From ea915216b6f488860adbe78e029652147ee734f2 Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Tue, 13 Oct 2026 15:32:43 +0100
Subject: [PATCH] Make `auth` property on `GitHubApiDetails` optional

---
 lib/entry-points.js | 40 ++++++++++++++++++++--------------------
 src/api-client.ts   | 35 +++++++++++++++++++----------------
 src/codeql.test.ts  |  2 +-
 src/github.ts       |  2 +-
 4 files changed, 41 insertions(+), 38 deletions(-)

diff --git a/lib/entry-points.js b/lib/entry-points.js
index d75374a7c..771cd7eed 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -26401,7 +26401,7 @@ var require_utils4 = __commonJS({
     })();
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.GitHub = exports2.defaults = exports2.context = void 0;
-    exports2.getOctokitOptions = getOctokitOptions2;
+    exports2.getOctokitOptions = getOctokitOptions;
     var Context = __importStar2(require_context());
     var Utils = __importStar2(require_utils3());
     var core_1 = (init_dist_src2(), __toCommonJS(dist_src_exports));
@@ -26417,7 +26417,7 @@ var require_utils4 = __commonJS({
       }
     };
     exports2.GitHub = core_1.Octokit.plugin(plugin_rest_endpoint_methods_1.restEndpointMethods, plugin_paginate_rest_1.paginateRest).defaults(exports2.defaults);
-    function getOctokitOptions2(token, options) {
+    function getOctokitOptions(token, options) {
       const opts = Object.assign({}, options || {});
       const auth2 = Utils.getAuthString(token, opts);
       if (auth2) {
@@ -140024,7 +140024,7 @@ var require_utils10 = __commonJS({
       }
     };
     exports2.GitHub = core_1.Octokit.plugin(plugin_rest_endpoint_methods_1.restEndpointMethods, plugin_paginate_rest_1.paginateRest).defaults(exports2.defaults);
-    function getOctokitOptions2(token, options) {
+    function getOctokitOptions(token, options) {
       const opts = Object.assign({}, options || {});
       const auth2 = Utils.getAuthString(token, opts);
       if (auth2) {
@@ -140032,7 +140032,7 @@ var require_utils10 = __commonJS({
       }
       return opts;
     }
-    exports2.getOctokitOptions = getOctokitOptions2;
+    exports2.getOctokitOptions = getOctokitOptions;
   }
 });
 
@@ -170731,22 +170731,22 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false, proxy =
   const auth2 = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry);
   const requestOptions = makeProxyRequestOptions(proxy);
-  return new retryingOctokit(
-    githubUtils.getOctokitOptions(auth2, {
-      baseUrl: apiDetails.apiURL,
-      userAgent: `CodeQL-Action/${getActionVersion()}`,
-      log: {
-        debug: core6.debug,
-        info: core6.info,
-        warn: core6.warning,
-        error: core6.error
-      },
-      request: requestOptions,
-      retry: {
-        doNotRetry: DO_NOT_RETRY_STATUSES
-      }
-    })
-  );
+  const opts = {
+    auth: auth2 !== void 0 ? `token ${auth2}` : void 0,
+    baseUrl: apiDetails.apiURL,
+    userAgent: `CodeQL-Action/${getActionVersion()}`,
+    log: {
+      debug: core6.debug,
+      info: core6.info,
+      warn: core6.warning,
+      error: core6.error
+    },
+    request: requestOptions,
+    retry: {
+      doNotRetry: DO_NOT_RETRY_STATUSES
+    }
+  };
+  return new retryingOctokit(opts);
 }
 function getApiDetails(env = getEnv()) {
   return {
diff --git a/src/api-client.ts b/src/api-client.ts
index c734261bf..e1e5dcc0a 100644
--- a/src/api-client.ts
+++ b/src/api-client.ts
@@ -1,5 +1,6 @@
 import * as core from "@actions/core";
 import * as githubUtils from "@actions/github/lib/utils";
+import type { OctokitOptions } from "@octokit/core";
 import * as retry from "@octokit/plugin-retry";
 import { RequestRequestOptions } from "@octokit/types";
 import {
@@ -133,22 +134,24 @@ function createApiClientWithDetails(
     (allowExternal && apiDetails.externalRepoAuth) || apiDetails.auth;
   const retryingOctokit = githubUtils.GitHub.plugin(retry.retry);
   const requestOptions = makeProxyRequestOptions(proxy);
-  return new retryingOctokit(
-    githubUtils.getOctokitOptions(auth, {
-      baseUrl: apiDetails.apiURL,
-      userAgent: `CodeQL-Action/${getActionVersion()}`,
-      log: {
-        debug: core.debug,
-        info: core.info,
-        warn: core.warning,
-        error: core.error,
-      },
-      request: requestOptions,
-      retry: {
-        doNotRetry: DO_NOT_RETRY_STATUSES,
-      },
-    }),
-  );
+
+  const opts: OctokitOptions = {
+    auth: auth !== undefined ? `token ${auth}` : undefined,
+    baseUrl: apiDetails.apiURL,
+    userAgent: `CodeQL-Action/${getActionVersion()}`,
+    log: {
+      debug: core.debug,
+      info: core.info,
+      warn: core.warning,
+      error: core.error,
+    },
+    request: requestOptions,
+    retry: {
+      doNotRetry: DO_NOT_RETRY_STATUSES,
+    },
+  };
+
+  return new retryingOctokit(opts);
 }
 
 export function getApiDetails(env: ReadOnlyEnv = getEnv()): GitHubApiDetails {
diff --git a/src/codeql.test.ts b/src/codeql.test.ts
index 3237d5772..e70dcd99f 100644
--- a/src/codeql.test.ts
+++ b/src/codeql.test.ts
@@ -126,7 +126,7 @@ function mockReleaseApi({
     });
 }
 
-function mockApiDetails(apiDetails: GitHubApiDetails) {
+function mockApiDetails(apiDetails: Required<GitHubApiDetails>) {
   // This is a workaround to mock `api.getApiDetails()` since it doesn't seem to be possible to
   // mock this directly. The difficulty is that `getApiDetails()` is called locally in
   // `api-client.ts`, but `sinon.stub(api, "getApiDetails")` only affects calls to
diff --git a/src/github.ts b/src/github.ts
index 4eef113de..6350fb3f3 100644
--- a/src/github.ts
+++ b/src/github.ts
@@ -38,7 +38,7 @@ export type GitHubInstance = {
 /** Represents a {@link GitHubInstance} with a token for accessing the API. */
 export type GitHubApiDetails = GitHubInstance & {
   /** The token to use for accessing the API of the GitHub instance. */
-  auth: string;
+  auth?: string;
 };
 
 /**