From 0134725c60a6ef58c270fe7c5ac17e07521c09ba Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Wed, 23 Sep 2026 15:34:35 +0800
Subject: fix: fall back to anonymous release downloads

---
 build_files/install-instruments.sh | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/build_files/install-instruments.sh b/build_files/install-instruments.sh
index 79f5066..0cf5fe6 100755
--- a/build_files/install-instruments.sh
+++ b/build_files/install-instruments.sh
@@ -48,7 +48,29 @@ github_curl() {
     args+=(--header "Authorization: Bearer $(</run/secrets/GITHUB_TOKEN)")
   fi
 
-  curl "${args[@]}" "$@"
+  if curl "${args[@]}" "$@"; then
+    return 0
+  fi
+
+  # The default release repository is public. A workflow token from another
+  # repository can be rejected by GitHub (403), even though anonymous access
+  # to the same release is allowed. Retry without credentials so a stale or
+  # cross-repository token cannot break public image builds.
+  if [[ -s /run/secrets/GITHUB_TOKEN ]]; then
+    local anonymous_args=(
+      --fail
+      --location
+      --retry 3
+      --retry-delay 2
+      --retry-max-time 60
+      --silent
+      --show-error
+    )
+    curl "${anonymous_args[@]}" "$@"
+    return $?
+  fi
+
+  return 1
 }
 
 if [[ "${INSTRUMENTS_VERSION}" == "latest" ]]; then
-- 
cgit v1.2.3