feat(action): add base-url

[DariuszPorowski]

💌 Description

• Add option to set own GitHub REST API, default to GITHUB_API_URL
• Enforce actionlint version / matcher check from public github
• Inputs naming adjustments
• Update docs

🔗 Related issue

Fixes: #14

🏗️ Type of change

• 📚 Examples/docs/tutorials
• 🐛 Bug fix (non-breaking change which fixes an issue)
• 🥂 Improvement (non-breaking change which improves an existing feature)
• 🚀 New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to change)
• 🚨 Security fix
• ⬆️ Dependencies update

✅ Checklist

• I've read the Code of Conduct document.
• I've read the Contributing guide.

[bhundven-axon]

@DariuszPorowski I'll give this a shot in a little while and will update with results.

[frederikb]

This isn't actually needed in my option. github.api_url will point to the correct API URL of the GHES instance.

[frederikb]

This will not work (and breaks as expected in my tests due to a 401 error), because the token here will be my GHES token by default, which is unknown to GitHub. If I override the github-token option with a real github.com token, then consequently the later steps which target my GHES API will fail due to always using the same configured token.

I think you would need to introduce an additional github-token-downloadurl (name just for illustration) which is used for the environment step. This can also default to ${{ github.api_url }}, thus remaining backwards compatible.

Additionally we should allow not using a token at all when accessing the API (unauthenticated request). These calls are heavily rate-limited, but our GHES workflow may not have access to any github.com token at all.

The list releases API is available without authentication:

This endpoint can be used without authentication or the aforementioned permissions if only public resources are requested.

[DariuszPorowski]

@frederikb great input! thanks for checking. Going to address your suggestions today, and appreciate GHES test after will update this PR.

[DariuszPorowski]

@frederikb the problem with anonymous GH public api calls is, it's a very limited rate limits: The primary rate limit for unauthenticated requests is 60 requests per hour.