[BUG]: octokit.repo.getReleaseAsset download binary content failing

[amber-beasley-liatrio]

What happened?

When using as documented, observed content blocked errors instead of expected return.

The expectation is that the contents of the asset would be streamed if we use Octokit to hit this api endpoint where GitHub traditionally blocks CORS.

I am using octokit in .tsx files and attempting to get the contents of a json file from the release asset specific as a particular id.

const assetResponse = await octokit.rest.repos.getReleaseAsset({
            owner,
            repo,
            asset_id: resultsAsset.id,
              headers: {
                accept: "application/octet-stream",
            }
});

Versions

octokit/rest v21.0.2, Node v20.16.0

Relevant log output

Preflight response is not successful. Status code: 405
Fetch API cannot load ... due to access control checks.

Code of Conduct

• I agree to follow this project's Code of Conduct

[github-actions]

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

[wolfy1339]

A 405 error is supposed to indicate that the method (GET,POST, etc) is not allowed.
In this case, this is supposed to be a simple GET request.

Octokit doesn't do streams by default, it will try to resolve to text.

The docs are misleading in that sense because they are generic and don't necessarily apply to Octokit.

We simply take GitHub's OpenAPI spec and use it to write the documentation using the provided annotations and descriptions for each route of the API.

This endpoint is supposed to redirect you to the download location for the release asset.
Unless something is overriding that, Octokit should be following redirects automatically

In order to use streams in NodeJS instead of parsing the body, set the request.parseSuccessResponseBody to false.

import { Octokit } from "@octokit/rest";

const octokit = new Octokit();

octokit.rest.repos.getReleaseAsset({
  owner,
  repo,
  asset_id: resultsAsset.id,
  headers: {
    accept: "application/octet-stream",
  },
  request: {
    parseSuccessResponseBody: false
  }
})

Octokit is not impervious to CORS issues on GitHub's end. There isn't anything we can do, it has to be fixed by GitHub.

[amber-beasley-liatrio]

Thanks for the response!

Tested with the following but still seeing the same error in the browser.

const assetResponse = await octokit.rest.repos.getReleaseAsset({
            owner,
            repo,
            asset_id: resultsAsset.id,
            headers: {
                accept: "application/octet-stream",
            },
            request: {
                parseSuccessResponseBody: false
            }
});

Will look for other workarounds.

[amber-beasley-liatrio]

I'll also see if I can find a GitHub issue or discussion to report octokit as impacted.

the non-download binary works, but not the binary download

const assetResponse = await octokit.rest.repos.getReleaseAsset({
            owner,
            repo,
            asset_id: resultsAsset.id,
});

(this returns metadata about asset as expected)