name: GitHub auth for git and cargo
description: Authenticate every github.com fetch in this job (git clone, cargo git dependencies) so shared-IP anonymous rate limits do not apply
inputs:
  token:
    description: Token with read access to the repositories fetched during the build
    default: ${{ github.token }}
runs:
  using: composite
  steps:
    - shell: bash
      env:
        TOKEN: ${{ inputs.token }}
      run: |
        # Sent on every github.com request, so throttled anonymous downloads never happen. A credential helper
        # or a token in the URL is only used after a 401, and GitHub never challenges for a public repository.
        B64=$(printf 'x-access-token:%s' "$TOKEN" | base64 | tr -d '\n')
        echo "::add-mask::$B64"
        git config --global http.https://github.com/.extraheader "AUTHORIZATION: basic $B64"
        # actions/checkout keeps the same header in each checked-out repository; two copies make GitHub answer 400.
        for d in "$GITHUB_WORKSPACE" "$GITHUB_WORKSPACE"/*/; do
          [ -d "$d/.git" ] && git -C "$d" config --local --unset-all http.https://github.com/.extraheader || true
        done
        echo "GIT_TERMINAL_PROMPT=0" >> "$GITHUB_ENV"
        # cargo's libgit2 transport ignores http.extraheader; the git CLI honours it.
        echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"