Allow Download of Release Evidence Files using Personal Access Tokens
Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.
Proposal
Currently, a Personal Access Token can be provided to authenticate for the asset download URL produced by the Get A Release By Tag Name. This allows for the programmatic downloading of these assets. (https://gitlab.example.com/<namespace>/<project name>/-/archive/<tag>/<asset file>)
However, the same API produces a download URL for the release evidence files that requires a session cookie from the UI to authenticate. (https://gitlab.example.com/<namespace>/<project name>/-/releases/<tag>/evidences/<evidence json filename>)
This leaves the web interface as the only way to access these files as there is no API access (see Issue #413505)
A similar issue regarding the release assets was raised in this now issue 28978. In fact, this comment is why I was able to know to use the Personal Access Token to download the release asset file.
This request comes from a large GitLab Ultimate customer from ZD Ticket #11921 (Access Required)