fix(installer): avoid GitHub API rate-limit failures

[nadaverell]

Summary

The public bootstrap could download successfully and then fail at Fetching latest release.... Both installers discovered the latest tag through the unauthenticated GitHub REST API, whose per-IP quota is shared by users behind the same corporate NAT, VPN, or CI egress.

This changes only bootstrap release discovery. The POSIX and PowerShell installers now use the ordinary GitHub latest-release redirect and no longer depend on that REST quota.

Mechanism

Both installers request:

https://github.com/skyhook-io/radar/releases/latest

They follow the redirect, require its final destination to be the exact HTTPS Radar release-tag path, validate the tag as semantic-version syntax, and then construct the existing versioned release-asset URL. Unexpected hosts, paths, ports, credentials, query strings, fragments, or tag formats fail before a temporary directory or download is created.

• install.sh reads curl url_effective and compares the complete final URL.
• install.ps1 reads the final response URI using the respective Windows PowerShell 5.1 and PowerShell 7 response shapes.
• The asset naming, install directories, aliases, and reinstall behavior are unchanged.
• A path-filtered workflow runs ShellCheck and complete installs on Ubuntu, Windows PowerShell 5.1, and PowerShell 7. It also rejects future api.github.com discovery in either bootstrap script.

There is deliberately no fallback to releases.skyhook.io. Bootstrap only needs a tag, and using the GitHub redirect avoids adding first-party service availability or update telemetry to the initial install path. The in-product update resolver and desktop updater have different metadata requirements and are outside this change.

Publication boundary

Merging this PR does not create a Radar tag, binary release, image, chart, or package-manager artifact. However, the public get.radarhq.io endpoints serve the installer files from main, so merging is a live installer publication after the existing cache window. Rollback is a revert on main and the same cache propagation path.

How to test each request

1. Bootstrap script delivery

curl -fsS https://get.radarhq.io -o /tmp/radar-install.sh
sh -n /tmp/radar-install.sh
grep -F github.com/skyhook-io/radar/releases/latest /tmp/radar-install.sh
! grep -Fq api.github.com /tmp/radar-install.sh

Expected: HTTP 200, valid shell syntax, the browser-facing latest-release URL is present, and the REST API hostname is absent.

2. Latest-tag discovery

curl -fsSL -o /dev/null \
  -w "status=%{http_code}\neffective_url=%{url_effective}\n" \
  https://github.com/skyhook-io/radar/releases/latest

Expected: HTTP 200 and an effective URL of https://github.com/skyhook-io/radar/releases/tag/v<version>.

3. Versioned release asset

release_url=$(curl -fsSL -o /dev/null -w "%{url_effective}" \
  https://github.com/skyhook-io/radar/releases/latest)
tag=${release_url##*/}
version=${tag#v}
curl -fsSI \
  "https://github.com/skyhook-io/radar/releases/download/${tag}/radar_v${version}_darwin_arm64.tar.gz"

Expected: GitHub returns the release-asset redirect. Substitute the target OS and architecture as needed.

4. Complete installers

The Installer smoke tests workflow runs the checked-out scripts end to end on Ubuntu, Windows PowerShell 5.1, and PowerShell 7, then executes the installed kubectl-radar --version. Use a disposable host if testing the public script manually because it writes to the normal system/user install location.

Validation

• sh -n install.sh
• static no-API guard for both installers
• live latest-release redirect: HTTP 200 to v1.9.0
• live v1.9.0 macOS arm64 asset response
• make tsc
• make test
• make build
• visual test skipped: no UI delta

Scope

This PR does not change install destinations, command aliases, artifact verification, the in-product update checker, the desktop updater, or any release/publishing workflow.

Type of change

• Bug fix (non-breaking)
• Installer smoke coverage
• UI change

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 77f9bc8. Configure here.}