fix(build): use GITHUB_TOKEN for curl when needed (#2808)

Author: ledif

.github/workflows/reusable-build.yml

@@ -73,8 +73,10 @@ jobs:
       - name: Build Image
         id: build-image
         shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          sudo $(command -v just) repo_organization="${{ github.repository_owner }}" \
+          sudo -E $(command -v just) repo_organization="${{ github.repository_owner }}" \
                     build-ghcr "${{ matrix.base_name }}" \
                                "${{ matrix.stream_name }}" \
                                "${{ matrix.image_flavor }}" \
@@ -105,8 +107,10 @@ jobs:
       - name: Rechunk Image
         id: rechunk-image
         shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          sudo $(command -v just) rechunk "${{ matrix.base_name }}" \
+          sudo -E $(command -v just) rechunk "${{ matrix.base_name }}" \
                             "${{ matrix.stream_name }}" \
                             "${{ matrix.image_flavor }}" \
                             "1"

Containerfile

@@ -27,6 +27,7 @@ ARG VERSION=""
 RUN --mount=type=cache,dst=/var/cache/libdnf5 \
     --mount=type=cache,dst=/var/cache/rpm-ostree \
     --mount=type=bind,from=ctx,source=/,target=/ctx \
+    --mount=type=secret,id=GITHUB_TOKEN \
     /ctx/build_files/shared/build-base.sh
 
 ## bluefin-dx developer edition image section
@@ -46,4 +47,5 @@ ARG VERSION=""
 RUN --mount=type=cache,dst=/var/cache/libdnf5 \
     --mount=type=cache,dst=/var/cache/rpm-ostree \
     --mount=type=bind,from=ctx,source=/,target=/ctx \
+    --mount=type=secret,id=GITHUB_TOKEN \
     /ctx/build_files/shared/build-dx.sh

Justfile

@@ -229,13 +229,17 @@ build $image="bluefin" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipelin
     echo "::group:: Build Container"
 
     # Build Image
-    ${PODMAN} build \
-        "${BUILD_ARGS[@]}" \
-        "${LABELS[@]}" \
-        --target "${target}" \
-        --tag localhost/"${image_name}:${tag}" \
-        --file Containerfile \
-        .
+    PODMAN_BUILD_ARGS=("${BUILD_ARGS[@]}" "${LABELS[@]}" --target "${target}" --tag localhost/"${image_name}:${tag}" --file Containerfile)
+
+    # Add GitHub token secret if available (for CI/CD)
+    if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+        echo "Adding GitHub token as build secret"
+        PODMAN_BUILD_ARGS+=(--secret "id=GITHUB_TOKEN,env=GITHUB_TOKEN")
+    else
+        echo "No GitHub token found - build may hit rate limit"
+    fi
+
+    ${PODMAN} build "${PODMAN_BUILD_ARGS[@]}" .
     echo "::endgroup::"
 
     # Rechunk

build_files/base/03-install-kernel-akmods.sh

@@ -99,7 +99,7 @@ if [[ "${IMAGE_NAME}" =~ nvidia ]]; then
     fi
 
     # Install Nvidia RPMs
-    curl -Lo /tmp/nvidia-install.sh https://raw.githubusercontent.com/ublue-os/main/main/build_files/nvidia-install.sh
+    ghcurl "https://raw.githubusercontent.com/ublue-os/main/main/build_files/nvidia-install.sh" -o /tmp/nvidia-install.sh
     chmod +x /tmp/nvidia-install.sh
     IMAGE_NAME="${BASE_IMAGE_NAME}" RPMFUSION_MIRROR="" /tmp/nvidia-install.sh
     rm -f /usr/share/vulkan/icd.d/nouveau_icd.*.json

build_files/base/05-override-install.sh

@@ -22,11 +22,11 @@ dnf5 -y swap \
     fwupd fwupd
 
 # Offline Bluefin documentation
-curl --retry 3 -Lo /tmp/bluefin.pdf https://github.com/ublue-os/bluefin-docs/releases/download/0.1/bluefin.pdf
+ghcurl "https://github.com/ublue-os/bluefin-docs/releases/download/0.1/bluefin.pdf" --retry 3 -o /tmp/bluefin.pdf
 install -Dm0644 -t /usr/share/doc/bluefin/ /tmp/bluefin.pdf
 
 # Starship Shell Prompt
-curl --retry 3 -Lo /tmp/starship.tar.gz "https://github.com/starship/starship/releases/latest/download/starship-x86_64-unknown-linux-gnu.tar.gz"
+ghcurl "https://github.com/starship/starship/releases/latest/download/starship-x86_64-unknown-linux-gnu.tar.gz" --retry 3 -o /tmp/starship.tar.gz
 tar -xzf /tmp/starship.tar.gz -C /tmp
 install -c -m 0755 /tmp/starship /usr/bin
 # shellcheck disable=SC2016

build_files/dx/04-override-install-dx.sh

@@ -4,13 +4,13 @@ echo "::group:: ===$(basename "$0")==="
 
 set -eoux pipefail
 
-curl --retry 3 -Lo /tmp/kind "https://github.com/kubernetes-sigs/kind/releases/latest/download/kind-$(uname)-amd64"
+ghcurl "https://github.com/kubernetes-sigs/kind/releases/latest/download/kind-$(uname)-amd64" --retry 3 -o /tmp/kind
 chmod +x /tmp/kind
 mv /tmp/kind /usr/bin/kind
 
 # GitHub Monaspace Font
-DOWNLOAD_URL=$(curl --retry 3 https://api.github.com/repos/githubnext/monaspace/releases/latest | jq -r '.assets[] | select(.name| test(".*.zip$")).browser_download_url')
-curl --retry 3 -Lo /tmp/monaspace-font.zip "$DOWNLOAD_URL"
+DOWNLOAD_URL=$(ghcurl "https://api.github.com/repos/githubnext/monaspace/releases/latest" --retry 3 | jq -r '.assets[] | select(.name| test(".*.zip$")).browser_download_url')
+ghcurl "$DOWNLOAD_URL" --retry 3 -o /tmp/monaspace-font.zip
 
 unzip -qo /tmp/monaspace-font.zip -d /tmp/monaspace-font
 mkdir -p /usr/share/fonts/monaspace
@@ -21,8 +21,8 @@ fc-cache -f /usr/share/fonts/monaspace
 fc-cache --system-only --really-force --verbose
 
 # ls-iommu helper tool for listing devices in iommu groups (PCI Passthrough)
-DOWNLOAD_URL=$(curl https://api.github.com/repos/HikariKnight/ls-iommu/releases/latest | jq -r '.assets[] | select(.name| test(".*x86_64.tar.gz$")).browser_download_url')
-curl --retry 3 -Lo /tmp/ls-iommu.tar.gz "$DOWNLOAD_URL"
+DOWNLOAD_URL=$(ghcurl "https://api.github.com/repos/HikariKnight/ls-iommu/releases/latest" | jq -r '.assets[] | select(.name| test(".*x86_64.tar.gz$")).browser_download_url')
+ghcurl "$DOWNLOAD_URL" --retry 3 -o /tmp/ls-iommu.tar.gz
 mkdir /tmp/ls-iommu
 tar --no-same-owner --no-same-permissions --no-overwrite-dir -xvzf /tmp/ls-iommu.tar.gz -C /tmp/ls-iommu
 mv /tmp/ls-iommu/ls-iommu /usr/bin/

build_files/shared/build-base.sh

@@ -20,6 +20,11 @@ install -Dm0644 -t /etc/ublue-os/ /ctx/iso_files/*.list
 cp -r /ctx/just /tmp/just
 cp /ctx/packages.json /tmp/packages.json
 rsync -rvK /ctx/system_files/shared/ /
+
+mkdir -p /tmp/scripts/helpers
+install -Dm0755 /ctx/build_files/shared/utils/ghcurl /tmp/scripts/helpers/ghcurl
+export PATH="/tmp/scripts/helpers:$PATH"
+
 echo "::endgroup::"
 
 # Generate image-info.json

build_files/shared/build-dx.sh

@@ -9,6 +9,11 @@ echo "::group:: Copy Files"
 # Copy Files to Image
 cp /ctx/packages.json /tmp/packages.json
 rsync -rvK /ctx/system_files/dx/ /
+
+mkdir -p /tmp/scripts/helpers
+install -Dm0755 /ctx/build_files/shared/utils/ghcurl /tmp/scripts/helpers/ghcurl
+export PATH="/tmp/scripts/helpers:$PATH"
+
 echo "::endgroup::"
 
 # Apply IP Forwarding before installing Docker to prevent messing with LXC networking

build_files/shared/utils/ghcurl

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Check for GITHUB_TOKEN in /run/secrets/GITHUB_TOKEN (Podman secret mount)
+if [[ -f /run/secrets/GITHUB_TOKEN ]]; then
+  GITHUB_TOKEN=$(< /run/secrets/GITHUB_TOKEN)
+  echo "Using GITHUB_TOKEN from /run/secrets/GITHUB_TOKEN for authentication." >&2
+  AUTH_HEADER="Authorization: Bearer $GITHUB_TOKEN"
+else
+  echo "GITHUB_TOKEN secret not found. Using unauthenticated requests." >&2
+  AUTH_HEADER=""
+fi
+
+URL="$1"
+shift
+OPTIONS=("$@")
+
+if [[ -n "$AUTH_HEADER" ]]; then
+  curl -sSL -H "$AUTH_HEADER" "${OPTIONS[@]}" "$URL"
+else
+  curl -sSL "${OPTIONS[@]}" "$URL"
+fi