Fix validation workflow to download draft release assets using GitHub API

The gh release download command doesn't work with draft releases.
Switch to using curl with GitHub API and authentication token to download assets.
This allows validation to work properly with draft releases.

Related to #695

.github/workflows/validate-release-assets.yml

@@ -115,37 +115,41 @@ jobs:
       - name: Download all release assets
         if: steps.context.outputs.should_run == 'true'
         id: download
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           echo "Downloading all assets from release ${{ steps.context.outputs.tag }}..."
 
           mkdir -p release
           cd release
 
-          ASSETS=$(gh api "repos/${{ github.repository }}/releases/${{ steps.context.outputs.release_id }}/assets" --jq '.[].browser_download_url')
+          # Get asset info (id and name) - API works with GITHUB_TOKEN for draft releases
+          ASSETS_JSON=$(gh api "repos/${{ github.repository }}/releases/${{ steps.context.outputs.release_id }}/assets")
 
-          if [ -z "$ASSETS" ]; then
+          if [ "$(echo "$ASSETS_JSON" | jq '. | length')" -eq 0 ]; then
             echo "::error::No assets found in release"
             echo "has_assets=false" >> $GITHUB_OUTPUT
             exit 1
           fi
 
           echo "has_assets=true" >> $GITHUB_OUTPUT
-          echo "Found assets:"
+          echo "Found $(echo "$ASSETS_JSON" | jq '. | length') assets"
-          echo "$ASSETS"
 
-          echo "$ASSETS" | while read -r url; do
+          # Download each asset using the API (works with draft releases)
-            if [ -n "$url" ]; then
+          echo "$ASSETS_JSON" | jq -r '.[] | "\(.id) \(.name)"' | while read -r asset_id filename; do
-              filename=$(basename "$url")
+            echo "Downloading $filename (ID: $asset_id)..."
-              echo "Downloading $filename..."
-              gh release download "${{ steps.context.outputs.tag }}" \
-                --pattern "$filename" --dir . --clobber
 
-              if [ $? -eq 0 ]; then
+            # Use GitHub API to download with authentication
-                echo "✓ Downloaded $filename ($(du -h "$filename" | cut -f1))"
+            curl -L -H "Authorization: token $GH_TOKEN" \
-              else
+              -H "Accept: application/octet-stream" \
-                echo "::error::Failed to download $filename"
+              "https://api.github.com/repos/${{ github.repository }}/releases/assets/$asset_id" \
-                exit 1
+              -o "$filename"
-              fi
+
+            if [ $? -eq 0 ] && [ -f "$filename" ]; then
+              echo "✓ Downloaded $filename ($(du -h "$filename" | cut -f1))"
+            else
+              echo "::error::Failed to download $filename"
+              exit 1
             fi
           done