From 8774e3cf7db1f8ad37e659017f6b363f54f9d79d Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Thu, 27 Aug 2026 04:37:18 +0800
Subject: fix: authenticate Booster release downloads

Mount the CI token as a build secret for release asset requests.
---
 Justfile | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'Justfile')

diff --git a/Justfile b/Justfile
index 96b988f..9a9c75a 100644
--- a/Justfile
+++ b/Justfile
@@ -168,7 +168,9 @@ build $target_image=image_name $tag=default_tag:
     LABELS+=("--label" "org.opencontainers.image.vendor={{ repo_organization }}")
 
     # This actually builds the image!
-    PODMAN_BUILD_ARGS=("${BUILD_CHANNEL_ARGS[@]}" "${BUILD_ARGS[@]}" "${LABELS[@]}" --pull=newer --tag "${target_image}:${tag}" --file Containerfile)
+    # The build always exposes a secret mount.  Local builds use /dev/null;
+    # CI supplies a short-lived GitHub token file for private release assets.
+    PODMAN_BUILD_ARGS=("${BUILD_CHANNEL_ARGS[@]}" "${BUILD_ARGS[@]}" "${LABELS[@]}" --secret "id=GITHUB_TOKEN,src=${GITHUB_TOKEN_FILE:-/dev/null}" --pull=newer --tag "${target_image}:${tag}" --file Containerfile)
 
     podman build "${PODMAN_BUILD_ARGS[@]}" .
 
-- 
cgit v1.2.3