From 73c64d149fb60850013324c9bff13eb404e45759 Mon Sep 17 00:00:00 2001
From: Brian Normington <bnormington@goodwaygroup.com>
Date: Sat, 4 Jul 2026 16:55:13 -0700
Subject: [PATCH] feat: github pat for authenticated install kustomize requests

---
 src/commands/deploy-with-kustomize.yml | 18 +++++++++++++++++-
 src/jobs/deploy-with-kustomize.yml     |  7 +++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/src/commands/deploy-with-kustomize.yml b/src/commands/deploy-with-kustomize.yml
index 62d5d5f..2aaf06d 100644
--- a/src/commands/deploy-with-kustomize.yml
+++ b/src/commands/deploy-with-kustomize.yml
@@ -21,6 +21,13 @@ parameters:
   notification-channel:
     type: string
     default:
+  github-pat-env:
+    type: env_var_name
+    default: GITHUB_PAT
+    description: |
+      Name of a CircleCI env var containing a GitHub PAT.
+      When set and non-empty, the install script is downloaded with authentication.
+      When unset or empty, downloads without auth.
 
 steps:
   - checkout
@@ -32,7 +39,16 @@ steps:
   - run:
       name: 'Install Kustomize'
       command: |
-        curl -s "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh" | bash
+        INSTALL_URL="https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"
+        PAT="${<< parameters.github-pat-env >>}"
+
+        if [ -n "$PAT" ]; then
+          echo "Downloading install_kustomize.sh with GitHub authentication (<< parameters.github-pat-env >>)"
+          curl -sf -H "Authorization: Bearer ${PAT}" "$INSTALL_URL" | bash
+        else
+          echo "Downloading install_kustomize.sh without authentication (<< parameters.github-pat-env >> not set)"
+          curl -sf "$INSTALL_URL" | bash
+        fi
         sudo mv kustomize /usr/local/bin
 
   - run:
diff --git a/src/jobs/deploy-with-kustomize.yml b/src/jobs/deploy-with-kustomize.yml
index f307ea1..fb28e79 100644
--- a/src/jobs/deploy-with-kustomize.yml
+++ b/src/jobs/deploy-with-kustomize.yml
@@ -38,6 +38,11 @@ parameters:
   cluster-name:
     type: string
     default: ''
+  github-pat-env:
+    type: env_var_name
+    default: GITHUB_PAT
+    description: |
+      Name of a CircleCI env var containing a GitHub PAT for downloading install_kustomize.sh.
 
 executor:
   name: python-default
@@ -57,6 +62,7 @@ steps:
             post-deploy-steps: << parameters.post-deploy-steps >>
             deployment-resource-name: << parameters.deployment-resource-name >>
             notification-channel: << parameters.notification-channel >>
+            github-pat-env: << parameters.github-pat-env >>
   - when:
       condition: << parameters.cluster-name >>
       steps:
@@ -69,3 +75,4 @@ steps:
             post-deploy-steps: << parameters.post-deploy-steps >>
             deployment-resource-name: << parameters.deployment-resource-name >>
             notification-channel: << parameters.notification-channel >>
+            github-pat-env: << parameters.github-pat-env >>