chore: add GITHUB_TOKEN environment variable to setup task in multiple workflows

.github/actions/setup-dev-environment/action.yml

@@ -105,4 +105,6 @@ runs:
         - name: Setup Task
           if: inputs.install-task == 'true'
           shell: bash
+          env:
+              GITHUB_TOKEN: ${{ github.token }}
           run: sh scripts/ci/setup-task.sh "${{ inputs.task-version }}"

.github/workflows/build-linux-packages.yml

@@ -95,6 +95,8 @@ jobs:
                   artifact-name: ${{ env.FRONTEND_ARTIFACT_NAME }}
 
             - name: Setup Task
+              env:
+                  GITHUB_TOKEN: ${{ github.token }}
               run: sh scripts/ci/setup-task.sh
 
             - name: Build release-assets

.github/workflows/build-release.yml

@@ -130,6 +130,8 @@ jobs:
 
             - name: Setup Task
               if: matrix.setup_trivy
+              env:
+                  GITHUB_TOKEN: ${{ github.token }}
               run: sh scripts/ci/setup-task.sh
 
             - name: Apt update (for Trivy .deb)

.github/workflows/ci.yml

@@ -120,6 +120,8 @@ jobs:
                   go-version: ${{ env.GO_VERSION }}
 
             - name: Setup Task
+              env:
+                  GITHUB_TOKEN: ${{ github.token }}
               run: sh scripts/ci/setup-task.sh 3.49.1
 
             - name: Run visualiser-wasm tests

scripts/ci/docker-build-entry.sh

@@ -26,14 +26,7 @@ if ! command -v node >/dev/null 2>&1; then
     apt-get install -y nodejs
 fi
 
-TASK_VER="${TASK_VERSION:-3.46.4}"
-_TASK_ARCH="$(uname -m)"
-case "$_TASK_ARCH" in
-    x86_64) _TASK_ARCH="amd64" ;;
-    aarch64) _TASK_ARCH="arm64" ;;
-esac
-curl -fsSL "https://github.com/go-task/task/releases/download/v${TASK_VER}/task_linux_${_TASK_ARCH}.tar.gz" \
-    | tar xz -C /usr/local/bin task
+sh scripts/ci/setup-task.sh "${TASK_VERSION:-3.49.1}"
 
 corepack enable
 corepack prepare "pnpm@${PNPM_VERSION}" --activate

scripts/ci/setup-task.sh

@@ -19,9 +19,42 @@ esac
 BASE_URL="https://github.com/go-task/task/releases/download/v${TASK_VERSION}"
 TARBALL="task_linux_${ARCH}.tar.gz"
 
+# GitHub release CDN over HTTP/2 can drop the stream (curl 56, "tried 5 times").
+# Default curl --retry skips that recv error. HTTP/1.1 plus --retry-all-errors
+# recovers from 503 and dropped connections. GITHUB_TOKEN / GH_TOKEN avoids
+# unauthenticated github.com rate limits. -L strips Authorization on the
+# objects.githubusercontent.com redirect.
+download_release() {
+    dest="$1"
+    url="$2"
+    token="${GITHUB_TOKEN:-${GH_TOKEN:-}}"
+    if [ -n "$token" ]; then
+        curl -fsSL --http1.1 \
+            --retry 8 \
+            --retry-all-errors \
+            --retry-delay 4 \
+            --retry-max-time 180 \
+            --connect-timeout 20 \
+            --max-time 180 \
+            -H "Authorization: Bearer ${token}" \
+            -o "$dest" \
+            "$url"
+    else
+        curl -fsSL --http1.1 \
+            --retry 8 \
+            --retry-all-errors \
+            --retry-delay 4 \
+            --retry-max-time 180 \
+            --connect-timeout 20 \
+            --max-time 180 \
+            -o "$dest" \
+            "$url"
+    fi
+}
+
 echo "Installing Task v${TASK_VERSION} (${ARCH})"
-curl -fsSL "${BASE_URL}/task_checksums.txt" -o /tmp/task-checksums.txt
-curl -fsSL "${BASE_URL}/${TARBALL}" -o /tmp/task.tar.gz
+download_release /tmp/task-checksums.txt "${BASE_URL}/task_checksums.txt"
+download_release /tmp/task.tar.gz "${BASE_URL}/${TARBALL}"
 
 EXPECTED="$(grep "  ${TARBALL}\$" /tmp/task-checksums.txt | cut -d' ' -f1)"
 ACTUAL="$(sha256sum /tmp/task.tar.gz | cut -d' ' -f1)"