🐛 [Bug]: Secure install action host handling

[Marius Storhaug (MariusStorhaug)]

Install-PowerShell now keeps release metadata and package downloads on github.com across every runner platform. It rejects unsupported host values before making an authenticated request and avoids forwarding a GitHub Enterprise Cloud token to GitHub.com by default.

Fixed: Restrict authenticated release requests

The action validates that Host is github.com before Linux, macOS, or Windows performs a release API request. This prevents a workflow token from being sent to an arbitrary hostname.

When the action runs outside GitHub.com, Token now defaults to an empty value. Consumers can still provide a GitHub.com PAT explicitly when authenticated release lookup is required.

Changed: Align metadata and package hosts

Release metadata and installation packages now consistently come from the official PowerShell/PowerShell repository on GitHub.com. Unsupported host values fail with a clear error instead of mixing metadata from one host with packages from another.

Documentation

The input reference and secrets guidance now describe the supported host and platform-aware token default.

Validation

• ShellCheck passed for the Linux and macOS installers.
• PSScriptAnalyzer and PowerShell parser validation passed for the Windows installer.
• Actionlint passed for repository workflows.
• Action metadata parsed successfully as YAML.
• Host-rejection tests passed for Linux, macOS, and Windows.
• git diff --check passed.

[Copilot]

🟡 Changes recommended

action.yml uses an expression in inputs.Token.default, which is treated as a literal string for action input defaults and can break token handling unless the defaulting logic is moved into step-level expressions.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR hardens the Install-PowerShell composite action by forcing all release metadata and package downloads to originate from github.com, and by rejecting unsupported Host values before any authenticated GitHub API usage. It also updates action metadata and documentation to reflect the new host/token behavior across runner platforms.

Changes:

• Add early host validation in Linux/macOS/Windows installers to only allow GH_HOST=github.com, and standardize API base to https://api.github.com.
• Update action.yml to stop exporting enterprise-specific token env vars and to make token defaults platform/server aware.
• Update README inputs/secrets guidance to match the new host restriction and token-default behavior.

File summaries

File	Description
scripts/windows/install.ps1	Rejects non-github.com hosts before making release API requests; pins API base to api.github.com.
scripts/macos/install.sh	Rejects non-github.com hosts before GitHub API calls; pins API base to api.github.com.
scripts/linux/install.sh	Rejects non-github.com hosts before GitHub API calls; pins API base to api.github.com.
README.md	Documents supported host behavior and platform/server-aware token defaults.
action.yml	Updates inputs/env wiring for Host/Token behavior and removes enterprise token env forwarding.

Review details

Suppressed comments (2)

action.yml:72

• With Token set to a sentinel like auto, the Windows step should translate it to github.token only on GitHub.com and to empty elsewhere; otherwise GITHUB_TOKEN will be the literal string auto and API calls will fail.

        GITHUB_TOKEN: ${{ inputs.Token }}

action.yml:61

• With Token set to a sentinel like auto, the macOS step should translate it to github.token only on GitHub.com and to empty elsewhere; otherwise GITHUB_TOKEN/GH_TOKEN will be the literal string auto and API calls will fail.

        GITHUB_TOKEN: ${{ inputs.Token }}
        GH_TOKEN: ${{ inputs.Token }}

• Files reviewed: 5/5 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.