From eaa10566992e8371a27fbb1300e6fdc2e4161f17 Mon Sep 17 00:00:00 2001
From: Vladislav Doster <mvdoster@gmail.com>
Date: Fri, 28 Aug 2026 01:47:30 -0500
Subject: [PATCH] fix(install): retry and auth github api downloads

.zinit-download-file-stdout made every request anonymously and gave
up on the first transient error. The gh-r test suite alone exceeds
GitHub's anonymous API limit of 60 requests/hour/IP, and racing CI
runs trip per-IP abuse throttling, failing whole zunit slices (run
33138613456: 28 failures, all rate-limited downloads).

Send Authorization from GITHUB_TOKEN/GH_TOKEN, strictly limited to
api.github.com so tokens never reach asset CDNs, mirrors, or snippet
hosts, and retry transient HTTP errors in curl and wget.

Signed-off-by: Vladislav Doster <mvdoster@gmail.com>
---
 zinit-install.zsh | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/zinit-install.zsh b/zinit-install.zsh
index 02b91301..4413a548 100644
--- a/zinit-install.zsh
+++ b/zinit-install.zsh
@@ -666,6 +666,16 @@ builtin source "${ZINIT[BIN_DIR]}/zinit-side.zsh" || {
     builtin emulate -LR zsh ${=${options[xtrace]:#off}:+-o xtrace}
     setopt localtraps extendedglob
 
+    # Authenticate GitHub API requests when a token is available — the anonymous
+    # limit of 60 requests/hour/IP is too low for e.g. CI runners. Restricted to
+    # api.github.com so the token is never sent to any other host.
+    local -a curl_auth wget_auth
+    local gh_token=${GITHUB_TOKEN:-$GH_TOKEN}
+    if [[ $url == https://api.github.com/* && -n $gh_token ]] {
+        curl_auth=( -H "Authorization: Bearer $gh_token" )
+        wget_auth=( --header="Authorization: Bearer $gh_token" )
+    }
+
     # Return file directly for file:// urls, wget doesn't support this schema
     if [[ "$url" =~ ^file:// ]] {
         local filepath=${url##file://}
@@ -682,12 +692,12 @@ builtin source "${ZINIT[BIN_DIR]}/zinit-side.zsh" || {
 
         if (( ${+commands[curl]} )); then
             if [[ -n $progress ]]; then
-                command curl --progress-bar -fSL "$url" 2> >(.zinit-single-line >&2) || return 1
+                command curl --retry 2 --retry-delay 1 "${curl_auth[@]}" --progress-bar -fSL "$url" 2> >(.zinit-single-line >&2) || return 1
             else
-                command curl -fsSL "$url" || return 1
+                command curl --retry 2 --retry-delay 1 "${curl_auth[@]}" -fsSL "$url" || return 1
             fi
         elif (( ${+commands[wget]} )); then
-            command wget ${${progress:--q}:#1} "$url" -O - || return 1
+            command wget --tries=3 "${wget_auth[@]}" ${${progress:--q}:#1} "$url" -O - || return 1
         elif (( ${+commands[lftp]} )); then
             command lftp -c "cat $url" || return 1
         elif (( ${+commands[lynx]} )); then
@@ -701,12 +711,12 @@ builtin source "${ZINIT[BIN_DIR]}/zinit-side.zsh" || {
     } else {
         if type curl 2>/dev/null 1>&2; then
             if [[ -n $progress ]]; then
-                command curl --progress-bar -fSL "$url" 2> >(.zinit-single-line >&2) || return 1
+                command curl --retry 2 --retry-delay 1 "${curl_auth[@]}" --progress-bar -fSL "$url" 2> >(.zinit-single-line >&2) || return 1
             else
-                command curl -fsSL "$url" || return 1
+                command curl --retry 2 --retry-delay 1 "${curl_auth[@]}" -fsSL "$url" || return 1
             fi
         elif type wget 2>/dev/null 1>&2; then
-            command wget ${${progress:--q}:#1} "$url" -O - || return 1
+            command wget --tries=3 "${wget_auth[@]}" ${${progress:--q}:#1} "$url" -O - || return 1
         elif type lftp 2>/dev/null 1>&2; then
             command lftp -c "cat $url" || return 1
         else