install-scripts.yml

name: install-scripts

# Verifies the one-line install scripts work regardless of an ambient
# GITHUB_TOKEN. The repo is public, so no token is required; a present-but-bad
# token must NOT break the install (it should warn and retry unauthenticated).
#
# Note on rate limits: the *only* request a bad token can 401 on is the
# `releases/latest` API call (asset downloads ignore the bad header and 200).
# Anonymous API calls are limited to 60/hr/IP and shared CI runners can exceed
# that, so the tests are split:
#   * bad-token  -> hits the API, asserts only that the retry WARNING is emitted
#                   (the install itself may be anon-rate-limited; that's GitHub's
#                   limit, not our bug).
#   * no-token   -> resolves the version up front with the runner's authenticated
#                   token, pins MDZ_VERSION so the script skips the API and
#                   downloads directly, then asserts a clean install + NO warning.
on:
  push:
    branches: [main]
    paths:
      - 'scripts/install.ps1'
      - 'scripts/install.sh'
      - '.github/workflows/install-scripts.yml'
  pull_request:
    paths:
      - 'scripts/install.ps1'
      - 'scripts/install.sh'
      - '.github/workflows/install-scripts.yml'
  workflow_dispatch:

permissions:
  contents: read

# A deliberately invalid token. Any malformed value makes GitHub return 401,
# which is exactly the "dev with an expired token" case we want to cover.
env:
  BAD_TOKEN: ghp_invalidTokenForFallbackTest000000000000

jobs:
  windows:
    name: install.ps1 (windows-latest)
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v5

      # Runs before the version is resolved, so MDZ_VERSION is unset and the
      # script must hit the API -> bad token -> 401/403 -> warning + retry.
      - name: Invalid token -> must warn (retry, not die)
        shell: pwsh
        env:
          GITHUB_TOKEN: ${{ env.BAD_TOKEN }}
        run: |
          $ErrorActionPreference = 'Continue'
          # Capture all streams to a file so the warning survives even if the
          # anonymous retry is rate-limited and the script then throws.
          try { & ./scripts/install.ps1 *> install-bad.log }
          catch { ("EXC: " + $_.Exception.Message) | Out-File -FilePath install-bad.log -Append }
          $out = Get-Content install-bad.log -Raw
          Write-Host $out
          if ($out -notmatch 'retrying without authentication') {
            throw 'Expected the unauthenticated-retry warning, but it was not emitted.'
          }

      - name: Resolve latest version (authenticated; avoids anon rate limit)
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          tag="$(gh api "repos/$GITHUB_REPOSITORY/releases/latest" --jq .tag_name)"
          echo "MDZ_VERSION=$tag" >> "$GITHUB_ENV"
          echo "Resolved MDZ_VERSION=$tag"

      - name: No token -> clean install, no warning
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          Remove-Item Env:GITHUB_TOKEN -ErrorAction SilentlyContinue
          if (-not $env:MDZ_VERSION) { throw 'MDZ_VERSION was not resolved.' }
          $out = & ./scripts/install.ps1 *>&1 | Out-String
          Write-Host $out
          if ($out -match 'retrying without authentication') {
            throw 'Got the unauthenticated-retry warning even though no token was set.'
          }
          $v = & "$env:LOCALAPPDATA\Microsoft\WindowsApps\mdz.cmd" --version 2>&1 | Out-String
          Write-Host "mdz --version -> $v"
          if ($v -notmatch '\d+\.\d+\.\d+') { throw 'mdz did not report a version after install.' }

  posix:
    name: install.sh (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - uses: actions/checkout@v5

      - name: Invalid token -> must warn (retry, not die)
        shell: bash
        env:
          GITHUB_TOKEN: ${{ env.BAD_TOKEN }}
        run: |
          # Command substitution captures all output (incl. the stderr warning)
          # even if the script later exits non-zero on an anon rate limit.
          set +e
          out="$(sh ./scripts/install.sh 2>&1)"
          set -e
          echo "$out"
          echo "$out" | grep -q 'retrying without authentication' \
            || { echo 'Expected the unauthenticated-retry warning, but it was not emitted.'; exit 1; }

      - name: Resolve latest version (authenticated; avoids anon rate limit)
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          tag="$(gh api "repos/$GITHUB_REPOSITORY/releases/latest" --jq .tag_name)"
          echo "MDZ_VERSION=$tag" >> "$GITHUB_ENV"
          echo "Resolved MDZ_VERSION=$tag"

      - name: No token -> clean install, no warning
        shell: bash
        run: |
          unset GITHUB_TOKEN
          [ -n "$MDZ_VERSION" ] || { echo 'MDZ_VERSION was not resolved.'; exit 1; }
          set +e
          out="$(sh ./scripts/install.sh 2>&1)"; rc=$?
          set -e
          echo "$out"
          [ "$rc" -eq 0 ] || { echo "install.sh exited $rc"; exit 1; }
          if echo "$out" | grep -q 'retrying without authentication'; then
            echo 'Got the unauthenticated-retry warning even though no token was set.'; exit 1
          fi
          v="$("$HOME/.local/bin/mdz" --version 2>&1 || true)"
          echo "mdz --version -> $v"
          echo "$v" | grep -Eq '[0-9]+\.[0-9]+\.[0-9]+' \
            || { echo 'mdz did not report a version after install.'; exit 1; }