From 26ae2541cfc4d5e8f479677aee9dab5a10d1ae82 Mon Sep 17 00:00:00 2001 From: GF Date: Thu, 6 Aug 2026 21:33:59 -0400 Subject: [PATCH] Fix GitHub artifact download media type --- scripts/github_actions_verify.py | 2 +- scripts/tests/test_github_actions_verify.py | 18 ++++++++++++++++++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/scripts/github_actions_verify.py b/scripts/github_actions_verify.py index d692ab66..ecd8ada6 100755 --- a/scripts/github_actions_verify.py +++ b/scripts/github_actions_verify.py @@ -206,7 +206,7 @@ def download_bytes(self, path: str, *, maximum_bytes: int) -> bytes: request = urllib.request.Request( url, headers={ - "Accept": "application/octet-stream", + "Accept": "application/vnd.github+json", "Authorization": f"Bearer {self._token}", "X-GitHub-Api-Version": API_VERSION, }, diff --git a/scripts/tests/test_github_actions_verify.py b/scripts/tests/test_github_actions_verify.py index 8101c0bf..914fbc60 100644 --- a/scripts/tests/test_github_actions_verify.py +++ b/scripts/tests/test_github_actions_verify.py @@ -837,6 +837,24 @@ def test_missing_token_fails_closed(self) -> None: ): verifier.GitHubApi("https://api.github.invalid", "owner/repo", "") + def test_artifact_download_uses_github_json_media_type(self) -> None: + captured_headers: dict[str, str] = {} + + def capture(request: Any, timeout: int) -> Any: + self.assertEqual(timeout, 30) + captured_headers.update( + {name.lower(): value for name, value in request.header_items()} + ) + raise urllib.error.HTTPError(request.full_url, 418, "Stop", {}, None) + + api = verifier.GitHubApi( + "https://api.github.invalid", "owner/repo", "token", opener=capture + ) + with self.assertRaises(verifier.VerificationError): + api.download_bytes("/actions/artifacts/1/zip", maximum_bytes=1024) + + self.assertEqual(captured_headers["accept"], "application/vnd.github+json") + def test_http_failure_does_not_expose_token(self) -> None: token = "secret-token-that-must-not-appear"