diff options
| author | tranch <tranch.xiao@gmail.com> | 2026-08-27 04:37:18 +0800 |
|---|---|---|
| committer | tranch <tranch.xiao@gmail.com> | 2026-08-27 04:37:18 +0800 |
| commit | 8774e3cf7db1f8ad37e659017f6b363f54f9d79d (patch) | |
| tree | ddb2fa053d5d27f5e2cce20ea39dc85b71823e6b | |
| parent | 5bf694571bd0a13873e7326a55995969bd7a0759 (diff) | |
| download | AeroCore-OS-8774e3cf7db1f8ad37e659017f6b363f54f9d79d.tar.gz AeroCore-OS-8774e3cf7db1f8ad37e659017f6b363f54f9d79d.zip | |
fix: authenticate Booster release downloads
Mount the CI token as a build secret for release asset requests.
| -rw-r--r-- | .github/workflows/build.yml | 7 | ||||
| -rw-r--r-- | Containerfile | 1 | ||||
| -rw-r--r-- | Justfile | 4 |
3 files changed, 10 insertions, 2 deletions
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 908a18f..98f9c15 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -136,6 +136,7 @@ jobs: - name: Build Image id: build-image env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} BASE_IMAGE: ${{ vars.BASE_IMAGE || 'ghcr.io/ublue-os/bazzite-deck:stable' }} FLATPAK_REMOTE_URL: ${{ vars.FLATPAK_REMOTE_URL }} HOMEBREW_BOTTLE_DOMAIN: ${{ vars.HOMEBREW_BOTTLE_DOMAIN }} @@ -146,7 +147,11 @@ jobs: INSTRUMENTS_VERSION: ${{ vars.INSTRUMENTS_VERSION || 'latest' }} INSTRUMENTS_RELEASE_API_BASE: ${{ vars.INSTRUMENTS_RELEASE_API_BASE || 'https://api.github.com' }} run: | - sudo -E "$(command -v just)" build \ + GITHUB_TOKEN_FILE="${RUNNER_TEMP}/aerocore-build-github-token" + umask 077 + printf '%s' "${GITHUB_TOKEN}" > "${GITHUB_TOKEN_FILE}" + trap 'rm -f "${GITHUB_TOKEN_FILE}"' EXIT + sudo GITHUB_TOKEN_FILE="${GITHUB_TOKEN_FILE}" "$(command -v just)" build \ "${IMAGE_NAME}" \ "${DEFAULT_TAG}" diff --git a/Containerfile b/Containerfile index 71bf132..9eb1b28 100644 --- a/Containerfile +++ b/Containerfile @@ -44,6 +44,7 @@ ARG INSTRUMENTS_RELEASE_API_BASE="https://api.github.com" RUN --mount=type=bind,from=ctx,source=/,target=/ctx \ --mount=type=cache,dst=/var/cache \ --mount=type=cache,dst=/var/log \ + --mount=type=secret,id=GITHUB_TOKEN \ --mount=type=tmpfs,dst=/tmp \ /ctx/build.sh && \ /ctx/image-info && \ @@ -168,7 +168,9 @@ build $target_image=image_name $tag=default_tag: LABELS+=("--label" "org.opencontainers.image.vendor={{ repo_organization }}") # This actually builds the image! - PODMAN_BUILD_ARGS=("${BUILD_CHANNEL_ARGS[@]}" "${BUILD_ARGS[@]}" "${LABELS[@]}" --pull=newer --tag "${target_image}:${tag}" --file Containerfile) + # The build always exposes a secret mount. Local builds use /dev/null; + # CI supplies a short-lived GitHub token file for private release assets. + PODMAN_BUILD_ARGS=("${BUILD_CHANNEL_ARGS[@]}" "${BUILD_ARGS[@]}" "${LABELS[@]}" --secret "id=GITHUB_TOKEN,src=${GITHUB_TOKEN_FILE:-/dev/null}" --pull=newer --tag "${target_image}:${tag}" --file Containerfile) podman build "${PODMAN_BUILD_ARGS[@]}" . |