Download release from another repo using CI_JOB_TOKEN

Hello,

I’m trying to download a release / tag / commit in one repo from another using the CI_JOB_TOKEN. My application code is in one repo and I use Packer to build an AMI from it. I prefer to keep the Packer code separate from the application code.

I see from this page that there are a limited number of operations that can be performed using the CI_JOB_TOKEN (compared to a personal access token)

I can see from get-a-release-by-a-tag-name that a zip file exists.

({'format': 'zip',
  'url': 'https://gitlab.example.com/group/project/-/archive/v1.0/project-v1.0.zip'},
 {'format': 'tar.gz',
  'url': 'https://gitlab.example.com/group/project/-/archive/v1.0/project-v1.0.tar.gz'},
 {'format': 'tar.bz2',
  'url': 'https://gitlab.example.com/group/project/-/archive/v1.0/project-v1.0.tar.bz2'},
 {'format': 'tar',
  'url': 'https://gitlab.example.com/group/project/-/archive/v1.0/project-v1.0.tar'})

but when i try using download-a-release-asset i can’t seem to figure out what the path should be

$ curl --header "PRIVATE-TOKEN: $GITLAB_ACCESS_TOKEN" "https://gitlab.example.com/api/v4/projects/278/releases/v1.0/downloads/project-v1.0.zip"
{"message":"404 Not found"}
$ curl --header "PRIVATE-TOKEN: $GITLAB_ACCESS_TOKEN" "https://gitlab.example.com/api/v4/projects/278/releases/v1.0/downloads/v1.0/project-v1.0.zip"
{"message":"404 Not found"}
$ curl --header "PRIVATE-TOKEN: $GITLAB_ACCESS_TOKEN" "https://gitlab.example.com/api/v4/projects/278/releases/v1.0/downloads/archive/v1.0/project-v1.0.zip"
{"message":"404 Not found"}

Any help with what is presumably a stupid mistake on my part would be gratefully received

I appreciate it may seem odd that I’m mentioning the CI_JOB_TOKEN and then my examples seem to use a personal access token. My rationale is that it’s simpler to get it working with a personal access token locally. Once I find something that works, I’ll put it in a pipeline job and use the CI_JOB_TOKEN