ci: pre-download network launcher to avoid API rate limits

icp-cli v0.1.0 doesn't support ICP_CLI_GITHUB_TOKEN yet, so
`icp network start` hits the unauthenticated GitHub API rate limit
(60 req/hr) when fetching the latest launcher version.

Add a shared script that uses the authenticated `gh` CLI to get the
version and downloads the binary directly. Sets
ICP_CLI_NETWORK_LAUNCHER_PATH so icp-cli skips the API call entirely.

Replaces the previous ICP_CLI_GITHUB_TOKEN approach which only works
with unreleased icp-cli builds.

Author: marc0olo

.github/workflows/hosting-photo-storage-example.yml

@@ -16,12 +16,14 @@ concurrency:
 jobs:
   hosting-photo-storage-darwin:
     runs-on: macos-15
-    env:
-      ICP_CLI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - uses: actions/checkout@v1
       - name: Provision Darwin
         run: bash .github/workflows/provision-darwin.sh
+      - name: Pre-download network launcher
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: bash .github/workflows/pre-download-launcher.sh
       - name: Hosting Photo Storage Darwin
         run: |
           pushd hosting/photo-storage
@@ -32,12 +34,14 @@ jobs:
           popd
   hosting-photo-storage-linux:
     runs-on: ubuntu-22.04
-    env:
-      ICP_CLI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - uses: actions/checkout@v1
       - name: Provision Linux
         run: bash .github/workflows/provision-linux.sh
+      - name: Pre-download network launcher
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: bash .github/workflows/pre-download-launcher.sh
       - name: Hosting Photo Storage Linux
         run: |
           pushd hosting/photo-storage

.github/workflows/hosting-static-website-example.yaml

@@ -16,12 +16,14 @@ concurrency:
 jobs:
   hosting-static-website-darwin:
     runs-on: macos-15
-    env:
-      ICP_CLI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - uses: actions/checkout@v1
       - name: Provision Darwin
         run: bash .github/workflows/provision-darwin.sh
+      - name: Pre-download network launcher
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: bash .github/workflows/pre-download-launcher.sh
       - name: Hosting Static Website Darwin
         run: |
           pushd hosting/static-website
@@ -30,12 +32,14 @@ jobs:
           popd
   hosting-static-website-linux:
     runs-on: ubuntu-22.04
-    env:
-      ICP_CLI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - uses: actions/checkout@v1
       - name: Provision Linux
         run: bash .github/workflows/provision-linux.sh
+      - name: Pre-download network launcher
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: bash .github/workflows/pre-download-launcher.sh
       - name: Hosting Static Website Linux
         run: |
           pushd hosting/static-website

.github/workflows/hosting-unity-webgl-example.yaml

@@ -16,12 +16,14 @@ concurrency:
 jobs:
   hosting-unity-webgl-darwin:
     runs-on: macos-15
-    env:
-      ICP_CLI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - uses: actions/checkout@v1
       - name: Provision Darwin
         run: bash .github/workflows/provision-darwin.sh
+      - name: Pre-download network launcher
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: bash .github/workflows/pre-download-launcher.sh
       - name: Hosting Unity Webgl Darwin
         run: |
           pushd hosting/unity-webgl-template
@@ -30,12 +32,14 @@ jobs:
           popd
   hosting-unity-webgl-linux:
     runs-on: ubuntu-22.04
-    env:
-      ICP_CLI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - uses: actions/checkout@v1
       - name: Provision Linux
         run: bash .github/workflows/provision-linux.sh
+      - name: Pre-download network launcher
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: bash .github/workflows/pre-download-launcher.sh
       - name: Hosting Unity Webgl Linux
         run: |
           pushd hosting/unity-webgl-template

.github/workflows/pre-download-launcher.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+# Pre-download the icp-cli network launcher to avoid GitHub API rate limits.
+# icp-cli v0.1.0 doesn't support ICP_CLI_GITHUB_TOKEN yet, so `icp network start`
+# hits the unauthenticated GitHub API rate limit (60 req/hr) when fetching the
+# latest launcher version. This script uses the authenticated `gh` CLI to get
+# the version, downloads the binary directly, and sets ICP_CLI_NETWORK_LAUNCHER_PATH
+# so icp-cli skips the API call entirely.
+#
+# Requires: GH_TOKEN env var (for authenticated GitHub API access via gh CLI)
+#
+# This workaround can be removed once icp-cli supports ICP_CLI_GITHUB_TOKEN.
+set -ex
+
+VERSION=$(gh release view --repo dfinity/icp-cli-network-launcher --json tagName -q .tagName)
+
+ARCH=$(uname -m)
+case "$ARCH" in
+  arm64|aarch64) ARCH="arm64" ;;
+  x86_64)        ARCH="x86_64" ;;
+  *)             echo "Unsupported architecture: $ARCH"; exit 1 ;;
+esac
+
+OS=$(uname -s)
+case "$OS" in
+  Darwin) OS="darwin" ;;
+  Linux)  OS="linux" ;;
+  *)      echo "Unsupported OS: $OS"; exit 1 ;;
+esac
+
+TARBALL="icp-cli-network-launcher-${ARCH}-${OS}-${VERSION}"
+URL="https://github.com/dfinity/icp-cli-network-launcher/releases/download/${VERSION}/${TARBALL}.tar.gz"
+
+LAUNCHER_DIR="$HOME/.icp-cli-launcher"
+mkdir -p "$LAUNCHER_DIR"
+curl -sL "$URL" | tar xz -C "$LAUNCHER_DIR"
+
+LAUNCHER_PATH="${LAUNCHER_DIR}/${TARBALL}/icp-cli-network-launcher"
+chmod +x "$LAUNCHER_PATH"
+
+echo "ICP_CLI_NETWORK_LAUNCHER_PATH=${LAUNCHER_PATH}" >> "$GITHUB_ENV"
+echo "Network launcher ${VERSION} downloaded to ${LAUNCHER_PATH}"