feat(ghes): fetch tool from configurable server

[DariuszPorowski]

💌 Description

• Add option to set own GitHub REST API, default to GITHUB_API_URL
• Enforce actionlint version / matcher check from public github
• Inputs naming adjustments
• Update docs

🔗 Related issue

Fixes: #14

🏗️ Type of change

• 📚 Examples/docs/tutorials
• 🐛 Bug fix (non-breaking change which fixes an issue)
• 🥂 Improvement (non-breaking change which improves an existing feature)
• 🚀 New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to change)
• 🚨 Security fix
• ⬆️ Dependencies update

✅ Checklist

• I've read the Code of Conduct document.
• I've read the Contributing guide.

[bhundven-axon]

@DariuszPorowski I'll give this a shot in a little while and will update with results.

[frederikb]

This isn't actually needed in my option. github.api_url will point to the correct API URL of the GHES instance.

[frederikb]

This will not work (and breaks as expected in my tests due to a 401 error), because the token here will be my GHES token by default, which is unknown to GitHub. If I override the github-token option with a real GitHub.com token, then consequently the later steps which target my GHES API will fail due to always using the same configured token.

I think you would need to introduce an additional github-token-downloadurl (name just for illustration) which is used for the environment step. This can also default to ${{ github.api_url }}, thus remaining backwards compatible.

Additionally we should allow not using a token at all when accessing the API (unauthenticated request). These calls are heavily rate-limited, but our GHES workflow may not have access to any GitHub.com token at all.

The list releases API is available without authentication:

This endpoint can be used without authentication or the aforementioned permissions if only public resources are requested.

[DariuszPorowski]

@frederikb great input! thanks for checking. Going to address your suggestions today, and appreciate GHES test after will update this PR.

[DariuszPorowski]

@frederikb the problem with anonymous GH public api calls is, it's a very limited rate limits: The primary rate limit for unauthenticated requests is 60 requests per hour.

[RufusJWB]

Is there hope that this will be fixed anytime soon? I'm trying to use actionlint inside of a GitHub Enterprise instance and it is constantly failing with 404 errors

[alikose90]

Me either.

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ EDITORCONFIG	editorconfig-checker	3		0	0	0.25s
✅ MARKDOWN	markdownlint	1	0	0	0	0.64s
✅ MARKDOWN	markdown-table-formatter	1	0	0	0	0.22s
✅ REPOSITORY	gitleaks	yes		no	no	0.52s
✅ SPELL	cspell	2		0	0	2.28s
✅ SPELL	lychee	3		0	0	1.61s
✅ YAML	yamllint	2		0	0	0.54s

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository