Binary download is unauthenticated, so it hits the 60/hour anonymous rate limit and 403s

What happens

Intermittently, the action fails before scanning anything:

Downloading asset: docker-scout-action_linux_amd64 (179.2 MB)
##[error]Unexpected HTTP response: 403

No image is scanned and no finding is reported, so the job goes red for a reason unrelated to the code under test. A re-run usually clears it.

Why

In src/index.js, downloadRelease() builds an authenticated client and then does not use it for the download:

const octokit = github.getOctokit(core.getInput('github-token'))   // authenticated

release = await octokit.rest.repos.getReleaseByTag({ ... })        // authenticated

await tc.downloadTool(asset.url, binary, undefined, {              // <-- auth: undefined
    accept: 'application/octet-stream',
})

The third parameter of @actions/tool-cache's downloadTool is auth. It is undefined, so the asset is fetched anonymously from api.github.com, which puts it on the 60-requests-per-hour-per-IP budget:

$ curl -sI -H "Accept: application/octet-stream" \
    https://api.github.com/repos/docker/scout-action/releases/assets/493034676
HTTP/2 302
x-ratelimit-limit: 60
x-ratelimit-resource: core

Authenticated, that limit is 5,000/hour. GitHub-hosted runners come from a shared address pool, so the anonymous budget is spent collectively by everyone using this action — which is consistent with the failures being bursty and with a re-run (a different runner) succeeding.

It also means retrying inside the same job does not help: the retry runs from the same address against the same exhausted budget.

Suggested fix

Pass the token the action already accepts (github-token, default ${{ github.token }}):

const token = core.getInput('github-token')
await tc.downloadTool(asset.url, binary, `token ${token}`, {
    accept: 'application/octet-stream',
})

Version

docker/scout-action@v1.24.0 (pinned by digest, 7c6b6c3f7844478ace1ffd4e7aef649053d1f87d), ubuntu-24.04 runners.

Happy to open a PR if that would be useful.

Start in src/index.js at downloadRelease(), then inspect how the authenticated client and github-token input are used around tc.downloadTool. Confirm the release asset download uses the existing token and that the action no longer fails with the reported anonymous-rate-limit 403 before scanning.