@redpanda-data/docs-extensions-and-macros 5.29.0 → 5.30.0

package/bin/doc-tools.js

@@ -119,7 +119,12 @@ programCli
  *
  * @requirements
  * - Internet connection to access GitHub API
- * - GitHub API rate limits apply (60 requests/hour unauthenticated)
+ * - A GitHub token with access to redpanda-data/streaming-enterprise, which is
+ *   private. Redpanda releases are published there now, and the old public repo
+ *   is frozen, so this command exits rather than report a stale version when it
+ *   has no token. Resolved from GIT_CREDENTIALS, REDPANDA_GITHUB_TOKEN,
+ *   ACTIONS_BOT_TOKEN, GITHUB_TOKEN, VBOT_GITHUB_API_TOKEN, or GH_TOKEN, in
+ *   that priority order
  */
 programCli
   .command('get-redpanda-version')
@@ -1057,8 +1062,10 @@ automation
  * @requirements
  * - Python 3.9 or higher
  * - Git
- * - Internet connection to clone Redpanda repository
- * - For --cloud-support: GitHub token with repo permissions (GITHUB_TOKEN env var)
+ * - A GitHub token (resolved from GIT_CREDENTIALS, REDPANDA_GITHUB_TOKEN, ACTIONS_BOT_TOKEN, GITHUB_TOKEN, VBOT_GITHUB_API_TOKEN, or GH_TOKEN, in that priority order) with
+ *   access to redpanda-data/streaming-enterprise, which is private
+ * - Internet connection to clone the streaming-enterprise repository
+ * - For --cloud-support: GitHub token with repo permissions (same resolution chain)
  * - For --cloud-support: Python packages pyyaml and requests
  */
 automation
@@ -1073,7 +1080,8 @@ automation
   .option('--regenerate-old-baseline', 'Re-extract the --diff tag from source instead of using the committed attachments/redpanda-properties-<oldTag>.json baseline')
   .option('--overrides <path>', 'Optional JSON file with property description overrides', 'docs-data/property-overrides.json')
   .option('--output-dir <dir>', 'Where to write all generated files', 'modules/reference')
-  .option('--cloud-support', 'Add AsciiDoc tags to generated property docs to indicate which ones are supported in Redpanda Cloud. This data is fetched from the cloudv2 repository so requires a GitHub token with repo permissions. Set the token as an environment variable using GITHUB_TOKEN, GH_TOKEN, or REDPANDA_GITHUB_TOKEN', true)
+  .option('--cloud-support', 'Add AsciiDoc tags to generated property docs to indicate which ones are supported in Redpanda Cloud. This data is fetched from the cloudv2 repository so requires a GitHub token with repo permissions. The token is resolved from GIT_CREDENTIALS, REDPANDA_GITHUB_TOKEN, ACTIONS_BOT_TOKEN, GITHUB_TOKEN, VBOT_GITHUB_API_TOKEN, or GH_TOKEN, in that priority order', true)
+  .option('--no-cloud-support', 'Skip Cloud support tags, and the cloudv2 repository access they need. A GitHub token is still required either way: the extractor clones the private streaming-enterprise repo to read the source')
   .option('--template-property <path>', 'Custom Handlebars template for individual property sections')
   .option('--template-topic-property <path>', 'Custom Handlebars template for topic property sections')
   .option('--template-topic-property-mappings <path>', 'Custom Handlebars template for topic property mappings table')
@@ -1091,17 +1099,35 @@ automation
 
     const newTag = options.tag || options.branch || 'dev'
 
-    if (options.cloudSupport) {
-      console.log('Validating cloud support dependencies...')
-      const { getGitHubToken } = require('../cli-utils/github-token')
-      const token = getGitHubToken()
-      if (!token) {
-        console.error('Error: Cloud support requires a GitHub token')
-        console.error('   Set: export GITHUB_TOKEN=your_token_here')
-        console.error('   Or disable cloud support with: --no-cloud-support')
-        process.exit(1)
+    // Resolved once, via the same priority chain every other GitHub-fetching
+    // command in this CLI already uses (cli-utils/github-token.js) --
+    // notably GIT_CREDENTIALS, which is the token Antora/Netlify builds
+    // actually populate, and which the Makefile's own narrower shell
+    // fallback (REDPANDA_GITHUB_TOKEN/GITHUB_TOKEN/GH_TOKEN only) can't see.
+    // Passed through as GH_TOKEN so the Makefile's clone step picks up
+    // whatever this resolved, private-repo access included, without having
+    // to duplicate the GIT_CREDENTIALS parsing logic in shell.
+    const { getGitHubToken } = require('../cli-utils/github-token')
+    const githubToken = getGitHubToken()
+
+    // A token is required whether or not Cloud metadata is: the extractor
+    // clones the private streaming-enterprise repo to read the source either
+    // way. --no-cloud-support only drops the extra cloudv2 read, so it is not
+    // a remedy for having no token, and pointing at it as one sent people
+    // into a run that got as far as the Makefile's clone step and died there.
+    if (!githubToken) {
+      console.error('Error: Generating property docs requires a GitHub token')
+      console.error('   The extractor reads Redpanda source from the private')
+      console.error('   redpanda-data/streaming-enterprise repository.')
+      console.error('   Set GH_TOKEN, REDPANDA_GITHUB_TOKEN, or GITHUB_TOKEN to a token with access.')
+      if (options.cloudSupport) {
+        console.error('   Cloud support tags (on by default) additionally read the cloudv2 repository;')
+        console.error('   --no-cloud-support skips those, but not the token requirement above.')
       }
-      console.log('Done: GitHub token validated')
+      process.exit(1)
+    }
+    if (options.cloudSupport) {
+      console.log('Done: GitHub token validated for source and cloudv2 access')
     }
 
     let oldTag = options.diff
@@ -1127,6 +1153,7 @@ automation
       console.log(`Building property docs for ${tag}…`)
       const args = ['build', `TAG=${tag}`]
       const env = { ...process.env }
+      if (githubToken) env.GH_TOKEN = githubToken
       if (overrides) env.OVERRIDES = path.resolve(overrides)
       if (options.cloudSupport) env.CLOUD_SUPPORT = '1'
       if (templates.property) env.TEMPLATE_PROPERTY = path.resolve(templates.property)
@@ -1290,8 +1317,9 @@ automation
  *
  * @description
  * Generates comprehensive CLI reference documentation for rpk (Redpanda Keeper).
- * Clones the Redpanda source, builds rpk with Go, and parses `rpk --print-tree` JSON output.
- * Detects Linux-only commands by analyzing Go build tags in the source code.
+ * Clones the Redpanda source from streaming-enterprise (private), builds rpk
+ * with Go, and parses `rpk --print-tree` JSON output. Detects Linux-only
+ * commands by analyzing Go build tags in the source code.
  *
  * Key features:
  * - Clones source from GitHub (sparse checkout for speed)
@@ -1325,6 +1353,9 @@ automation
  * @requirements
  * - Go must be installed (https://go.dev/)
  * - Git must be installed (for cloning source)
+ * - A GitHub token (resolved from GIT_CREDENTIALS, REDPANDA_GITHUB_TOKEN, ACTIONS_BOT_TOKEN, GITHUB_TOKEN, VBOT_GITHUB_API_TOKEN, or GH_TOKEN, in that priority order) with
+ *   access to redpanda-data/streaming-enterprise, which is private (not
+ *   needed when --from-source points at an existing local checkout)
  */
 automation
   .command('rpk-docs')
@@ -1875,7 +1906,7 @@ automation
  *
  * @requirements
  * - GitHub token with access to redpanda-data/cloudv2-infra repository
- * - Token must be set via GITHUB_TOKEN, GH_TOKEN, or REDPANDA_GITHUB_TOKEN environment variable
+ * - Token is resolved from GIT_CREDENTIALS, REDPANDA_GITHUB_TOKEN, ACTIONS_BOT_TOKEN, GITHUB_TOKEN, VBOT_GITHUB_API_TOKEN, or GH_TOKEN, in that priority order
  * - Internet connection to access GitHub API
  */
 automation
@@ -2169,7 +2200,9 @@ automation
  * npx doc-tools generate bundle-openapi --tag $VERSION --surface both
  *
  * @requirements
- * - Git to clone Redpanda repository
+ * - Git to clone the streaming-enterprise repository
+ * - A GitHub token (resolved from GIT_CREDENTIALS, REDPANDA_GITHUB_TOKEN, ACTIONS_BOT_TOKEN, GITHUB_TOKEN, VBOT_GITHUB_API_TOKEN, or GH_TOKEN, in that priority order) with
+ *   access to redpanda-data/streaming-enterprise, which is private
  * - Buf tool (automatically installed via npm)
  * - Redocly CLI or vacuum for OpenAPI bundling (automatically detected)
  * - Internet connection to clone repository
@@ -2180,7 +2213,7 @@ automation
   .description('Bundle Redpanda OpenAPI fragments for admin and connect APIs. Requires either --tag or --branch.')
   .option('-t, --tag <tag>', 'Git tag for released content')
   .option('-b, --branch <branch>', 'Branch name for in-progress content')
-  .option('--repo <url>', 'Repository URL', 'https://github.com/redpanda-data/redpanda.git')
+  .option('--repo <url>', 'Repository URL. The default is a private repo, so requires a GitHub token (resolved from GIT_CREDENTIALS, REDPANDA_GITHUB_TOKEN, ACTIONS_BOT_TOKEN, GITHUB_TOKEN, VBOT_GITHUB_API_TOKEN, or GH_TOKEN, in that priority order)', 'https://github.com/redpanda-data/streaming-enterprise.git')
   .addOption(new Option('-s, --surface <surface>', 'Which API surfaces to bundle').choices(['admin', 'connect', 'both']).makeOptionMandatory())
   .option('--out-admin <path>', 'Output path for admin API', 'admin/redpanda-admin-api.yaml')
   .option('--out-connect <path>', 'Output path for connect API', 'connect/redpanda-connect-api.yaml')

package/bin/mcp-tools/versions.js

@@ -74,7 +74,7 @@ function getRedpandaVersion(args = {}) {
       version,
       docker_tag: `docker.redpanda.com/redpandadata/${dockerRepo}:${version}`,
       is_beta: args.beta || false,
-      notes_url: `https://github.com/redpanda-data/redpanda/releases/tag/${version}`,
+      notes_url: `https://github.com/redpanda-data/streaming-enterprise/releases/tag/${version}`,
       _modelRecommendation: 'haiku'
     };
 

package/cli-utils/enterprise-sources.js

@@ -17,13 +17,13 @@ const { getGitHubToken } = require('./github-token')
 const RAW = 'https://raw.githubusercontent.com'
 
 // Repos known to be private, so a 404 can legitimately mean "needs auth".
-// Public sources (redpanda core headers, connect info.csv) 404 only when the
-// file is genuinely missing, and suggesting credentials there sends the
-// reader after a problem that does not exist (e.g. during a transient
-// GitHub blip).
+// Public sources (connect info.csv) 404 only when the file is genuinely
+// missing, and suggesting credentials there sends the reader after a
+// problem that does not exist (e.g. during a transient GitHub blip).
 const PRIVATE_REPO_PREFIXES = [
   `${RAW}/redpanda-data/docs/`,
   `${RAW}/redpanda-data/rp-connect-docs/`,
+  `${RAW}/redpanda-data/streaming-enterprise/`,
 ]
 
 const TOKEN_HINT = ' This source is in a private repository: set GIT_CREDENTIALS (or GITHUB_TOKEN / REDPANDA_GITHUB_TOKEN / ACTIONS_BOT_TOKEN) so the fetch can authenticate.'
@@ -220,8 +220,8 @@ async function loadEnterpriseSources (options, deps = {}) {
   const registryYaml = options.registry
     ? readLocal(options.registry)
     : await fetchText(`${RAW}/redpanda-data/docs/${options.docsRef}/shared/modules/ROOT/partials/enterprise-features.yml`)
-  const coreHeader = await fetchText(`${RAW}/redpanda-data/redpanda/${options.tag}/src/v/features/enterprise_features.h`, 'core enterprise_features.h')
-  const configurationHeader = await fetchText(`${RAW}/redpanda-data/redpanda/${options.tag}/src/v/config/configuration.h`, 'core configuration.h')
+  const coreHeader = await fetchText(`${RAW}/redpanda-data/streaming-enterprise/${options.tag}/src/v/features/enterprise_features.h`, 'core enterprise_features.h')
+  const configurationHeader = await fetchText(`${RAW}/redpanda-data/streaming-enterprise/${options.tag}/src/v/config/configuration.h`, 'core configuration.h')
 
   let connectRef = options.connectRef
   let infoCsv

package/cli-utils/install-test-dependencies.sh

@@ -462,21 +462,73 @@ install_rpk() {
             ;;
     esac
     
-    # Construct download URL and filename
+    # rpk releases now publish to the private redpanda-data/streaming-enterprise,
+    # not the public redpanda-data/redpanda, so a token is required (same
+    # priority order as cli-utils/github-token.js's getGitHubToken(), minus
+    # GIT_CREDENTIALS, which is Antora's own credential store and doesn't
+    # apply to this standalone installer script).
+    local gh_token="${REDPANDA_GITHUB_TOKEN:-${ACTIONS_BOT_TOKEN:-${GITHUB_TOKEN:-${VBOT_GITHUB_API_TOKEN:-${GH_TOKEN:-}}}}}"
+    if [ -z "$gh_token" ]; then
+        log_warn "No GitHub token found (checked REDPANDA_GITHUB_TOKEN, ACTIONS_BOT_TOKEN, GITHUB_TOKEN, VBOT_GITHUB_API_TOKEN, GH_TOKEN)."
+        log_warn "rpk releases are now published to the private redpanda-data/streaming-enterprise repo and require authentication."
+        log_warn "Please install rpk manually:"
+        log_warn "https://docs.redpanda.com/current/get-started/rpk-install/"
+        return 1
+    fi
+
     local rpk_filename="rpk-${rpk_os}-${rpk_arch}.zip"
-    local rpk_url="https://github.com/redpanda-data/redpanda/releases/latest/download/${rpk_filename}"
-    
-    log_info "Detected ${os_name} ${arch_name}, downloading ${rpk_filename}..."
-    
+    local releases_api="https://api.github.com/repos/redpanda-data/streaming-enterprise/releases/latest"
+
+    log_info "Detected ${os_name} ${arch_name}, looking up the latest rpk release..."
+
+    # The Authorization header reaches curl through a config file on stdin
+    # (--config -), never as an -H argument: an argv header is readable by
+    # any process on the host (ps, /proc) for as long as the transfer runs.
+    local release_json
+    if ! release_json=$(curl -fsSL --retry 5 --retry-all-errors \
+            --connect-timeout 30 --max-time 60 --retry-max-time 120 \
+            --config - \
+            -H "Accept: application/vnd.github+json" \
+            "$releases_api" <<EOF
+header = "Authorization: token ${gh_token}"
+EOF
+    ); then
+        log_warn "Failed to query the latest release from streaming-enterprise"
+        log_warn "Please install rpk manually:"
+        log_warn "https://docs.redpanda.com/current/get-started/rpk-install/"
+        return 1
+    fi
+
+    # Resolve the asset's API url (not browser_download_url): only the API
+    # asset endpoint accepts the Authorization header this private repo needs.
+    local rpk_url
+    rpk_url=$(printf '%s' "$release_json" | jq -r --arg name "$rpk_filename" '.assets[] | select(.name == $name) | .url')
+    if [ -z "$rpk_url" ] || [ "$rpk_url" = "null" ]; then
+        log_warn "Latest streaming-enterprise release has no asset named ${rpk_filename}"
+        log_warn "Please install rpk manually:"
+        log_warn "https://docs.redpanda.com/current/get-started/rpk-install/"
+        return 1
+    fi
+
+    log_info "Downloading ${rpk_filename}..."
+
     # Try to download and install rpk.
     # Use -f so HTTP errors (e.g. 403/404/429/503) fail instead of writing an
     # error page into the zip, and retry with curl's default exponential
     # backoff (1s, 2s, 4s, ...) to ride out transient GitHub/CDN and network
     # errors, including rate limits that need time to clear. --retry-max-time
     # caps the whole retry window so CI fails fast on persistent errors.
+    # Accept: application/octet-stream is required on the API asset url to
+    # receive the binary itself instead of its JSON metadata.
+    # Same as the release lookup above: the token travels on stdin, not argv.
     if curl -fL --retry 5 --retry-all-errors \
             --connect-timeout 30 --max-time 300 --retry-max-time 600 \
-            -o "$rpk_filename" "$rpk_url"; then
+            --config - \
+            -H "Accept: application/octet-stream" \
+            -o "$rpk_filename" "$rpk_url" <<EOF
+header = "Authorization: token ${gh_token}"
+EOF
+    then
         if unzip "$rpk_filename" 2>/dev/null; then
             mkdir -p ~/.local/bin
             if mv rpk ~/.local/bin/ 2>/dev/null; then

package/extensions/version-fetcher/set-latest-version.js

@@ -16,7 +16,12 @@ module.exports.register = function ({ config }) {
   const token = getGitHubToken();
 
   if (!token) {
-    logger.warn('GitHub token not set (REDPANDA_GITHUB_TOKEN, GITHUB_TOKEN, or GH_TOKEN). Attempting unauthenticated request.');
+    // Unauthenticated requests still work for the public repos this
+    // extension queries (connect, redpanda-operator), but the Redpanda
+    // version now comes from the private streaming-enterprise repo, whose
+    // API 404s without a token -- the latest-redpanda-* attributes are then
+    // left unset and pages fall back to their antora.yml values.
+    logger.warn('GitHub token not set (GIT_CREDENTIALS, REDPANDA_GITHUB_TOKEN, GITHUB_TOKEN, or GH_TOKEN). The Redpanda version lookup against the private streaming-enterprise repo will fail and leave latest-redpanda-* attributes unset; other lookups proceed unauthenticated.');
   }
 
   this.on('contentClassified', async ({ contentCatalog }) => {
@@ -41,7 +46,11 @@ module.exports.register = function ({ config }) {
         latestOperatorResult,
         latestConnectResult,
       ] = await Promise.allSettled([
-        GetLatestRedpandaVersion(github, owner, 'redpanda', logger),
+        // streaming-enterprise, not the frozen public 'redpanda' repo: the public
+        // repo still answers API calls but stopped receiving releases on
+        // 2026-08-20, so resolving from it silently pins the docs to the last
+        // pre-freeze version forever.
+        GetLatestRedpandaVersion(github, owner, 'streaming-enterprise', logger),
         GetLatestDockerTag(dockerNamespace, 'console', logger),
         GetLatestDockerTag(dockerNamespace, 'redpanda-operator', logger),
         GetLatestConnectVersion(github, owner, 'connect', logger),

package/mcp/CLI_INTERFACE.adoc

@@ -43,7 +43,7 @@ npx doc-tools get-redpanda-version [--beta]
 ----
 REDPANDA_VERSION=v25.3.1
 REDPANDA_DOCKER_TAG=docker.redpanda.com/redpandadata/redpanda:v25.3.1
-REDPANDA_RELEASE_NOTES=https://github.com/redpanda-data/redpanda/releases/tag/v25.3.1
+REDPANDA_RELEASE_NOTES=https://github.com/redpanda-data/streaming-enterprise/releases/tag/v25.3.1
 ----
 
 *Flags:*

package/mcp/USER_GUIDE.adoc

@@ -571,7 +571,7 @@ NOTE: Stack traces are only included when `NODE_ENV=development` for security re
   "version": "v25.3.1",
   "docker_tag": "docker.redpanda.com/redpandadata/redpanda:v25.3.1",
   "is_beta": false,
-  "notes_url": "https://github.com/redpanda-data/redpanda/releases/tag/v25.3.1"
+  "notes_url": "https://github.com/redpanda-data/streaming-enterprise/releases/tag/v25.3.1"
 }
 ----
 
@@ -592,7 +592,7 @@ notes_url:: GitHub release notes URL
   "version": "v25.4.1-rc1",
   "docker_tag": "docker.redpanda.com/redpandadata/redpanda-unstable:v25.4.1-rc1",
   "is_beta": true,
-  "notes_url": "https://github.com/redpanda-data/redpanda/releases/tag/v25.4.1-rc1"
+  "notes_url": "https://github.com/redpanda-data/streaming-enterprise/releases/tag/v25.4.1-rc1"
 }
 ----
 
@@ -857,7 +857,7 @@ Claude: *uses get_redpanda_version MCP tool*
 The latest Redpanda version is v25.3.1, released on January 15, 2024.
 
 Docker tag: docker.redpanda.com/redpandadata/redpanda:v25.3.1
-Release notes: https://github.com/redpanda-data/redpanda/releases/tag/v25.3.1
+Release notes: https://github.com/redpanda-data/streaming-enterprise/releases/tag/v25.3.1
 ----
 
 ----
@@ -969,7 +969,7 @@ Claude: *uses generate_property_docs MCP tool*
 ❌ Generation failed: Tag v99.9.9 not found in Redpanda repository
 
 Suggestion: Check that the version exists in the Redpanda repository. You can find available versions at:
-https://github.com/redpanda-data/redpanda/releases
+https://github.com/redpanda-data/streaming-enterprise/releases
 ----
 
 === Example 7: Property documentation updates (with prompt)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redpanda-data/docs-extensions-and-macros",
-  "version": "5.29.0",
+  "version": "5.30.0",
   "description": "Antora extensions and macros developed for Redpanda documentation.",
   "keywords": [
     "antora",

package/tools/bundle-openapi.js

@@ -2,7 +2,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const { execSync, spawnSync } = require('child_process');
+const { execSync, execFileSync, spawnSync } = require('child_process');
 const yaml = require('yaml');
 const { getMajorMinor } = require('../cli-utils/version');
 
@@ -585,7 +585,7 @@ function postProcessBundle(filePath, options, quiet = false) {
  * @param {string} [options.output] - Standalone output file path; when provided, used for the single output file.
  * @param {string} [options.outAdmin] - Output path for the admin API when integrating with doc-tools mode.
  * @param {string} [options.outConnect] - Output path for the connect API when integrating with doc-tools mode.
- * @param {string} [options.repo] - Repository URL to clone (defaults to https://github.com/redpanda-data/redpanda.git).
+ * @param {string} [options.repo] - Repository URL to clone (defaults to https://github.com/redpanda-data/streaming-enterprise.git, a private repo that requires a GitHub token).
  * @param {string} [options.adminMajor] - Admin API major version string used for metadata (for example, 'v2.0.0').
  * @param {boolean} [options.useAdminMajorVersion] - When true and processing the admin surface, use `adminMajor` for the bundle info.version.
  * @param {boolean} [options.quiet=false] - Suppress logging to stdout/stderr when true.
@@ -649,24 +649,42 @@ async function bundleOpenAPI(options) {
   try {
     // Clone repository (only once for all surfaces)
     if (!quiet) {
-      console.log('📥 Cloning redpanda repository...');
+      console.log('📥 Cloning streaming-enterprise repository...');
     }
 
-    const { getAuthenticatedGitHubUrl, hasGitHubToken } = require('../cli-utils/github-token');
+    const { getGitHubToken } = require('../cli-utils/github-token');
 
-    let repositoryUrl = repo || 'https://github.com/redpanda-data/redpanda.git';
+    const repositoryUrl = repo || 'https://github.com/redpanda-data/streaming-enterprise.git';
+    const usingDefaultRepo = !repo;
+    const token = getGitHubToken();
 
-    // Use token if available for better rate limits and reliability
-    if (hasGitHubToken() && repositoryUrl.includes('github.com')) {
-      repositoryUrl = getAuthenticatedGitHubUrl(repositoryUrl);
+    if (usingDefaultRepo && !token) {
+      throw new Error('redpanda-data/streaming-enterprise is a private repository: set GH_TOKEN, GITHUB_TOKEN, or REDPANDA_GITHUB_TOKEN so the clone can authenticate.');
+    }
+
+    // Auth travels via a credential helper registered through GIT_CONFIG_*
+    // environment variables, never as a git -c argument, so the token
+    // cannot appear in this process's argv (visible to anything that can
+    // list processes) or get embedded in an exec error's command-line
+    // message. It's also never embedded in the remote URL or persisted in
+    // the clone's .git/config.
+    const gitEnv = { ...process.env };
+    if (token && repositoryUrl.includes('github.com')) {
       if (!quiet) {
         console.log('🔑 Using authenticated clone (token provided)');
       }
+      gitEnv.BUNDLE_OPENAPI_CLONE_TOKEN = token;
+      gitEnv.GIT_CONFIG_COUNT = '2';
+      gitEnv.GIT_CONFIG_KEY_0 = 'credential.helper';
+      gitEnv.GIT_CONFIG_VALUE_0 = '';
+      gitEnv.GIT_CONFIG_KEY_1 = 'credential.https://github.com.helper';
+      gitEnv.GIT_CONFIG_VALUE_1 = '!f() { echo "username=x-access-token"; echo "password=$BUNDLE_OPENAPI_CLONE_TOKEN"; }; f';
     }
 
     try {
-      execSync(`git clone --depth 1 --branch ${tag} ${repositoryUrl} redpanda`, {
+      execFileSync('git', ['clone', '--depth', '1', '--branch', tag, repositoryUrl, 'redpanda'], {
         cwd: tempDir,
+        env: gitEnv,
         stdio: quiet ? 'ignore' : 'inherit',
         timeout: 60000 // 1 minute timeout
       });
@@ -825,7 +843,7 @@ if (require.main === module) {
     .option('-o, --output <path>', 'Output file path (defaults: admin/redpanda-admin-api.yaml or connect/redpanda-connect-api.yaml)')
     .option('--out-admin <path>', 'Output path for admin API', 'admin/redpanda-admin-api.yaml')
     .option('--out-connect <path>', 'Output path for connect API', 'connect/redpanda-connect-api.yaml')
-    .option('--repo <url>', 'Repository URL', 'https://github.com/redpanda-data/redpanda.git')
+    .option('--repo <url>', 'Repository URL. The default is a private repo, so requires a GitHub token (GH_TOKEN, GITHUB_TOKEN, or REDPANDA_GITHUB_TOKEN)', 'https://github.com/redpanda-data/streaming-enterprise.git')
     .option('--admin-major <string>', 'Admin API major version', 'v2.0.0')
     .option('--use-admin-major-version', 'Use admin major version for info.version instead of git tag', false)
     .option('-q, --quiet', 'Suppress output', false)

package/tools/get-redpanda-version.js

@@ -2,6 +2,7 @@
 
 const GetLatestRedpandaVersion = require('../extensions/version-fetcher/get-latest-redpanda-version.js');
 const { getPrereleaseFromAntora } = require('../cli-utils/antora-utils.js');
+const { getGitHubToken } = require('../cli-utils/github-token');
 
 /**
  * Fetches and prints the latest Redpanda version and Docker repository.
@@ -10,8 +11,20 @@ const { getPrereleaseFromAntora } = require('../cli-utils/antora-utils.js');
  * @param {boolean} options.fromAntora - Whether to derive beta flag from antora.yml
  */
 module.exports = async function getRedpandaVersion({ beta = false, fromAntora = false }) {
+  // streaming-enterprise, not the old public redpanda repo: the public repo
+  // still answers API requests but froze at its 2026-08-20 state when the
+  // source moved, so resolving "latest" from it silently pins to the last
+  // pre-freeze release forever. streaming-enterprise is private, and
+  // unauthenticated release listings 404 rather than fail loudly, so refuse
+  // to guess without a token instead of quietly resolving nothing.
   const owner = 'redpanda-data';
-  const repo = 'redpanda';
+  const repo = 'streaming-enterprise';
+
+  if (!getGitHubToken()) {
+    console.error(`❌ redpanda-data/${repo} is a private repository.`);
+    console.error('   Set GH_TOKEN, REDPANDA_GITHUB_TOKEN, or GITHUB_TOKEN to a token with access.');
+    process.exit(1);
+  }
 
   // Determine whether to treat this as a beta (RC) release
   let useBeta = beta;

package/tools/property-extractor/Makefile

@@ -76,55 +76,101 @@ clean:
 	@echo "🧹 Cleaning up…"
 	@rm -rf $(VENV) $(TMP_ROOT) $(REPO_ROOT)/autogenerated
 
-# --- Clone or update Redpanda, checkout TAG or default branch ---
+# --- Clone or update the Redpanda source (now in streaming-enterprise), checkout TAG or default branch ---
 # Clones are shallow: the extractor only reads source files at a single tag,
 # so full history is wasted time and disk.
-# Auth is passed as a per-invocation HTTP header (git -c before the clone
-# subcommand), never embedded in the remote URL, so no token is persisted in
-# the clone's .git/config. The clone lives inside the installed package dir,
-# so a persisted token would be readable by anything that can list it.
+# Auth travels via a credential helper registered through GIT_CONFIG_*
+# environment variables, never as a git -c argument (which would put the
+# token in this process's argv, visible to anything that can list processes
+# on the runner) and never embedded in the remote URL. The clone lives
+# inside the installed package dir, so a persisted token would also be
+# readable by anything that can list it -- GIT_CONFIG_* env vars don't get
+# written to disk, so nothing persists in the clone's .git/config either.
+# streaming-enterprise is private, so a token is required -- not just
+# preferred the way it was when this cloned the public redpanda repo. GH_TOKEN
+# is checked first because `doc-tools generate property-docs` pre-resolves it
+# via cli-utils/github-token.js's full priority chain (notably GIT_CREDENTIALS,
+# the token Antora/Netlify builds actually populate) before invoking this
+# Makefile. REDPANDA_GITHUB_TOKEN/GITHUB_TOKEN are the fallback for invoking
+# `make` directly, without going through doc-tools.js.
+# An existing checkout may predate the streaming-enterprise migration and
+# still have origin pointed at the old public redpanda repo, so the
+# existing-directory path pins origin to REPO_URL before fetching. Pinning
+# origin is not enough by itself: the old repo's cached remote-tracking refs
+# and tags stay behind it, and a fetch that fails (expired token, outage,
+# ref that does not exist) used to fall straight through to checking one of
+# those out -- generating docs from stale public source under a tag that
+# source never contained, with nothing in the log to say so. So a fetch has
+# to succeed before any ref is resolved, the catch-all fetch prunes refs and
+# tags the new origin does not have, the ref that gets checked out is the
+# one the successful fetch actually wrote, and a TAG that is neither a tag
+# nor a branch there is an error rather than a quiet swap to the default
+# branch.
 redpanda-git:
 	@mkdir -p "$(TMP_ROOT)"
-	@echo "🔄 Cloning/updating Redpanda into $(REDPANDA_SRC)…"
-	@if [ -d "$(REDPANDA_SRC)" ]; then \
-	  git -C "$(REDPANDA_SRC)" fetch --depth 1 -q origin "+refs/tags/$(TAG):refs/tags/$(TAG)" 2>/dev/null || \
-	    git -C "$(REDPANDA_SRC)" fetch --depth 1 -q origin "+refs/heads/$(TAG):refs/remotes/origin/$(TAG)" 2>/dev/null || \
-	    git -C "$(REDPANDA_SRC)" fetch --all --tags -q; \
-	else \
-	  GH_TOKEN=$${REDPANDA_GITHUB_TOKEN:-$${GITHUB_TOKEN:-$${GH_TOKEN}}}; \
-	  REPO_URL="https://github.com/redpanda-data/redpanda.git"; \
-	  if [ -n "$$GH_TOKEN" ]; then \
-	    echo "🔑 Using authenticated clone (token provided)"; \
-	    AUTH_HEADER="AUTHORIZATION: basic $$(printf '%s' "x-access-token:$$GH_TOKEN" | base64 | tr -d '\n')"; \
-	  else \
-	    AUTH_HEADER=""; \
-	  fi; \
-	  git -c http.https://github.com/.extraheader="$$AUTH_HEADER" clone -q --depth 1 --branch "$(TAG)" "$$REPO_URL" "$(REDPANDA_SRC)" 2>/dev/null || \
-	    git -c http.https://github.com/.extraheader="$$AUTH_HEADER" clone -q --depth 1 "$$REPO_URL" "$(REDPANDA_SRC)"; \
+	@GH_TOKEN=$${GH_TOKEN:-$${REDPANDA_GITHUB_TOKEN:-$${GITHUB_TOKEN}}}; \
+	if [ -z "$$GH_TOKEN" ]; then \
+	  echo "❌ redpanda-data/streaming-enterprise is a private repository."; \
+	  echo "   Set GH_TOKEN, REDPANDA_GITHUB_TOKEN, or GITHUB_TOKEN to a token with access."; \
+	  exit 1; \
 	fi; \
-	if git -C "$(REDPANDA_SRC)" rev-parse --verify -q "origin/$(TAG)" >/dev/null 2>&1; then \
-	  echo "🔖 Checking out remote branch 'origin/$(TAG)'"; \
-	  git -C "$(REDPANDA_SRC)" checkout -q "$(TAG)" 2>/dev/null || git -C "$(REDPANDA_SRC)" checkout -q -b "$(TAG)" "origin/$(TAG)"; \
-	  git -C "$(REDPANDA_SRC)" reset --hard "origin/$(TAG)" -q; \
-	elif git -C "$(REDPANDA_SRC)" rev-parse --verify -q "$(TAG)" >/dev/null 2>&1; then \
-	  echo "🔖 Checking out '$(TAG)'"; \
-	  git -C "$(REDPANDA_SRC)" checkout -q "$(TAG)"; \
+	export GIT_MAKEFILE_CLONE_TOKEN="$$GH_TOKEN"; \
+	export GIT_CONFIG_COUNT=2; \
+	export GIT_CONFIG_KEY_0=credential.helper; \
+	export GIT_CONFIG_VALUE_0=; \
+	export GIT_CONFIG_KEY_1=credential.https://github.com.helper; \
+	export GIT_CONFIG_VALUE_1='!f() { echo "username=x-access-token"; echo "password=$$GIT_MAKEFILE_CLONE_TOKEN"; }; f'; \
+	REPO_URL="https://github.com/redpanda-data/streaming-enterprise.git"; \
+	echo "🔄 Cloning/updating streaming-enterprise into $(REDPANDA_SRC)…"; \
+	FETCH_LOG="$$(mktemp)"; \
+	FETCHED=""; \
+	if [ -d "$(REDPANDA_SRC)" ]; then \
+	  git -C "$(REDPANDA_SRC)" remote set-url origin "$$REPO_URL" 2>/dev/null || \
+	    git -C "$(REDPANDA_SRC)" remote add origin "$$REPO_URL"; \
+	  if git -C "$(REDPANDA_SRC)" fetch --depth 1 -q origin "+refs/tags/$(TAG):refs/tags/$(TAG)" >>"$$FETCH_LOG" 2>&1; then \
+	    FETCHED=tag; \
+	  elif git -C "$(REDPANDA_SRC)" fetch --depth 1 -q origin "+refs/heads/$(TAG):refs/remotes/origin/$(TAG)" >>"$$FETCH_LOG" 2>&1; then \
+	    FETCHED=branch; \
+	  elif git -C "$(REDPANDA_SRC)" fetch --all --tags --prune --prune-tags -q >>"$$FETCH_LOG" 2>&1; then \
+	    FETCHED=probe; \
+	  fi; \
 	else \
-	  DEFAULT_BRANCH=$$(git -C "$(REDPANDA_SRC)" symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null || true); \
-	  if [ -n "$$DEFAULT_BRANCH" ]; then \
-	    echo "⚠️ Tag '$(TAG)' not found; falling back to '$${DEFAULT_BRANCH}'"; \
-	    git -C "$(REDPANDA_SRC)" checkout -q "$${DEFAULT_BRANCH}"; \
-	  else \
-	    DEFAULT_BRANCH=$$(git -C "$(REDPANDA_SRC)" ls-remote --symref origin HEAD | awk '/^ref:/ {sub(/^refs\/heads\//, "", $$2); print $$2; exit}'); \
-	    if [ -z "$$DEFAULT_BRANCH" ]; then \
-	      echo "❌ Tag '$(TAG)' not found and the default branch could not be determined"; \
-	      exit 1; \
-	    fi; \
-	    echo "⚠️ Tag '$(TAG)' not found; falling back to '$${DEFAULT_BRANCH}'"; \
-	    git -C "$(REDPANDA_SRC)" fetch --depth 1 -q origin "$$DEFAULT_BRANCH"; \
-	    git -C "$(REDPANDA_SRC)" checkout -q FETCH_HEAD; \
+	  echo "🔑 Using authenticated clone"; \
+	  if git clone -q --depth 1 --branch "$(TAG)" "$$REPO_URL" "$(REDPANDA_SRC)" >>"$$FETCH_LOG" 2>&1; then \
+	    FETCHED=probe; \
 	  fi; \
-	fi
+	fi; \
+	if [ -z "$$FETCHED" ]; then \
+	  echo "❌ Could not fetch '$(TAG)' from redpanda-data/streaming-enterprise:"; \
+	  sed 's/^/   /' "$$FETCH_LOG"; \
+	  echo "   Not continuing: anything already in $(REDPANDA_SRC) can predate the"; \
+	  echo "   streaming-enterprise migration, and generating docs from it would"; \
+	  echo "   publish stale public source under this tag. Check that the token is"; \
+	  echo "   valid and has access to the repository, and that '$(TAG)' exists there."; \
+	  rm -f "$$FETCH_LOG"; \
+	  exit 1; \
+	fi; \
+	rm -f "$$FETCH_LOG"; \
+	case "$$FETCHED" in \
+	  tag) REF="refs/tags/$(TAG)";; \
+	  branch) REF="refs/remotes/origin/$(TAG)";; \
+	  *) REF=""; \
+	     for candidate in "refs/tags/$(TAG)" "refs/remotes/origin/$(TAG)"; do \
+	       if git -C "$(REDPANDA_SRC)" rev-parse --verify -q "$$candidate" >/dev/null 2>&1; then \
+	         REF="$$candidate"; \
+	         break; \
+	       fi; \
+	     done;; \
+	esac; \
+	if [ -z "$$REF" ]; then \
+	  echo "❌ '$(TAG)' is neither a tag nor a branch in redpanda-data/streaming-enterprise."; \
+	  echo "   Not falling back to the default branch: that would publish docs labelled"; \
+	  echo "   '$(TAG)' built from entirely different source."; \
+	  exit 1; \
+	fi; \
+	echo "🔖 Checking out '$$REF'"; \
+	git -C "$(REDPANDA_SRC)" checkout -q --detach "$$REF"; \
+	git -C "$(REDPANDA_SRC)" reset --hard -q "$$REF"
 
 # --- Clone Tree-sitter grammar & generate parser ---
 # Skips npm install and parser generation when the generated output already

package/tools/property-extractor/README.adoc

@@ -1296,7 +1296,7 @@ node generate-handlebars-docs.js test-input.json test-output
 
 == Additional resources
 
-* https://github.com/redpanda-data/redpanda[Redpanda GitHub Repository]
+* https://github.com/redpanda-data/streaming-enterprise[streaming-enterprise Repository] (private; this is where the extractor clones Redpanda's source from)
 * https://github.com/redpanda-data/docs-extensions-and-macros[docs-extensions-and-macros Repository]
 * https://tree-sitter.github.io/tree-sitter/[Tree-sitter Documentation]
 * https://handlebarsjs.com/[Handlebars.js Guide]

package/tools/property-extractor/cloud_config.py

@@ -6,7 +6,7 @@ This module fetches cloud configuration from the cloudv2 repository to determine
 which Redpanda properties are supported, editable, or readonly in cloud deployments.
 
 Prerequisites:
-    - GITHUB_TOKEN environment variable set with appropriate permissions
+    - GH_TOKEN, GITHUB_TOKEN, or REDPANDA_GITHUB_TOKEN environment variable set with appropriate permissions
     - Internet connection to access GitHub API
     
 Usage:
@@ -105,14 +105,14 @@ def fetch_cloud_config(github_token: Optional[str] = None) -> CloudConfig:
     """
     Fetch the latest cloud configuration from the redpanda-data/cloudv2 repository and return it as a CloudConfig.
     
-    This function uses a GitHub personal access token for authentication. If `github_token` is not provided, it will read GITHUB_TOKEN or REDPANDA_GITHUB_TOKEN from the environment. It downloads the most recent versioned YAML from the repository's install-pack directory, validates expected sections (`customer_managed_configs` and `readonly_cluster_config`), and constructs a CloudConfig instance.
-    
+    This function uses a GitHub personal access token for authentication. If `github_token` is not provided, it will read GH_TOKEN, GITHUB_TOKEN, or REDPANDA_GITHUB_TOKEN from the environment. It downloads the most recent versioned YAML from the repository's install-pack directory, validates expected sections (`customer_managed_configs` and `readonly_cluster_config`), and constructs a CloudConfig instance.
+
     Parameters:
-        github_token (Optional[str]): Personal access token for GitHub API. If omitted, the function will try environment variables GITHUB_TOKEN or REDPANDA_GITHUB_TOKEN.
-    
+        github_token (Optional[str]): Personal access token for GitHub API. If omitted, the function will try environment variables GH_TOKEN, GITHUB_TOKEN, or REDPANDA_GITHUB_TOKEN.
+
     Returns:
         CloudConfig: Parsed cloud configuration for the latest available version.
-    
+
     Raises:
         GitHubAuthError: Authentication or access problems with the GitHub API (including 401/403 responses).
         NetworkError: Network connectivity or timeout failures when contacting the GitHub API.
@@ -120,7 +120,11 @@ def fetch_cloud_config(github_token: Optional[str] = None) -> CloudConfig:
         CloudConfigError: Generic configuration error (for example, missing token) or unexpected internal failures.
     """
     if not github_token:
-        github_token = os.environ.get('GITHUB_TOKEN') or os.environ.get('REDPANDA_GITHUB_TOKEN')
+        # GH_TOKEN takes priority: `doc-tools generate property-docs` pre-resolves
+        # a token via cli-utils/github-token.js's full priority chain (GIT_CREDENTIALS,
+        # ACTIONS_BOT_TOKEN, etc.) and passes it down as GH_TOKEN, so this must see
+        # that name too -- not just the two env vars a directly-invoked `make` sets.
+        github_token = os.environ.get('GH_TOKEN') or os.environ.get('GITHUB_TOKEN') or os.environ.get('REDPANDA_GITHUB_TOKEN')
     
     if not github_token:
         error_msg = (

package/tools/rpk-docs/rpk-docs-handler.js

@@ -241,7 +241,31 @@ function prepareSourceFromRef(sourceRef, sourcePath = null) {
   const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'rpk-source-'))
   const repoDir = path.join(tmpDir, 'redpanda')
 
-  console.log(`Sparse-cloning redpanda repo (ref: ${sourceRef}) to ${repoDir}...`)
+  // streaming-enterprise is private, so a token is required. Auth travels
+  // via a credential helper registered through GIT_CONFIG_* environment
+  // variables, never as a git -c argument, so the token cannot appear in
+  // this process's argv (visible to anything that can list processes) and
+  // never embedded in the remote URL, so no token is persisted in the
+  // clone's .git/config either.
+  const { getGitHubToken } = require('../../cli-utils/github-token')
+  const token = getGitHubToken()
+  if (!token) {
+    throw new Error(
+      'redpanda-data/streaming-enterprise is a private repository.\n' +
+      'Set GH_TOKEN, GITHUB_TOKEN, or REDPANDA_GITHUB_TOKEN so the clone can authenticate.'
+    )
+  }
+  const gitEnv = {
+    ...process.env,
+    RPK_SOURCE_CLONE_TOKEN: token,
+    GIT_CONFIG_COUNT: '2',
+    GIT_CONFIG_KEY_0: 'credential.helper',
+    GIT_CONFIG_VALUE_0: '',
+    GIT_CONFIG_KEY_1: 'credential.https://github.com.helper',
+    GIT_CONFIG_VALUE_1: '!f() { echo "username=x-access-token"; echo "password=$RPK_SOURCE_CLONE_TOKEN"; }; f'
+  }
+
+  console.log(`Sparse-cloning streaming-enterprise repo (ref: ${sourceRef}) to ${repoDir}...`)
 
   // Clone with sparse checkout
   const cloneResult = spawnSync('git', [
@@ -250,27 +274,31 @@ function prepareSourceFromRef(sourceRef, sourcePath = null) {
     '--filter=blob:none',
     '--sparse',
     '--branch', sourceRef,
-    'https://github.com/redpanda-data/redpanda.git',
+    'https://github.com/redpanda-data/streaming-enterprise.git',
     repoDir
   ], {
     encoding: 'utf8',
     timeout: 120000,
+    env: gitEnv,
     stdio: ['pipe', 'pipe', 'pipe']
   })
 
   if (cloneResult.status !== 0) {
     throw new Error(
-      `Failed to clone redpanda repo with ref '${sourceRef}'.\n` +
+      `Failed to clone streaming-enterprise repo with ref '${sourceRef}'.\n` +
       `Make sure the branch or tag exists.\n` +
       `Error: ${cloneResult.stderr}`
     )
   }
 
-  // Set sparse checkout to only get rpk
+  // Set sparse checkout to only get rpk. With --filter=blob:none, the blobs
+  // for src/go/rpk were not fetched by the clone above and are pulled lazily
+  // here, so this invocation needs the same credential helper.
   const sparseResult = spawnSync('git', ['sparse-checkout', 'set', 'src/go/rpk'], {
     cwd: repoDir,
     encoding: 'utf8',
-    timeout: 60000
+    timeout: 60000,
+    env: gitEnv
   })
 
   if (sparseResult.status !== 0) {
@@ -292,8 +320,8 @@ function fetchRpkTreeFromSource(sourcePath) {
   if (!fs.existsSync(sourcePath)) {
     throw new Error(
       `rpk source directory not found: ${sourcePath}\n` +
-      'To use --from-source, you need a local checkout of the redpanda repository.\n' +
-      'Clone it with: git clone https://github.com/redpanda-data/redpanda.git\n' +
+      'To use --from-source, you need a local checkout of the streaming-enterprise repository (private).\n' +
+      'Clone it with: git clone https://github.com/redpanda-data/streaming-enterprise.git\n' +
       'Then point to: <repo>/src/go/rpk'
     )
   }
@@ -393,8 +421,8 @@ function fetchRpkTreeFromLinuxSource(sourcePath, pluginPins = {}) {
   if (!fs.existsSync(absoluteSourcePath)) {
     throw new Error(
       `rpk source directory not found: ${absoluteSourcePath}\n` +
-      'Expected a checkout of the redpanda repository.\n' +
-      'Clone it with: git clone https://github.com/redpanda-data/redpanda.git'
+      'Expected a checkout of the streaming-enterprise repository (private).\n' +
+      'Clone it with: git clone https://github.com/redpanda-data/streaming-enterprise.git'
     )
   }
 
@@ -1292,16 +1320,69 @@ function downloadRpkRelease(tag, destDir) {
     return null
   }
 
+  // Releases now publish to streaming-enterprise (private), not the public
+  // redpanda-data/redpanda. This function already has a fallback (the
+  // caller builds from source instead), so a missing token warns and
+  // returns null here rather than throwing the way the clone-only paths do.
+  const { getGitHubToken } = require('../../cli-utils/github-token')
+  const token = getGitHubToken()
+  if (!token) {
+    console.warn('No GitHub token available for the private streaming-enterprise release download; falling back to a source build.')
+    return null
+  }
+
   const assetName = `rpk-${osName}-${archName}.zip`
-  const baseUrl = `https://github.com/redpanda-data/redpanda/releases/download/${tag}`
+  const checksumAsset = `rpk_${tag.replace(/^v/, '')}_checksums.txt`
   const zipPath = path.join(destDir, assetName)
+  // The Authorization header reaches curl through a config file on stdin
+  // (--config -), never as an -H argument: an argv header is readable by
+  // any process on the host (ps, /proc) for as long as the transfer runs.
+  const curlAuthConfig = `header = "Authorization: token ${token}"`
+
+  // streaming-enterprise is private, so the release's browser download URL
+  // (releases/download/<tag>/<asset>) 404s even with a valid token: it
+  // redirects to a signed storage URL that requires an authenticated
+  // browser session, not a bearer token. Only the API's per-asset url
+  // (asset.url, not asset.browser_download_url) accepts this Authorization
+  // header, so resolve assets through the release-by-tag API first.
+  const releaseResult = spawnSync('curl', [
+    '-fsSL', '--retry', '5', '--retry-all-errors',
+    '--connect-timeout', '30', '--max-time', '60',
+    '--config', '-',
+    '-H', 'Accept: application/vnd.github+json',
+    `https://api.github.com/repos/redpanda-data/streaming-enterprise/releases/tags/${tag}`
+  ], { encoding: 'utf8', input: curlAuthConfig, timeout: 90000 })
+
+  if (releaseResult.status !== 0) {
+    console.warn(`Could not look up release ${tag} from streaming-enterprise (draft or missing release)`)
+    return null
+  }
+
+  let release
+  try {
+    release = JSON.parse(releaseResult.stdout)
+  } catch {
+    console.warn(`Could not parse release metadata for ${tag}`)
+    return null
+  }
+
+  const assetUrl = (release.assets || []).find(a => a.name === assetName)?.url
+  if (!assetUrl) {
+    console.warn(`Release ${tag} has no asset named ${assetName} (draft or missing release asset)`)
+    return null
+  }
+  const checksumUrl = (release.assets || []).find(a => a.name === checksumAsset)?.url
 
   console.log(`Downloading ${assetName} for ${tag}...`)
+  // Accept: application/octet-stream is required on the API asset url to
+  // receive the binary itself instead of its JSON metadata.
   const curlResult = spawnSync('curl', [
     '-fL', '--retry', '5', '--retry-all-errors',
     '--connect-timeout', '30', '--max-time', '300',
-    '-o', zipPath, `${baseUrl}/${assetName}`
-  ], { encoding: 'utf8', timeout: 360000 })
+    '--config', '-',
+    '-H', 'Accept: application/octet-stream',
+    '-o', zipPath, assetUrl
+  ], { encoding: 'utf8', input: curlAuthConfig, timeout: 360000 })
 
   if (curlResult.status !== 0) {
     console.warn(`Could not download rpk release for ${tag} (draft or missing release asset)`)
@@ -1309,12 +1390,13 @@ function downloadRpkRelease(tag, destDir) {
   }
 
   // Verify against the release checksum file when it exists
-  const checksumAsset = `rpk_${tag.replace(/^v/, '')}_checksums.txt`
   const checksumPath = path.join(destDir, checksumAsset)
-  const checksumResult = spawnSync('curl', [
+  const checksumResult = checksumUrl ? spawnSync('curl', [
     '-fsSL', '--retry', '3', '--connect-timeout', '30', '--max-time', '60',
-    '-o', checksumPath, `${baseUrl}/${checksumAsset}`
-  ], { encoding: 'utf8', timeout: 90000 })
+    '--config', '-',
+    '-H', 'Accept: application/octet-stream',
+    '-o', checksumPath, checksumUrl
+  ], { encoding: 'utf8', input: curlAuthConfig, timeout: 90000 }) : { status: 1 }
 
   if (checksumResult.status === 0) {
     const expectedLine = fs.readFileSync(checksumPath, 'utf8')