chore: Fix local scie builds

Both CI and local builds should work!

Author: achimnol

changes/.fix.md

@@ -0,0 +1 @@
+Forward `SCIENCE_AUTH_GITHUB_COM_BEARER` (and `SCIENCE_AUTH_API_GITHUB_COM_BEARER`) to Pants subprocesses so local scie builds (e.g. `pants package src/ai/backend/client:backendai-client-fat`) can authenticate the `science` binary against GitHub. Without a token, anonymous GitHub rate limits cause the scie-jump `.sha256` URL to return an HTML error page, surfacing as a checksum failure with `<!DOCTYPE` inside the compared digest.

pants.ci.toml

@@ -8,8 +8,5 @@ search_path = ["<PATH>"]
 [stats]
 log = true
 
-[subprocess-environment]
-env_vars.add = ["SCIENCE_AUTH_API_GITHUB_COM_BEARER"]
-
 [pytest]
 args = ["-vv", "--no-header", "--suppress-no-test-exit-code"]

pants.toml

@@ -42,6 +42,17 @@ root_patterns = [
     "/tools/pants-plugins",
 ]
 
+[subprocess-environment]
+# Forward optional GitHub auth tokens used by the `science` binary during scie
+# builds. Without these, science calls GitHub anonymously and can hit the per-IP
+# rate limit (the response is HTML, which then surfaces as a checksum failure
+# with `<!DOCTYPE` in the digest). Set either env var to a GitHub PAT in your
+# shell to authenticate scie-jump/ptex/PBS downloads.
+env_vars.add = [
+    "SCIENCE_AUTH_GITHUB_COM_BEARER",
+    "SCIENCE_AUTH_API_GITHUB_COM_BEARER",
+]
+
 [test]
 extra_env_vars = ["BACKEND_BUILD_ROOT=%(buildroot)s", "HOME"]
 attempts_default = 3