feat: route install script downloads through the Dapr download gateway (Scarf)

[nelson-parente]

Description

This PR routes the install scripts' artifact downloads through the Dapr download gateway (Scarf) instead of hitting GitHub Releases directly, giving the project anonymous download counts for the CLI.

Context: the project already uses Scarf for analytics — the docs.dapr.io footer carries a Scarf pixel, and Scarf.sh is listed as a community-managed analytics tool in COMMUNITY-MANAGER.md. Scarf is also one of the analytics services CNCF makes available to its projects (CNCF hosted tools). The gateway is a plain redirect layer: it returns a 307 to the exact same GitHub Releases artifact and serves no bytes itself. The Dapr CLI Scarf package has existed since December 2022 and was never pointed at anything; this is the first change that uses it.

Changes:

• install.sh: artifact downloads default to https://dapr.gateway.scarf.sh/cli/<version>/<platform>/<arch>, overridable via DAPR_DOWNLOAD_BASE. The gateway resolves the artifact filename itself from the platform and arch segments, so its URLs are shaped differently from GitHub's — any DAPR_DOWNLOAD_BASE other than the gateway is treated as GitHub-shaped (<base>/<version>/<artifact>), which keeps the documented bypass working unchanged. Automatic fallback to GitHub Releases if the gateway is unreachable. curl now uses -f, so HTTP errors are detected instead of saving an error page (pre-existing gap). Version discovery (releases.atom) and the darwin-arm64 availability probe intentionally stay on GitHub — the probe is an existence check and should not be counted as a download.
• install.ps1: new -DownloadBase parameter (same default). Tries the gateway first, falls back to the GitHub API asset URL on failure. The GitHub auth header is not sent to the gateway. CustomAssetFactory users skip the gateway entirely. Windows resolves to the .zip artifact via a dedicated route, since the other platforms are .tar.gz.
• Homebrew, winget, dapr.msi, and direct-GitHub install paths are untouched and remain uncounted.

Privacy: the gateway derives coarse company and location information from the requesting IP to produce download counts, and does not retain the raw IP or expose it in reporting. Anyone preferring to bypass it entirely can set DAPR_DOWNLOAD_BASE / -DownloadBase to https://github.com/dapr/cli/releases/download.

Verification: every platform route was checked end-to-end — the gateway returns 307 and the redirect target returns 200 — across two releases:

Path	Resolves to
/cli/{version}/windows/amd64	dapr_windows_amd64.zip
/cli/{version}/linux/amd64	dapr_linux_amd64.tar.gz
/cli/{version}/linux/arm64	dapr_linux_arm64.tar.gz
/cli/{version}/linux/arm	dapr_linux_arm.tar.gz
/cli/{version}/darwin/amd64	dapr_darwin_amd64.tar.gz
/cli/{version}/darwin/arm64	dapr_darwin_arm64.tar.gz

12/12 passing on v1.15.0 and v1.14.1. A full install was also exercised on macOS (arm64) against an unprovisioned gateway, which validates the fallback path end-to-end.

Remaining before merge:

• Provision the Scarf file package and its routes (/cli/{version}/{platform}/{arch}, plus the Windows .zip route)
• Run a full install on each platform through the live gateway (the matrix above verifies redirect resolution, not the complete install)
• Follow-up PR to the docs.dapr.io install page documenting the override

Issue reference

We strive to have all PR being opened based on an issue, where the problem or feature have been discussed prior to implementation.

Please reference the issue this PR will close: N/A — opened as a draft proposal; happy to open a tracking issue (here or in dapr/community) for the download-analytics initiative if maintainers prefer.

Checklist

Please make sure you've completed the relevant tasks for this PR, out of the following list:

• Code compiles correctly
• Created/updated tests
• Extended the documentation