[imanimanyara]

Summary

#30 added a credential for private cross-org dependencies and authenticated one of the two routes composer can take. laranail/sis-wrapper then failed on the other:

The "https://api.github.com/repos/simtabi/sis-sdk/zipball/637e562…" file
could not be downloaded (HTTP/2 404 ): {"message":"Not Found", …}

The token minted correctly and the guard passed — the log shows "Inputs 'owner' and 'repositories' are set. Creating token". The clone rewrite simply was not the path composer used.

Both paths, because the caller picks which one

Which route composer takes is decided by the dependency's own composer.json, not by this workflow:

route	how it fetches	what authenticates it
dist (default)	GET api.github.com/repos/<o>/<r>/zipball/<sha>	COMPOSER_AUTH → github-oauth
source (no-api)	git clone of the plain https URL	git config url.insteadOf → x-access-token:<token>

#30 set only the second. Setting only one fixes only half the callers — and the half it misses fails with an error naming neither authentication nor the token. A private zipball answers 404, which reads as "no such release" rather than "not authorised", so the symptom points away from the cause. That is the same shape as the original GITHUB_TOKEN failure this whole thread started from.

Verified

• COMPOSER_AUTH= written at 2 sites, git config --global url. at 2 sites — one pair per composer-installing job (composer-audit, osv-scan). secret-scan installs nothing.
• YAML parses; all three jobs intact.
• The token is the per-run installation token, written to GITHUB_ENV inside the job and revoked at job end. Nothing long-lived is stored, and the value never appears in a log — Actions masks it.

Follow-up

laranail/sis-wrapper#51 re-runs against this.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.