fix(ci): authenticate gh-image installation (#69793)

Use the trusted publisher's scoped GitHub token when resolving the pinned
gh-image release. This avoids GitHub-hosted runners exhausting their shared
anonymous API rate limit before the evidence publisher can run.
This commit is contained in:
ethernet 2026-07-22 23:23:28 -04:00 committed by GitHub
parent dbf4f69b72
commit 4baf2ed8ad
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -33,6 +33,8 @@ jobs:
# v1.2.0 resolves to 44f4b93ecbbe22de6c45fa2f62f519aee564ca8c.
- name: Install gh-image
env:
GH_TOKEN: ${{ github.token }}
run: gh extension install drogers0/gh-image --pin v1.2.0
- name: Download and attach evidence