microlinkhq / youtube-dl-exec

94%

LAST BUILD ON BRANCH master

branch: SELECT

CHANGE BRANCH

x

Sync Branches

• No branch selected
• bin-check
• ci
• dependabot/github_actions/actions/checkout-3
• dependabot/github_actions/actions/checkout-4
• dependabot/github_actions/actions/checkout-5
• dependabot/github_actions/actions/checkout-6
• dependabot/github_actions/actions/checkout-7
• dependabot/github_actions/actions/setup-node-3.0.0
• dependabot/github_actions/actions/setup-node-3.1.0
• dependabot/github_actions/actions/setup-node-3.1.1
• dependabot/github_actions/actions/setup-node-4
• dependabot/github_actions/actions/setup-node-5
• dependabot/github_actions/actions/setup-node-6
• dependabot/github_actions/pnpm/action-setup-3
• dependabot/github_actions/pnpm/action-setup-4
• dependabot/github_actions/pnpm/action-setup-5
• dependabot/github_actions/pnpm/action-setup-6
• dependabot/npm_and_yarn/bin-version-check-6.0.0
• dependabot/npm_and_yarn/debug-logfmt-1.4.0
• dependabot/npm_and_yarn/tinyspawn-1.4.0
• dependabot/npm_and_yarn/tinyspawn-1.5.0
• deprecation-warning-fix
• docs
• feat/npm_config
• feat/youtube-dl-file
• feature/no-args-blacklist
• fetch
• fix-1
• fix/npm_config
• fix/postinstall-fetch-headers
• fix/typings
• issue/125
• issue/125-redo
• john-michaelburke/edit-postscript
• master
• miraclx/dump-simple-get
• next
• patch-1
• patch-2
• python
• refs/pull/164/merge
• remux-option-support
• skip-python-check
• types
• update-bin-version-check

Build # 28798430093

Build Type

push

github

Committed by web-flow

Commit Message

fix: pass authorization header to fetch in postinstall (#278)

The auth headers object was passed as the first-level options argument
(fetch(url, headers) instead of fetch(url, { headers })), so the
Authorization header from GITHUB_TOKEN/GH_TOKEN was silently dropped and
the GitHub API request was always unauthenticated. On shared CI egress
IPs this hits the 60 req/hr unauthenticated rate limit and breaks
installs even when a token is configured.

Also fixes the content-type guard on the next line, which negated the
header value before comparing it to a string and was therefore always
true, breaking direct binary hosts (YOUTUBE_DL_HOST pointing straight
at an octet-stream URL).

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Coverage Stats

18 of 26 branches covered (69.23%)

Branch coverage included in aggregate %.

137 of 139 relevant lines covered (98.56%)

3.78 hits per line