fix: Close the original response body on non-2xx responses - #4486

diff --git a/github/copilot.go b/github/copilot.go
index adbfae32..9dd24eb8 100644
--- a/github/copilot.go
+++ b/github/copilot.go
@@ -1212,12 +1212,8 @@ func (s *CopilotService) fetchMetricsReport(ctx context.Context, url string) (*h
 		return nil, nil, err
 	}
 
-	// CheckResponse substitutes resp.Body with a re-readable copy on error
-	// responses, so capture the original body first: it is the one that must
-	// be closed.
-	origBody := resp.Body
 	if err := CheckResponse(resp); err != nil {
-		_ = origBody.Close()
+		resp.Body.Close()
 		return nil, newResponse(resp), err
 	}
 
diff --git a/github/copilot_test.go b/github/copilot_test.go
index ee1f804a..4ddbab41 100644
--- a/github/copilot_test.go
+++ b/github/copilot_test.go
@@ -3212,8 +3212,8 @@ func TestCopilotService_DownloadDailyMetrics(t *testing.T) {
 	}
 }
 
-// CheckResponse substitutes resp.Body with a re-readable copy on error
-// responses; fetchMetricsReport must still close the original body it replaces.
+// CheckResponse closes the original resp.Body and substitutes a re-readable
+// copy on error responses; fetchMetricsReport must not leak the original body.
 func TestCopilotService_fetchMetricsReport_closesOriginalBodyOnErrorResponse(t *testing.T) {
 	t.Parallel()
 	client, mux, _ := setup(t)
diff --git a/github/github.go b/github/github.go
index efb4c677..bfa0bd10 100644
--- a/github/github.go
+++ b/github/github.go
@@ -1282,13 +1282,9 @@ func (c *Client) bareDo(caller *http.Client, req *http.Request) (*Response, erro
 		c.rateMu.Unlock()
 	}
 
-	// CheckResponse substitutes r.Body with a re-readable copy on error
-	// responses, so capture the network body first: it is the one that must
-	// be closed.
-	origBody := resp.Body
 	err = CheckResponse(resp)
 	if err != nil {
-		defer origBody.Close()
+		defer resp.Body.Close()
 		// Special case for AcceptedErrors. If an AcceptedError
 		// has been encountered, the response's payload will be
 		// added to the AcceptedError and returned.
@@ -1795,11 +1791,9 @@ func (e *Error) UnmarshalJSON(data []byte) error {
 // API error responses are expected to have response
 // body, and a JSON response body that maps to [ErrorResponse].
 //
-// On error responses other than 202 Accepted, CheckResponse consumes r.Body
-// and replaces it with an in-memory copy so that the error body can be
-// re-read. Closing r.Body after CheckResponse returns therefore closes only
-// the copy: to release the original body and its underlying connection,
-// capture r.Body before the call and close the captured body instead.
+// On error responses other than 202 Accepted, CheckResponse consumes and
+// closes r.Body, then replaces it with an in-memory copy so that the error
+// body can be re-read by the caller.
 //
 // The error type will be *[RateLimitError] for rate limit exceeded errors,
 // *[AcceptedError] for 202 Accepted status codes,
@@ -1822,9 +1816,11 @@ func CheckResponse(r *http.Response) error {
 			errorResponse = &ErrorResponse{Response: r}
 		}
 	}
-	// Re-populate error response body because GitHub error responses are often
-	// undocumented and inconsistent.
+	// Close the original body and re-populate the error response body with an
+	// in-memory copy, because GitHub error responses are often undocumented and
+	// inconsistent and the caller may need to re-read them.
 	// Issue #1136, #540.
+	_ = r.Body.Close()
 	r.Body = io.NopCloser(bytes.NewBuffer(data))
 	switch {
 	case r.StatusCode == http.StatusUnauthorized && strings.HasPrefix(r.Header.Get(headerOTP), "required"):
diff --git a/github/github_test.go b/github/github_test.go
index 776abaf4..77b346c6 100644
--- a/github/github_test.go
+++ b/github/github_test.go
@@ -2308,8 +2308,8 @@ func (r *closeRecorder) Close() error {
 	return r.ReadCloser.Close()
 }
 
-// CheckResponse substitutes resp.Body with a re-readable copy on error
-// responses; the network body it replaces must still be closed.
+// CheckResponse closes the original resp.Body and substitutes a re-readable
+// copy on error responses; the network body must not leak.
 func TestDo_closesOriginalBodyOnErrorResponse(t *testing.T) {
 	t.Parallel()
 	client, mux, _ := setup(t)
diff --git a/github/repos_releases.go b/github/repos_releases.go
index 3361a5d7..889afb6d 100644
--- a/github/repos_releases.go
+++ b/github/repos_releases.go
@@ -375,12 +375,8 @@ func (s *RepositoriesService) downloadReleaseAssetFromURL(ctx context.Context, f
 	if err != nil {
 		return nil, err
 	}
-	// CheckResponse substitutes resp.Body with a re-readable copy on error
-	// responses, so capture the original body first: it is the one that must
-	// be closed.
-	origBody := resp.Body
 	if err := CheckResponse(resp); err != nil {
-		_ = origBody.Close()
+		_ = resp.Body.Close()
 		return nil, err
 	}
 	return resp.Body, nil
diff --git a/github/repos_releases_test.go b/github/repos_releases_test.go
index 4fb85c75..4208513d 100644
--- a/github/repos_releases_test.go
+++ b/github/repos_releases_test.go
@@ -537,9 +537,9 @@ func TestRepositoriesService_DownloadReleaseAsset_FollowRedirectToError(t *testi
 	}
 }
 
-// CheckResponse substitutes resp.Body with a re-readable copy on error
-// responses; downloadReleaseAssetFromURL must still close the original body it
-// replaces. Unlike its sibling tests, the recorder wraps the follow-redirects
+// CheckResponse closes the original resp.Body and substitutes a re-readable
+// copy on error responses; downloadReleaseAssetFromURL must not leak the
+// original body. Unlike its sibling tests, the recorder wraps the follow-redirects
 // client's transport: that client, not the library client, performs the
 // redirected request, so wrapping the library client would only ever observe
 // the first hop's correctly-closed redirect response and never the leak.