Download release asset from private repo using personal access token

[pantelis-karamolegkos]

Select Topic Area

Question

Body

I am trying to download a release assed from GitHub using curl, as follows:

curl -H "Accept: application/vnd.github+json"  -H "X-GitHub-Api-Version: 2022-11-28" -H "Authorization: Bearer XXXXXXXX" -LJO https://github.com/Org/repo/releases/download/0.4.2/repo-linux-amd64

This keep fetching a file with content Not Found.

When opening the link https://github.com/Org/repo/releases/download/0.4.2/repo-linux-amd64 from an authenticated browser window, it does download the file.

I have also tested my token by running

curl -H "Authorization: token XXXXXXXX" https://api.github.com/user

What is more, the token has the right scopes given that

gh release download 0.4.2 --pattern repo-linux-amd64 -R Org/repo

also works (the token value is exported in the GITHUB_TOKEN environment variable).

I have also tried this variation (with token instead of Bearer in the Authorization header) and the end result is the same

curl -H "Accept: application/vnd.github+json"  -H "X-GitHub-Api-Version: 2022-11-28" -H "Authorization: token XXXXXXXX" -LJO https://github.com/Org/repo/releases/download/0.4.2/repo-linux-amd64

What am I missing?

[ryan-cha]

Instead of the direct download url, have you tried Github API?

Here's how you can download a certain asset in a release. (See Github API Doc)
(Note the header! To download the binary itself, the header should be application/octet-stream.)

# Download a certain asset file in a release
curl -L \
  -H "Accept: application/octet-stream" \ 
  -H "Authorization: Bearer <YOUR-TOKEN>"\
  -H "X-GitHub-Api-Version: 2022-11-28" \
  -o {destination-file-name} \
  https://api.github.com/repos/{OWNER}/{REPO}/releases/assets/{ASSET-ID}


  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100  148k  100  148k    0     0   198k      0 --:--:-- --:--:-- --:--:--  198k

Where is the ASSET-ID? Make a call to List Releases API and search the response for it.

# List all the releases in a repo
curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>"\
  -H "X-GitHub-Api-Version: 2022-11-28" \
  https://api.github.com/repos/{OWNER}/{REPO}/releases

Hope this helps!

[abekila]

This doesn't actually download the asset content!

Just returns the representation of the assets:

{
"url": "xxxxxxx/releases/assets/9843333690",
"id": xxxx,
"node_id": "adsad",
"name": "content.txt",
"label": "",
"uploader": {
},
"content_type": "text/plain",
"state": "uploaded",
"size": 383,
"download_count": 1,
"created_at": "2024-03-27T23:27:49Z",
"updated_at": "2024-03-27T23:27:49Z",
"browser_download_url": "https://github.com/xxxx/xxx-xxx-xx-ss-ss-ss/releases/download/v1.2.1/content.txt"
}

[abekila]

Anyone found away to download the content of the asset from a private repo ? Using the browser_download_url ?

@pantelis-karamolegkos Did you find a solution ?

[Vincenzoferrara]

using application/octet-stream"
in the place of application/vnd.github+json"

[nmbarel]

where? it does not work for me. both with url and browser_download_url
can ypu paste your full command?

[Vincenzoferrara]

curl -L -H "Accept: application/octet-stream" -H "Authorization: Bearer " "<url/assent>" -o "<myfile.exstection>"

modifies the fields inside <>

instead of url/asset it must be the version of the url "api.github.com" and must also include assets of the single file you want to download
example url https://api.github.com/repos/[my-Owner]/[my-repo]/releases/assets/[my-file-asett-id]
change the values inside [ ]

(I also have some working (albeit simple) C# code if you need it)

curl command works on linux

[utamas]

[belibug]

Dude remove token in plain text.

[gm3dmo]

The Power is a repo containing example scripts for a lot of GitHub API endpoints. It includes an example for downloading a release asset:

https://github.com/gm3dmo/the-power/blob/main/download-release-asset.sh

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[nothub]

This is an example for matching the asset file name via regex:

asset_id="$(
    curl -fsSL \
        -H "Accept: application/vnd.github+json" \
        -H "Authorization: token ${GITHUB_PAT}" \
        -H "X-GitHub-Api-Version: 2022-11-28" \
        "https://api.github.com/repos/foobar/myapp/releases/tags/${MY_TAG}" \
        | jq -r 'first(.assets|to_entries[]|select(.value.name|test("foobar-\\d+\\.\\d+\\.\\d+\\.tar\\.gz"))|.value.id)'
)"

curl -fsSL \
    -H "Accept: application/octet-stream" \
    -H "Authorization: token ${GITHUB_PAT}" \
    -H "X-GitHub-Api-Version: 2022-11-28" \
    -o "${file_path}" \
    "https://api.github.com/repos/foobar/myapp/releases/assets/${asset_id}"