[renovate]

This PR contains the following updates:

Package	Update	Change
aquaproj/aqua	patch	v2.66.0 → v2.66.1

---

Release Notes

aquaproj/aqua

v2.66.1

Compare Source

Bug Fixes

#​5577 GitHub Artifact Attestations: Pass GitHub access tokens from the keyring or ghtkn to GitHub CLI

aqua verifies GitHub Artifact Attestations by running GitHub CLI (gh attestation verify).
Before, aqua didn't pass GitHub access tokens managed by the keyring or ghtkn to GitHub CLI, so GitHub CLI called GitHub API without authentication unless GH_TOKEN, GITHUB_TOKEN, AQUA_GITHUB_TOKEN, or gh auth login was used.
So you couldn't verify packages of private repositories with the keyring or ghtkn, and the verification of public packages could fail because of the rate limit.

aqua now tries GitHub access tokens in order until the verification succeeds.

If GitHub CLI has its own credential (GH_TOKEN, GITHUB_TOKEN, or gh auth login):

1. GitHub CLI's own credential
2. AQUA_GITHUB_TOKEN
3. The access token managed by the keyring
4. The access token managed by ghtkn

Otherwise:

1. AQUA_GITHUB_TOKEN
2. The access token managed by the keyring
3. The access token managed by ghtkn
4. No access token

The same access token isn't tried twice even if it comes from different sources.
Access tokens which are invalid or hit the rate limit aren't used for the rest of the process.

If the verification fails, the error has the link to the error code 008, which describes the causes and solutions.

Behavior changes

The verification isn't skipped on authentication errors anymore

Before, aqua skipped the verification if the output of GitHub CLI contained gh auth login or set the GH_TOKEN environment variable.
Now the verification fails, because skipping the verification installs packages without verifying them.

In practice, this rarely affects you.
aqua runs GitHub CLI with GH_HOST=github.com (#​4038), so GitHub CLI skips its authentication check and can verify attestations without an access token.
Rate limit errors weren't skipped before either.

If the verification fails because of the rate limit, please pass a GitHub access token by GITHUB_TOKEN, AQUA_GITHUB_TOKEN, the keyring, or ghtkn.
On GitHub Actions, you can pass ${{ github.token }}.

- run: aqua i
  env:
    GITHUB_TOKEN: ${{ github.token }}

If you can't verify packages, you can disable the verification explicitly, though we don't recommend it.

export AQUA_DISABLE_GITHUB_ARTIFACT_ATTESTATION=true

Precedence of AQUA_GITHUB_TOKEN

If GitHub CLI has its own credential, it now takes precedence over AQUA_GITHUB_TOKEN.
Before, AQUA_GITHUB_TOKEN overrode the credential stored by gh auth login.
If GitHub CLI's own credential fails, AQUA_GITHUB_TOKEN is tried next, so the result is the same in most cases.

The exception is HTTP 404 for a private package without private: true.
aqua treats such a package as public and fails immediately without trying other access tokens.
Please set private: true to private packages.

Retries

Before, aqua retried any failure of GitHub CLI up to 5 times.
Now aqua retries only temporary failures such as HTTP 5xx and network errors, and fails immediately on failures it doesn't recognize.

Others

#​5578 #​5585 #​5587 ci: Update workflows

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.