "$file" -sSf \
+              -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+              "https://raw.githubusercontent.com/mozilla/application-services/refs/tags/$VERSION/libs/$file"
             chmod +x "$file"
           done
           # See https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md#android

rust/action.yml

@@ -111,7 +111,9 @@ runs:
         TOOLS: ${{ inputs.tools }}
       run: |
         # renovate: depName=cargo-bins/cargo-binstall datasource=github-releases
-        curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/ec80feb9e330418e014932e5982599255eff6dbb/install-from-binstall-release.sh | bash # v1.17.8
+        curl -L --proto '=https' --tlsv1.2 -sSf \
+          -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+          https://raw.githubusercontent.com/cargo-bins/cargo-binstall/ec80feb9e330418e014932e5982599255eff6dbb/install-from-binstall-release.sh | bash # v1.17.8
 
         for tool in $(echo $TOOLS | tr "," " "); do
           cargo binstall --no-confirm "$tool" || cargo install --locked "$tool"