docs,ci: make dl.agora.io the canonical install URL

.github/workflows/sync-installers.yml

@@ -0,0 +1,53 @@
+name: Sync installers to S3
+
+# Keeps the canonical installer scripts on the dl.agora.io mirror in sync with
+# main. The mirror-to-s3 job in release.yml only uploads them on tag releases;
+# this syncs them whenever install.sh / install.ps1 change on main, so
+# https://dl.agora.io/cli/install.sh never lags the default branch.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - install.sh
+      - install.ps1
+
+permissions:
+  contents: read
+
+jobs:
+  sync-installers:
+    runs-on: ubuntu-latest
+    env:
+      AWS_REGION: us-east-1
+      S3_BUCKET: dl-agora-io
+      S3_PREFIX: cli
+      CF_DISTRIBUTION_ID: E2U1WWAZBG33XY
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Upload installer scripts (mutable)
+        shell: bash
+        run: |
+          set -euo pipefail
+          base="s3://${S3_BUCKET}/${S3_PREFIX}"
+          aws s3 cp install.sh  "${base}/install.sh"  --cache-control "public, max-age=300" --content-type "text/x-shellscript"
+          aws s3 cp install.ps1 "${base}/install.ps1" --cache-control "public, max-age=300" --content-type "text/plain"
+          echo "Synced install.sh / install.ps1 to ${base}/"
+
+      - name: Invalidate CloudFront
+        shell: bash
+        run: |
+          set -euo pipefail
+          aws cloudfront create-invalidation \
+            --distribution-id "${CF_DISTRIBUTION_ID}" \
+            --paths "/${S3_PREFIX}/install.sh" "/${S3_PREFIX}/install.ps1"
+          echo "Invalidated /${S3_PREFIX}/install.sh and /${S3_PREFIX}/install.ps1"

README.md

@@ -19,7 +19,7 @@ Native Agora CLI for authentication, project management, quickstart setup, and d
 ### Install the CLI
 
 ```bash
-curl -fsSL https://agoraio.github.io/cli/install.sh | sh
+curl -fsSL https://dl.agora.io/cli/install.sh | sh
 ```
 
 Run the CLI:
@@ -28,38 +28,36 @@ Run the CLI:
 agora --help
 ```
 
-Alternative install paths:
+The script is served from the Agora CDN (`dl.agora.io`, CloudFront). Binaries download from GitHub by default and automatically fall back to the CDN mirror if GitHub is unreachable; downloads are verified against `checksums.txt` regardless of source.
+
+Windows PowerShell:
+
+```powershell
+irm https://dl.agora.io/cli/install.ps1 | iex
+```
+
+Alternative install paths (GitHub-hosted; use `install.ps1` for PowerShell):
 
 ```bash
-# Windows PowerShell
-irm https://agoraio.github.io/cli/install.ps1 | iex
+# GitHub Pages
+curl -fsSL https://agoraio.github.io/cli/install.sh | sh
+# raw GitHub
+curl -fsSL https://raw.githubusercontent.com/AgoraIO/cli/main/install.sh | sh
 ```
 
 Locked-down environments that block `curl | sh` can use npm, download a release archive from GitHub, or mirror the binary internally. Every release includes `checksums.txt`, a Cosign keyless signature, and an SBOM; see [docs/install.md](docs/install.md#enterprise--locked-down-environments) for manual tarball, checksum, and Cosign verification steps.
 
-When GitHub is unreachable (blocked region, API rate limit, transient outage), the installer automatically falls back to the Agora mirror at `dl.agora.io` (CloudFront), and downloads are still verified against `checksums.txt`. See [Restricted networks](#restricted-networks-github-blocked) below.
-
 Notes:
 
 - The shell installer supports macOS, Linux, and Windows POSIX shells such as Git Bash. Use `install.ps1` for native PowerShell installs on Windows.
 - **Shell setup is auto-on**: the installer wires the install directory onto your `PATH` (when needed) and writes a shell completion script for the detected shell (bash, zsh, fish, or PowerShell). Pass `--no-path`, `--no-completion`, or the umbrella `--skip-shell` (PowerShell: `-NoPath` / `-NoCompletion` / `-SkipShell`) to opt out granularly.
-- Installer help is always available with `curl -fsSL https://agoraio.github.io/cli/install.sh | sh -s -- --help`.
+- Installer help is always available with `curl -fsSL https://dl.agora.io/cli/install.sh | sh -s -- --help`.
 - Pinned versions, dry runs, custom install directories, npm details, and source builds are documented in [docs/install.md](docs/install.md).
 - Release artifacts and checksums: [GitHub Releases](https://github.com/AgoraIO/cli/releases). Vulnerability disclosures: [SECURITY.md](SECURITY.md).
 
-Direct GitHub fallback:
-
-```bash
-# macOS, Linux, and Windows POSIX shells
-curl -fsSL https://raw.githubusercontent.com/AgoraIO/cli/main/install.sh | sh
-
-# Windows PowerShell
-irm https://raw.githubusercontent.com/AgoraIO/cli/main/install.ps1 | iex
-```
-
 ### Restricted networks (GitHub blocked)
 
-The installer fetches from GitHub by default and automatically falls back to the Agora mirror at `dl.agora.io` on failure. Where GitHub is **fully** blocked, the GitHub-hosted script URLs above are unreachable too — fetch the script from the mirror and skip GitHub entirely with `AGORA_INSTALL_SOURCE=s3`:
+The default command already fetches the install script from the Agora CDN (`dl.agora.io`), so it works even where GitHub is blocked. Binaries still download from GitHub first (with automatic fallback to the mirror); in a fully-blocked region, add `AGORA_INSTALL_SOURCE=s3` to skip GitHub entirely and avoid the failover delay:
 
 ```bash
 # macOS, Linux, and Windows POSIX shells

install.ps1

@@ -9,10 +9,11 @@
 #   - Documented exit-code contract (matches install.sh; see docs/install.md)
 #
 # Quick start:
-#   irm https://agoraio.github.io/cli/install.ps1 | iex
+#   irm https://dl.agora.io/cli/install.ps1 | iex
 #
-# Restricted networks (GitHub blocked): auto-falls back to the dl.agora.io
-# mirror; where GitHub is fully blocked, fetch the script from the mirror too:
+# Restricted networks (GitHub blocked): the script is served from the dl.agora.io
+# CDN, and binaries auto-fall back to the mirror. In a fully-blocked region, skip
+# GitHub for binaries too:
 #   $env:AGORA_INSTALL_SOURCE='s3'; irm https://dl.agora.io/cli/install.ps1 | iex
 #
 # Pin a version:

install.sh

@@ -2,10 +2,11 @@
 # Agora CLI installer for macOS, Linux, and Windows POSIX shells.
 #
 # Quick start:
-#   curl -fsSL https://agoraio.github.io/cli/install.sh | sh
+#   curl -fsSL https://dl.agora.io/cli/install.sh | sh
 #
-# Restricted networks (GitHub blocked): auto-falls back to the dl.agora.io
-# mirror; where GitHub is fully blocked, fetch the script from the mirror too:
+# Restricted networks (GitHub blocked): the script is served from the dl.agora.io
+# CDN, and binaries auto-fall back to the mirror. In a fully-blocked region, skip
+# GitHub for binaries too:
 #   curl -fsSL https://dl.agora.io/cli/install.sh | AGORA_INSTALL_SOURCE=s3 sh
 #
 # Pin a version:
@@ -46,7 +47,7 @@ AGORA_INSTALL_SOURCE="${AGORA_INSTALL_SOURCE:-auto}"
 RELEASES_PAGE_URL="${RELEASES_PAGE_URL:-https://github.com/${GITHUB_REPO}/releases}"
 DOCS_URL="${DOCS_URL:-https://github.com/${GITHUB_REPO}#readme}"
 ISSUES_URL="${ISSUES_URL:-https://github.com/${GITHUB_REPO}/issues}"
-INSTALLER_BASE_URL="${INSTALLER_BASE_URL:-https://agoraio.github.io/cli}"
+INSTALLER_BASE_URL="${INSTALLER_BASE_URL:-https://dl.agora.io/cli}"
 AUTH_TOKEN="${GITHUB_TOKEN:-${GH_TOKEN:-}}"
 NO_COLOR_ENV="${NO_COLOR:-}"
 

scripts/prepare-pages-site.py

@@ -25,8 +25,8 @@
 DEFAULTS = {
     "CLI_DOCS_BASE_URL": "https://agoraio.github.io/cli",
     "CLI_DOCS_MD_BASE_URL": "https://agoraio.github.io/cli/md",
-    "CLI_INSTALL_SH_URL": "https://agoraio.github.io/cli/install.sh",
-    "CLI_INSTALL_PS1_URL": "https://agoraio.github.io/cli/install.ps1",
+    "CLI_INSTALL_SH_URL": "https://dl.agora.io/cli/install.sh",
+    "CLI_INSTALL_PS1_URL": "https://dl.agora.io/cli/install.ps1",
     "CLI_INSTALL_SH_FALLBACK_URL": "https://raw.githubusercontent.com/AgoraIO/cli/main/install.sh",
     "CLI_INSTALL_PS1_FALLBACK_URL": "https://raw.githubusercontent.com/AgoraIO/cli/main/install.ps1",
 }

scripts/test-installer-messages.sh

@@ -72,7 +72,7 @@ run_case() {
     GREEN=""
     DOCS_URL="https://github.com/AgoraIO/cli#readme"
     GITHUB_REPO="AgoraIO/cli"
-    INSTALLER_BASE_URL="https://agoraio.github.io/cli"
+    INSTALLER_BASE_URL="https://dl.agora.io/cli"
     HOME=$home_dir
     SHELL=$shell_path
     INSTALL_DIR=$install_dir
@@ -129,7 +129,7 @@ assert_contains "$bash_walk_output" "Added $TMPROOT/bash-walk/home/.local/bin to
 canonical_installer_url_output=$(run_case "canonical-installer-url" "/bin/sh" '
   installer_script_url
 ')
-assert_contains "$canonical_installer_url_output" "https://agoraio.github.io/cli/install.sh"
+assert_contains "$canonical_installer_url_output" "https://dl.agora.io/cli/install.sh"
 
 fork_installer_url_output=$(run_case "fork-installer-url" "/bin/sh" '
   GITHUB_REPO="Example/fork"