From e4520f70a1af30b7124f8adedbc520f2ae16a993 Mon Sep 17 00:00:00 2001
From: Chris <anzhengchao@gmail.com>
Date: Mon, 28 Sep 2026 15:13:03 +0800
Subject: [PATCH] fix(ci): verify CPU acceptance identity without gh

Use authenticated curl for the pinned release run and artifact checks on sm-standard-2.
---
 .../workflows/connect-profile-cpu-acceptance.yml  | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/connect-profile-cpu-acceptance.yml b/.github/workflows/connect-profile-cpu-acceptance.yml
index 85b5fd3ff..ccaaf34da 100644
--- a/.github/workflows/connect-profile-cpu-acceptance.yml
+++ b/.github/workflows/connect-profile-cpu-acceptance.yml
@@ -105,20 +105,27 @@ jobs:
           [[ $(git -C rustfs-source remote get-url origin) == https://github.com/rustfs/rustfs ]]
           [[ $(git -C connect-harness remote get-url origin) == https://github.com/rustfs/connect ]]
 
-          run=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}")
+          github_api() {
+            curl --fail --silent --show-error \
+              --header "Authorization: Bearer $GH_TOKEN" \
+              --header 'Accept: application/vnd.github+json' \
+              "https://api.github.com/$1"
+          }
+
+          run=$(github_api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}")
           [[ $(jq -r '.head_sha' <<<"$run") == "$SOURCE_SHA" ]]
           [[ $(jq -r '.head_branch' <<<"$run") == main ]]
           [[ $(jq -r '.head_repository.full_name' <<<"$run") == "$GITHUB_REPOSITORY" ]]
           [[ $(jq -r '.name' <<<"$run") == "Build and Release" ]]
 
           expected_job='Build RustFS (linux-x86_64-gnu, sm-standard-4, x86_64-unknown-linux-gnu, false, linux, pyroscope)'
-          jobs=$(gh api --paginate --slurp "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
+          jobs=$(github_api "repos/${GITHUB_REPOSITORY}/actions/runs/${BUILD_RUN_ID}/jobs?per_page=100")
           jq -e --arg name "$expected_job" '
-            [.[].jobs[] | select(.name == $name)] as $matches
+            [.jobs[] | select(.name == $name)] as $matches
             | (($matches | length) == 1 and $matches[0].conclusion == "success")
           ' <<<"$jobs" >/dev/null
 
-          artifact=$(gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")
+          artifact=$(github_api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}")
           [[ $(jq -r '.workflow_run.id' <<<"$artifact") == "$BUILD_RUN_ID" ]]
           [[ $(jq -r '.workflow_run.head_sha' <<<"$artifact") == "$SOURCE_SHA" ]]
           [[ $(jq -r '.name' <<<"$artifact") == rustfs-linux-x86_64-gnu-* ]]