Curl是一种方法，but the github-cli has some built-in features that make it a lot easier。

echo $GITHUB_TOKEN | gh auth login

# Download the Source.zip
gh release download v1.0 --archive

# Download an attachment by name or wildcard
gh release download v1.0 --pattern file.zip

对于CURL，您还可以调用以下API

https://api.github.com/repos/{owner}/{repo}/releases/latest

然后从中抓取assets/url或assets/browser_download_url或zipball_url元素，然后下载。您需要在API调用中传递一个auth令牌，因为您正在访问一个私有存储库。

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>"\
  -H "X-GitHub-Api-Version: 2022-11-28" \
  https://api.github.com/repos/{owner}/{repo}/releases/latest

返回如下的回复：

{
  "url": "https://api.github.com/repos/jessehouwing/azure-pipelines-tfvc-tasks/releases/2696154",
  "assets_url": "https://api.github.com/repos/jessehouwing/azure-pipelines-tfvc-tasks/releases/2696154/assets",
  "upload_url": "https://uploads.github.com/repos/jessehouwing/azure-pipelines-tfvc-tasks/releases/2696154/assets{?name, label}",
  "assets": [
    {
      "url": "https://api.github.com/repos/jessehouwing/azure-pipelines-tfvc-tasks/releases/assets/1357442",
      "browser_download_url": "https://github.com/jessehouwing/azure-pipelines-tfvc-tasks/releases/download/1.1.69/jessehouwing.jessehouwing-vsts-tfvc-tasks-1.1.69.vsix"
    }
  ],
  "tarball_url": "https://api.github.com/repos/jessehouwing/azure-pipelines-tfvc-tasks/tarball/1.1.69",
  "zipball_url": "https://api.github.com/repos/jessehouwing/azure-pipelines-tfvc-tasks/zipball/1.1.69"
}

截至2023年，根据Github REST API文档https：//docs.github.com/en/rest/releases/assets？apiVersion=2022-11-28#get-a-release-asset，GET /repos/{owner}/{repo}/releases/assets/{asset_id}端点唯一支持的Content-Type是application/json。
如果你像普通的Web浏览器一样使用curl，可以使用cURL来获取文件，但是你需要在请求中有一个有效的github.com浏览器会话/cookie作为HTTP头。有效的语法应该如下所示：

curl -O --location 'https://github.com/{USERNAME}/{REPO_NAME}/releases/download/tag/{FILENAME}.zip' \
--header 'Host:  github.com' \
--header 'User-Agent:  Mozilla/5.0 (Windows NT 10.0; rv:112.0) Gecko/20100101 Firefox/112.0' \
--header 'Accept:  text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8' \
--header 'Accept-Encoding:  gzip, deflate, br' \
--header 'DNT:  1' \
--header 'Sec-GPC:  1' \
--header 'Connection:  keep-alive' \
--header 'Cookie:  _gh_sess={SESSION_VALUE}; _octo=GH1.1.2006260662.1682085066; logged_in=yes; preferred_color_mode=light; tz=UTC; _device_id=c556501e17ef6ab887e37181390d27d8; user_session={SESSION_VALUE}; __Host-user_session_same_site={USESSION_VALUE}; tz=UTC; color_mode=%7B%22color_mode%22%3A%22light%22%2C%22light_theme%22%3A%7B%22name%22%3A%22light%22%2C%22color_mode%22%3A%22light%22%7D%2C%22dark_theme%22%3A%7B%22name%22%3A%22dark_dimmed%22%2C%22color_mode%22%3A%22dark%22%7D%7D; dotcom_user={USERNAME}; has_recent_activity=1' \
--header 'Upgrade-Insecure-Requests:  1' \
--header 'Sec-Fetch-Dest:  document' \
--header 'Sec-Fetch-Mode:  navigate' \
--header 'Sec-Fetch-Site:  none' \
--header 'Sec-Fetch-User:  ?1' \
--header 'Pragma:  no-cache' \
--header 'Cache-Control:  no-cache'