Refactor: Replace GitHub token verification script and update workflow steps

.gitea/workflows/test-python.yml

@@ -0,0 +1,42 @@
+name: Test Python CLI
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '.gitea/workflows/test-python.yml'
+      - 'python/**'
+
+jobs:
+  test-python:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.14'
+
+      - name: Check Authentication
+        run: python3 python/install_github_release.py --check-token -k "${{ secrets.GH_TOKEN }}"
+
+      - name: Go ACME Setup
+        run: python3 python/install_github_release.py go-acme/lego -t archive -k "${{ secrets.GH_TOKEN }}" -p /tmp/python-cli-test
+
+      - name: Setup Hugo
+        run: python3 python/install_github_release.py gohugoio/hugo -f '~hugo_extended_[^a-z].*{{SYSTEM}}-{{ARCH}}' -t archive -k "${{ secrets.GH_TOKEN }}" -p /tmp/python-cli-test
+
+      - name: Setup RClone
+        run: python3 python/install_github_release.py rclone/rclone -t archive -k "${{ secrets.GH_TOKEN }}" -p /tmp/python-cli-test
+
+      - name: Verify Installation
+        run: |
+          echo "Verifying installed tools..."
+          printf "\nGo ACME Lego:\n"
+          /tmp/python-cli-test/lego -v
+          printf "\nHugo:\n"
+          /tmp/python-cli-test/hugo version
+          printf "\nRClone:\n"
+          /tmp/python-cli-test/rclone version

.github/workflows/test-python.yml

@@ -0,0 +1,42 @@
+name: Test Python CLI
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '.github/workflows/test-python.yml'
+      - 'python/**'
+
+jobs:
+  test-python:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.14'
+
+      - name: Check Authentication
+        run: python3 python/install_github_release.py --check-token -k "${{ github.token }}"
+
+      - name: Go ACME Setup
+        run: python3 python/install_github_release.py go-acme/lego -t archive -k "${{ github.token }}" -p /tmp/python-cli-test
+
+      - name: Setup Hugo
+        run: python3 python/install_github_release.py gohugoio/hugo -f '~hugo_extended_[^a-z].*{{SYSTEM}}-{{ARCH}}' -t archive -k "${{ github.token }}" -p /tmp/python-cli-test
+
+      - name: Setup RClone
+        run: python3 python/install_github_release.py rclone/rclone -t archive -k "${{ github.token }}" -p /tmp/python-cli-test
+
+      - name: Verify Installation
+        run: |
+          echo "Verifying installed tools..."
+          printf "\nGo ACME Lego:\n"
+          /tmp/python-cli-test/lego -v
+          printf "\nHugo:\n"
+          /tmp/python-cli-test/hugo version
+          printf "\nRClone:\n"
+          /tmp/python-cli-test/rclone version

.github/workflows/test.yml

@@ -20,15 +20,12 @@ jobs:
 
       - name: Check Authentication
         uses: ./check-token
-        with:
-          token: ${{ secrets.GH_TOKEN }}
 
       - name: Go ACME Setup
         uses: ./
         with:
           repository: 'go-acme/lego'
           file-type: 'archive'
-          token: ${{ secrets.GH_TOKEN }}
           update-cache: 'always'
 
       - name: Setup Hugo
@@ -37,7 +34,6 @@ jobs:
           repository: 'gohugoio/hugo'
           file-name: '~hugo_extended_[^a-z].*{{SYSTEM}}-{{ARCH}}'
           file-type: 'archive'
-          token: ${{ secrets.GH_TOKEN }}
           update-cache: 'always'
 
       - name: Setup RClone
@@ -45,7 +41,6 @@ jobs:
         with:
           repository: 'rclone/rclone'
           file-type: 'archive'
-          token: ${{ secrets.GH_TOKEN }}
           update-cache: 'always'
 
       - name: Verify Installation

python/install_github_release.py

@@ -79,6 +79,13 @@ def fetch_latest_release(repository, token=None):
         raise RuntimeError(f'Failed to fetch latest release for {repository}: {error.reason}. {body}') from error
 
 
+def check_github_token(token):
+    """Verify a GitHub token by fetching the latest release of actions/checkout."""
+    print('Verifying GitHub token...')
+    fetch_latest_release('actions/checkout', token)
+    print('Success: The provided GitHub token is valid and has sufficient permissions to access public repositories.')
+
+
 def download_asset(url, dest_path, token=None):
     """Download a release asset from url and write it to dest_path."""
     headers = {'User-Agent': 'install-github-release-cli'}
@@ -327,10 +334,72 @@ def install_github_release(repository, *, list_only=False, app_name=None, file_n
         shutil.rmtree(temp_dir, ignore_errors=True)
 
 
+BASH_COMPLETION = '''\
+_install_github_release_complete() {
+    local cur prev opts
+    COMPREPLY=()
+    cur="${COMP_WORDS[COMP_CWORD]}"
+    prev="${COMP_WORDS[COMP_CWORD-1]}"
+    opts="--dry-run -l --list -a --app-name -f --file-name -b --binary-name -t --file-type -p --install-path -o --output-directory -j --releases-json --system --arch -k --token -d --debug --completion --check-token -h --help"
+
+    case "$prev" in
+        -t|--file-type)
+            COMPREPLY=( $(compgen -W "archive package linux macos targz" -- "$cur") )
+            return 0
+            ;;
+        --completion)
+            COMPREPLY=( $(compgen -W "bash zsh" -- "$cur") )
+            return 0
+            ;;
+        -p|--install-path|-o|--output-directory)
+            COMPREPLY=( $(compgen -d -- "$cur") )
+            return 0
+            ;;
+    esac
+
+    COMPREPLY=( $(compgen -W "$opts" -- "$cur") )
+}
+complete -F _install_github_release_complete install_github_release.py
+'''
+
+ZSH_COMPLETION = '''\
+#compdef install_github_release.py
+compdef _install_github_release install_github_release.py
+
+_install_github_release() {
+    local -a options
+    options=(
+        '(-l --list)'{-l,--list}'[List available assets from latest release and exit]::repository:'
+        '(-a --app-name)'{-a,--app-name}'[Application name]:name:'
+        '(-f --file-name)'{-f,--file-name}'[Asset file name or regex pattern]:name:'
+        '(-b --binary-name)'{-b,--binary-name}'[Binary name]:name:'
+        '(-t --file-type)'{-t,--file-type}'[Asset type selector]:type:(archive package linux macos targz)'
+        '(-p --install-path)'{-p,--install-path}'[Custom installation directory]:path:_files -/'
+        '(-o --output-directory)'{-o,--output-directory}'[Download-only output directory]:path:_files -/'
+        '(-j --releases-json)'{-j,--releases-json}'[Download latest release JSON only]'
+        '--system[Override detected system]:system:'
+        '--arch[Override detected architecture]:arch:'
+        '(-k --token)'{-k,--token}'[GitHub token]:token:'
+        '(-d --debug)'{-d,--debug}'[Enable debug logging]'
+        '--dry-run[Run in test mode]'
+        '--completion[Print shell completion script]:shell:(bash zsh)'
+        '--check-token[Verify the GitHub token against actions/checkout and exit]'
+        '(-h --help)'{-h,--help}'[Show help message]'
+        '1:repository:'
+    )
+    _arguments -s $options
+}
+
+# don't run the completion function when being source-ed or eval-ed
+if [ "$funcstack[1]" = "_install_github_release" ]; then
+    _install_github_release
+fi
+'''
+
+
 def main():
     """Parse command-line arguments and run install_github_release, reporting errors via the exit code."""
     parser = argparse.ArgumentParser(
-        prog='install-github-release',
         usage='%(prog)s [options] <repository>',
         allow_abbrev=False,
     )
@@ -351,8 +420,26 @@ def main():
     parser.add_argument('--arch', metavar='name', help='Override detected architecture for asset matching')
     parser.add_argument('-k', '--token', metavar='token', help='GitHub token')
     parser.add_argument('-d', '--debug', action='store_true', help='Enable debug logging')
+    parser.add_argument('--completion', choices=['bash', 'zsh'], help='Print a shell completion script and exit')
+    parser.add_argument('--check-token', action='store_true', help='Verify the GitHub token against actions/checkout and exit')
     args = parser.parse_args()
 
+    if args.completion:
+        print(BASH_COMPLETION if args.completion == 'bash' else ZSH_COMPLETION, end='')
+        sys.exit(0)
+
+    if args.check_token:
+        token = args.token or os.environ.get('GITHUB_TOKEN')
+        if not token:
+            print('Error: No GitHub token provided as an argument or found in GITHUB_TOKEN environment variable.', file=sys.stderr)
+            sys.exit(1)
+        try:
+            check_github_token(token)
+        except Exception as error:
+            print(f'Error: {error}', file=sys.stderr)
+            sys.exit(1)
+        sys.exit(0)
+
     list_repo = args.list if isinstance(args.list, str) else None
     repository = list_repo or args.repository
     if not repository: