fix(ci): use gh with token for xlings download (fix API rate limit)

curl without auth token hits GitHub API rate limits on CI runners.
Restore gh-based download with github.token passed as input to the
setup-toolchain action.

Author: Sunrisepeak

.github/actions/setup-toolchain/action.yml

@@ -1,34 +1,43 @@
 name: Setup C++23 Toolchain
 description: Install xlings and project dependencies declared in .xlings.json
 
+inputs:
+  token:
+    description: 'GitHub token for downloading xlings releases'
+    required: true
+
 runs:
   using: composite
   steps:
     - name: Install xlings (linux)
       if: runner.os == 'Linux'
       shell: bash
       run: |
-        LATEST_VERSION=$(curl -s https://api.github.com/repos/d2learn/xlings/releases/latest | grep '"tag_name"' | sed 's/.*"tag_name": *"\([^"]*\)".*/\1/')
+        LATEST_VERSION=$(gh release view --repo d2learn/xlings --json tagName -q '.tagName')
         VERSION_NUM=${LATEST_VERSION#v}
         TARBALL="xlings-${VERSION_NUM}-linux-x86_64.tar.gz"
-        curl -sL "https://github.com/d2learn/xlings/releases/download/${LATEST_VERSION}/${TARBALL}" -o "/tmp/${TARBALL}"
+        gh release download "$LATEST_VERSION" --repo d2learn/xlings --pattern "$TARBALL" --dir /tmp
         mkdir -p "$HOME/.xlings"
-        tar -xzf "/tmp/${TARBALL}" -C "$HOME/.xlings" --strip-components=1
+        tar -xzf "/tmp/$TARBALL" -C "$HOME/.xlings" --strip-components=1
         "$HOME/.xlings/bin/xlings" self install
+      env:
+        GH_TOKEN: ${{ inputs.token }}
 
     - name: Install xlings (macos)
       if: runner.os == 'macOS'
       shell: bash
       run: |
-        LATEST_VERSION=$(curl -s https://api.github.com/repos/d2learn/xlings/releases/latest | grep '"tag_name"' | sed 's/.*"tag_name": *"\([^"]*\)".*/\1/')
+        LATEST_VERSION=$(gh release view --repo d2learn/xlings --json tagName -q '.tagName')
         VERSION_NUM=${LATEST_VERSION#v}
         ARCH=$(uname -m)
         TARBALL="xlings-${VERSION_NUM}-macosx-${ARCH}.tar.gz"
-        curl -sL "https://github.com/d2learn/xlings/releases/download/${LATEST_VERSION}/${TARBALL}" -o "/tmp/${TARBALL}"
+        gh release download "$LATEST_VERSION" --repo d2learn/xlings --pattern "$TARBALL" --dir /tmp
         mkdir -p "$HOME/.xlings"
-        tar -xzf "/tmp/${TARBALL}" -C "$HOME/.xlings" --strip-components=1
+        tar -xzf "/tmp/$TARBALL" -C "$HOME/.xlings" --strip-components=1
         xattr -dr com.apple.quarantine "$HOME/.xlings" 2>/dev/null || true
         "$HOME/.xlings/bin/xlings" self install
+      env:
+        GH_TOKEN: ${{ inputs.token }}
 
     - name: Install xlings (windows)
       if: runner.os == 'Windows'

.github/workflows/ci.yml

@@ -85,6 +85,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-toolchain
+        with:
+          token: ${{ github.token }}
 
       - name: Configure (linux)
         if: runner.os == 'Linux'