fix(install): harden installer and CI

Resolve VERSION against real release tags (try v-prefix and bare),
optional GITHUB_TOKEN/GH_TOKEN for the releases/latest API, defensive
checksum parsing, install/tar preflight, PATH dir normalization, and
README notes. Add a shellcheck job for scripts/install.sh.

Made-with: Cursor

Author: bschellenberger2600

.github/workflows/ci.yml

@@ -10,6 +10,16 @@ permissions:
   contents: read
 
 jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: ShellCheck install.sh
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y shellcheck
+          shellcheck scripts/install.sh
+
   lint:
     runs-on: ubuntu-latest
     steps:
@@ -44,7 +54,7 @@ jobs:
 
   uat:
     runs-on: ubuntu-latest
-    needs: [lint, test]
+    needs: [shellcheck, lint, test]
     steps:
       - uses: actions/checkout@v4
 

README.md

@@ -90,6 +90,8 @@ First-party install script (same idea as [`git-fire/scripts/install.sh`](https:/
 
 The `main` URL below always runs the installer script from the latest commit on that branch, while the binary itself comes from the latest GitHub release (or from `VERSION` if you set it). That is convenient for copy-paste installs, but it means the script can drift ahead of any given release. For a fully pinned install, use the release tag in the URL (as in each release’s notes) and set `VERSION` to the same tag.
 
+For repeated automation against the GitHub API (resolving `latest`), set **`GITHUB_TOKEN`** or **`GH_TOKEN`** so authenticated rate limits apply. `VERSION` may be a bare semver (`0.9.1`); the installer tries the `v`-prefixed release tag first, then the exact string you passed.
+
 ```bash
 curl -fsSL https://raw.githubusercontent.com/git-fire/git-rain/main/scripts/install.sh | bash
 ```
@@ -100,10 +102,13 @@ Pin a version or install directory (environment variables must apply to `bash`,
 curl -fsSL https://raw.githubusercontent.com/git-fire/git-rain/main/scripts/install.sh | VERSION=v0.9.1 INSTALL_DIR=/usr/local/bin bash
 ```
 
-If your shell does not already include `~/.local/bin` on `PATH`, add it (the installer prints a reminder). Example for bash:
+If your shell does not already include `~/.local/bin` on `PATH`, add it (the installer prints a reminder). Example for bash (skips the line if `.local/bin` is already mentioned in `~/.bashrc`):
 
 ```bash
-echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc && source ~/.bashrc
+if ! grep -qF '.local/bin' ~/.bashrc 2>/dev/null; then
+  echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
+fi
+source ~/.bashrc
 ```
 
 Windows is not supported by this script — use **WinGet** or download a `.zip` from Releases.

scripts/install.sh

@@ -5,9 +5,10 @@ set -euo pipefail
 # Usage:
 #   curl -fsSL https://raw.githubusercontent.com/git-fire/git-rain/main/scripts/install.sh | bash
 # Optional env vars:
-#   VERSION=v0.9.1
+#   VERSION=v0.9.1   (must match a GitHub release tag; bare semver like 0.9.1 tries v0.9.1 first)
 #   INSTALL_DIR=$HOME/.local/bin
 #   REPO=git-fire/git-rain
+#   GITHUB_TOKEN or GH_TOKEN  (optional; increases api.github.com rate limits for "latest" resolution)
 
 REPO="${REPO:-git-fire/git-rain}"
 INSTALL_DIR="${INSTALL_DIR:-$HOME/.local/bin}"
@@ -27,9 +28,13 @@ need_cmd() {
   command -v "$1" >/dev/null 2>&1 || fail "required command not found: $1"
 }
 
+github_token() {
+  printf '%s' "${GITHUB_TOKEN:-${GH_TOKEN:-}}"
+}
+
 download_to() {
-  src="$1"
-  dst="$2"
+  local src="$1"
+  local dst="$2"
   if command -v curl >/dev/null 2>&1; then
     curl -fsSL "$src" -o "$dst"
   elif command -v wget >/dev/null 2>&1; then
@@ -39,8 +44,38 @@ download_to() {
   fi
 }
 
+fetch_github_api() {
+  local url="$1"
+  if command -v curl >/dev/null 2>&1; then
+    local token
+    token="$(github_token)"
+    if [ -n "$token" ]; then
+      curl -fsSL \
+        -H "Authorization: Bearer ${token}" \
+        -H "Accept: application/vnd.github+json" \
+        -H "X-GitHub-Api-Version: 2022-11-28" \
+        "$url"
+    else
+      curl -fsSL "$url"
+    fi
+  elif command -v wget >/dev/null 2>&1; then
+    local token
+    token="$(github_token)"
+    if [ -n "$token" ]; then
+      wget -qO- \
+        --header="Authorization: Bearer ${token}" \
+        --header="Accept: application/vnd.github+json" \
+        "$url"
+    else
+      wget -qO- "$url"
+    fi
+  else
+    fail "curl or wget is required"
+  fi
+}
+
 sha256_file() {
-  target="$1"
+  local target="$1"
   if command -v sha256sum >/dev/null 2>&1; then
     sha256sum "$target" | awk '{print $1}'
   elif command -v shasum >/dev/null 2>&1; then
@@ -50,6 +85,23 @@ sha256_file() {
   fi
 }
 
+# First field is digest; remainder is filename (GNU text "  " or binary " *").
+checksum_for_file() {
+  local sums="$1"
+  local want="$2"
+  awk -v want="$want" '
+    {
+      hash = $1
+      name = $0
+      sub(/^[^[:space:]]+[[:space:]]+/, "", name)
+      sub(/^\*/, "", name)
+      if (name == want) {
+        print hash
+        exit
+      }
+    }' "$sums"
+}
+
 normalize_os() {
   local raw_os
   raw_os="$(uname -s | tr '[:upper:]' '[:lower:]')"
@@ -77,24 +129,73 @@ normalize_arch() {
   esac
 }
 
-resolve_version() {
+resolve_raw_version_tag() {
   if [ -n "$VERSION" ]; then
     printf '%s\n' "$VERSION"
     return
   fi
 
+  local api_url response tag
   api_url="https://api.github.com/repos/$REPO/releases/latest"
+  response="$(fetch_github_api "$api_url")"
+  tag="$(printf '%s\n' "$response" | awk -F '"' '/"tag_name"[[:space:]]*:/ {print $4; exit}')"
+  [ -n "$tag" ] || fail "could not resolve latest release tag from GitHub API"
+  printf '%s\n' "$tag"
+}
+
+release_archive_url() {
+  local tag="$1"
+  local archive_name="$2"
+  printf 'https://github.com/%s/releases/download/%s/%s\n' "$REPO" "$tag" "$archive_name"
+}
+
+# Return 0 if a release asset URL responds with success (follows redirects).
+release_asset_head_ok() {
+  local url="$1"
+  local code
   if command -v curl >/dev/null 2>&1; then
-    response="$(curl -fsSL "$api_url")"
+    code="$(curl -gfsSIL -L -o /dev/null -w "%{http_code}" "$url" 2>/dev/null || printf '%s' "000")"
+    [ "$code" = "200" ]
   elif command -v wget >/dev/null 2>&1; then
-    response="$(wget -qO- "$api_url")"
+    wget --spider -q -L "$url"
   else
-    fail "curl or wget is required"
+    false
   fi
+}
 
-  tag="$(printf '%s\n' "$response" | awk -F '"' '/"tag_name"[[:space:]]*:/ {print $4; exit}')"
-  [ -n "$tag" ] || fail "could not resolve latest release tag from GitHub API"
-  printf '%s\n' "$tag"
+# Map user input or "latest" API tag to the GitHub release tag that owns the archive.
+pick_release_tag() {
+  local raw="$1"
+  local -a candidates=()
+  case "$raw" in
+    v*)
+      candidates=("$raw" "${raw#v}")
+      ;;
+    *)
+      candidates=("v${raw}" "${raw}")
+      ;;
+  esac
+
+  local tag archive_version archive_name url
+  for tag in "${candidates[@]}"; do
+    archive_version="${tag#v}"
+    archive_name="${BINARY_NAME}_${archive_version}_${os}_${arch}.tar.gz"
+    url="$(release_archive_url "$tag" "$archive_name")"
+    if release_asset_head_ok "$url"; then
+      printf '%s\n' "$tag"
+      return
+    fi
+  done
+
+  fail "no GitHub release matched VERSION=${raw} for ${os}/${arch} (check tag spelling and that this platform is published)"
+}
+
+normalize_path_dir() {
+  local d="$1"
+  while [ "${#d}" -gt 1 ] && [ "${d%/}" != "$d" ]; do
+    d="${d%/}"
+  done
+  printf '%s\n' "$d"
 }
 
 install_binary() {
@@ -130,7 +231,8 @@ install_binary() {
 }
 
 path_has_dir() {
-  local dir="$1"
+  local dir
+  dir="$(normalize_path_dir "$1")"
   case ":${PATH:-}:" in
     *":${dir}:"*) return 0 ;;
     *) return 1 ;;
@@ -139,14 +241,15 @@ path_has_dir() {
 
 # Preflight: fail fast before downloads (curl/wget checked in download_to).
 need_cmd tar
+need_cmd install
 os="$(normalize_os)"
 arch="$(normalize_arch)"
-version_tag="$(resolve_version)"
+version_tag="$(pick_release_tag "$(resolve_raw_version_tag)")"
 version="${version_tag#v}"
 
 archive_name="${BINARY_NAME}_${version}_${os}_${arch}.tar.gz"
-archive_url="https://github.com/$REPO/releases/download/${version_tag}/${archive_name}"
-checksums_url="https://github.com/$REPO/releases/download/${version_tag}/checksums.txt"
+archive_url="$(release_archive_url "$version_tag" "$archive_name")"
+checksums_url="$(release_archive_url "$version_tag" "checksums.txt")"
 
 log "installing ${BINARY_NAME} ${version_tag} for ${os}/${arch}"
 
@@ -162,7 +265,7 @@ download_to "$archive_url" "$archive_path"
 log "downloading checksum file"
 download_to "$checksums_url" "$checksums_path"
 
-expected_sum="$(awk -v file="$archive_name" '$2 == file {print $1; exit}' "$checksums_path")"
+expected_sum="$(checksum_for_file "$checksums_path" "$archive_name")"
 [ -n "$expected_sum" ] || fail "could not find checksum entry for $archive_name (no asset for this OS/arch on this release?)"
 
 actual_sum="$(sha256_file "$archive_path")"