From 4b6e15afcde43d6a101ce01fc22d7a029f66cbef Mon Sep 17 00:00:00 2001 From: anshul23102 Date: Thu, 28 May 2026 23:38:22 +0530 Subject: [PATCH] ci(render-quarto): pass GITHUB_TOKEN as BuildKit secret to avoid API rate limit The Docker build step in render-quarto.yml runs make inside the container, which calls confirm_deps.R -> remotes::install_deps() when any package dependency is not already present in pecan/depends:latest. Those calls hit the unauthenticated GitHub API and fail with HTTP 403 when concurrent CI jobs exhaust the 60 req/hr limit. Fix: enable Docker BuildKit and pass GITHUB_TOKEN from the GitHub Actions environment as a BuildKit secret (id=GITHUB_PAT). The secret is mounted read-only inside the single RUN layer via --mount=type=secret, exported as GITHUB_PAT (the variable remotes respects), and never written into any image layer, so it does not appear in docker history or image metadata. --- .github/workflows/render-quarto.yml | 8 +++++++- docker/base/Dockerfile | 4 +++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/render-quarto.yml b/.github/workflows/render-quarto.yml index 5e7d9c8b7e2..c47cfaa465b 100644 --- a/.github/workflows/render-quarto.yml +++ b/.github/workflows/render-quarto.yml @@ -20,8 +20,14 @@ jobs: uses: actions/checkout@v6 - name: Build PEcAn base Docker image + env: + DOCKER_BUILDKIT: "1" + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | - docker build -t pecan-base-ci:latest -f docker/base/Dockerfile . + docker build \ + --secret id=GITHUB_PAT,env=GITHUB_TOKEN \ + -t pecan-base-ci:latest \ + -f docker/base/Dockerfile . - name: Set up Quarto uses: quarto-dev/quarto-actions/setup@v2 diff --git a/docker/base/Dockerfile b/docker/base/Dockerfile index 19a2692ef2d..2c613000129 100644 --- a/docker/base/Dockerfile +++ b/docker/base/Dockerfile @@ -25,7 +25,9 @@ COPY models /pecan/models/ # install all PEcAn packages # `make clean` is to remove artifacts copied in from host system # (e.g. basgra.so) -RUN cd /pecan \ +RUN --mount=type=secret,id=GITHUB_PAT \ + export GITHUB_PAT=$(cat /run/secrets/GITHUB_PAT 2>/dev/null || true) \ + && cd /pecan \ && make clean \ && make \ && rm -rf /tmp/downloaded_packages