Download assets in GitHub Actions

Use a read-only service token and inject it into the Git process without committing credentials.

Prepare the workflow

Create a service token with read access to the required LFSPush repository.
Save it as the repository or environment secret LFSPUSH_TOKEN. Save the repository ID as the variable LFSPUSH_REPOSITORY_ID.
Run this only for trusted code. A job that executes untrusted code with a secret can leak it, even when the log display masks the value.

Fetch using a temporary process configuration

This example keeps the code checkout on GitHub and fetches LFS data separately. Replace the trigger or branch for your trusted build policy. It uses the standard Git LFS client available on the runner; fail the job if that client is missing.

name: Assets
on:
  push:
    branches: [main]
permissions:
  contents: read
jobs:
  assets:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
        with:
          fetch-depth: 0
          lfs: false
          persist-credentials: false
      - name: Fetch LFSPush assets
        env:
          LFSPUSH_TOKEN: ${{ secrets.LFSPUSH_TOKEN }}
          LFSPUSH_REPOSITORY_ID: ${{ vars.LFSPUSH_REPOSITORY_ID }}
        shell: bash
        run: |
          set -euo pipefail
          git lfs version
          git lfs install --local
          basic=$(printf 'lfspush:%s' "$LFSPUSH_TOKEN" | base64 | tr -d '\n')
          echo "::add-mask::$basic"
          export GIT_CONFIG_COUNT=1
          export GIT_CONFIG_KEY_0='http.https://lfspush.dev/.extraheader'
          export GIT_CONFIG_VALUE_0="Authorization: Basic $basic"
          git config --local lfs.url "https://lfspush.dev/lfs/$LFSPUSH_REPOSITORY_ID"
          git lfs fetch --all origin
          git lfs checkout

Do not enable shell tracing. The temporary HTTP header is scoped to the LFSPush origin and is not written into the repository config. Use a write token only for a job that must upload, and keep that job separately restricted.

Validate the build

Check a known asset's hash before using it. fetch --all downloads history reachable from available refs; for a current-checkout-only build, use git lfs pull instead. Do not cache credentials alongside build outputs. If a token expires or is revoked, replace the CI secret and rerun the job.

Open your workspace