diff options
| author | tranch <tranch.xiao@gmail.com> | 2026-08-27 04:37:18 +0800 |
|---|---|---|
| committer | tranch <tranch.xiao@gmail.com> | 2026-08-27 04:37:18 +0800 |
| commit | 8774e3cf7db1f8ad37e659017f6b363f54f9d79d (patch) | |
| tree | ddb2fa053d5d27f5e2cce20ea39dc85b71823e6b /Justfile | |
| parent | 5bf694571bd0a13873e7326a55995969bd7a0759 (diff) | |
| download | AeroCore-OS-8774e3cf7db1f8ad37e659017f6b363f54f9d79d.tar.gz AeroCore-OS-8774e3cf7db1f8ad37e659017f6b363f54f9d79d.zip | |
fix: authenticate Booster release downloads
Mount the CI token as a build secret for release asset requests.
Diffstat (limited to 'Justfile')
| -rw-r--r-- | Justfile | 4 |
1 files changed, 3 insertions, 1 deletions
@@ -168,7 +168,9 @@ build $target_image=image_name $tag=default_tag: LABELS+=("--label" "org.opencontainers.image.vendor={{ repo_organization }}") # This actually builds the image! - PODMAN_BUILD_ARGS=("${BUILD_CHANNEL_ARGS[@]}" "${BUILD_ARGS[@]}" "${LABELS[@]}" --pull=newer --tag "${target_image}:${tag}" --file Containerfile) + # The build always exposes a secret mount. Local builds use /dev/null; + # CI supplies a short-lived GitHub token file for private release assets. + PODMAN_BUILD_ARGS=("${BUILD_CHANNEL_ARGS[@]}" "${BUILD_ARGS[@]}" "${LABELS[@]}" --secret "id=GITHUB_TOKEN,src=${GITHUB_TOKEN_FILE:-/dev/null}" --pull=newer --tag "${target_image}:${tag}" --file Containerfile) podman build "${PODMAN_BUILD_ARGS[@]}" . |