feat: authenticate API requests with GITHUB_TOKEN to avoid rate-limit

[G-Rath]

GH limits unauthenticated API requests to 60 an hour - GHA can authenticate using github.token which is always present to raise the limit to 1000 per hour.

Note that the GH API is only used for determining the latest version of Terminus so anyone specifying a specific version will not be rate limited, since the release download endpoint is not subject to rate limiting.

[namespacebrian]

How are the 60/hour requests counted when the requests originate from GHA? Is it per action, per project?

GHA can authenticate using github.token which is always present

Okay, please forgive my ignorance, but just to be clear, all GH actions already have github.token defined without any configuration steps being necessary, including at the project level?

Tracking internally as FEAT-1082

[namespacebrian]

You're the original maintainer. I trust your judgment.

[namespacebrian]

@G-Rath should I tag a release? 1.0.1? 1.1?

[G-Rath]

How are the 60/hour requests counted when the requests originate from GHA? Is it per action, per project?

Honestly I'm not entirely sure beyond knowing that is it not less than "per workflow" - it could be per project, but the docs only say "Unauthenticated requests are associated with the originating IP address". When using the GITHUB_TOKEN through:

When using GITHUB_TOKEN, the rate limit is 1,000 requests per hour per repository.

---

just to be clear, all GH actions already have github.token defined without any configuration steps being necessary, including at the project level?

That is my understanding yes - according to these docs:

An action can access the GITHUB_TOKEN through the github.token context even if the workflow does not explicitly pass the GITHUB_TOKEN to the action

I've had a hunt around and not been able to find anyway to definitely completely disable the GITHUB_TOKEN (/ github.token), nor a clear way to remove permission for that particular API.

We've already been using this on another action I maintain without issue, and if someone does report an issue because of this change I'm happy to be pinged and look into it (especially since it'll probably impact my other action 😅)

---

should I tag a release? 1.0.1? 1.1?

yup, I think releasing this as v1.1.0 would make sense - thanks!

[namespacebrian]

When I try to draft a new release, it shows this message saying it won't publish to GH marketplace because the action name isn't unique? I searched GH marketplace for "Setup Pantheon Terminus" and this action was the only result... :/