[fstagni]

CI fix: authenticate the artifacts API listing call

The run pilot wrapper test step lists the Pilot artifacts with an unauthenticated curl to the GitHub API — rate limited to 60 requests/hour per IP, and runner IPs are shared, so it intermittently returns an error body without the artifacts key:

jq: error (at <stdin>:1): Cannot iterate over null (null)
##[error]Process completed with exit code 5.

Seen on PR #8870 (PilotWrapper (3.14.6, devel) failed while its master twin passed in the same run, and the same leg had passed 40 minutes earlier).

The artifact download a few lines below already authenticates with ${{ secrets.GITHUB_TOKEN }}: this adds the same header to the listing call. One line, CI only.

Evidence

• Failure log of job 129226434925 (run 42636648792, PR CPU power from the HEPiX HS23 table (phase 1: record and report) #8870): jq null-iteration error immediately after the listing curl.
• The same run's master leg passed — classic per-IP rate-limit flakiness, not content.

Merge Danger

Door: two-way — adds an auth header to an API call; at worst the same flakiness as today.

Blast Radius: CI only.

[aldbr]

What about using gh?

- name: run pilot wrapper test
    env: 
        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    run: |
        export INVALID_UTF8_VAR=$'\xff'
        cp tests/Integration/WorkloadManagementSystem/Test_GenerateAndExecutePilotWrapper.py .
        eval "$(conda shell.bash hook)" && conda activate python_${{ matrix.python }}
        gh run download -R DIRACGrid/Pilot -n Pilot_${{ matrix.pilot_branch }} -D ${{ matrix.pilot_branch }}/pilot
        python Test_GenerateAndExecutePilotWrapper.py file://${{ github.workspace }}/src/DIRAC/WorkloadManagementSystem/Utilities/PilotWrapper.py file://${{ github.workspace }}/${{ matrix.pilot_branch }}

[fstagni]

Implemented on this branch (and folded into the rel-v8r0/rel-v9r0 backports): the whole listing+download+unzip block is replaced by gh run download -R DIRACGrid/Pilot -n Pilot_${{ matrix.pilot_branch }} -D ... with GH_TOKEN in the step env — authenticated, no rate limits, and it extracts the artifact directly, so the zip handling and the file-type check go away. Verified locally that gh run download -n locates the named artifact even when the most recent runs of the Pilot repo don't produce it (the artifacts come from the Pilot Nightly).