From c3ddcb336a35f8dae41f46989d0810ee97f8f8f4 Mon Sep 17 00:00:00 2001 From: Jason Ross Date: Tue, 26 May 2026 13:37:48 -0500 Subject: [PATCH] Forward GITHUB_TOKEN into Linux Dagger containers for API auth Add env: GITHUB_TOKEN to the Linux workflow step, then read it in ci/main.go and inject it into each test container via WithSecretVariable (for both GITHUB_TOKEN and GH_TOKEN). This prevents 403 rate-limit errors on GitHub API calls (neovim/nvm releases) and authenticates gh CLI for gh extension install inside the containers. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/integration.yml | 2 ++ ci/main.go | 8 ++++++++ 2 files changed, 10 insertions(+) diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml index b3e89fd..4d99e67 100644 --- a/.github/workflows/integration.yml +++ b/.github/workflows/integration.yml @@ -29,6 +29,8 @@ jobs: go-version: '1.25.x' - name: Run Dagger Integration Pipeline + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | go run ci/main.go --os ${{ matrix.os }} diff --git a/ci/main.go b/ci/main.go index 2e5308e..ad14491 100644 --- a/ci/main.go +++ b/ci/main.go @@ -88,6 +88,14 @@ func main() { WithFile("/usr/local/bin/bootstrap_environment", binaryFile). WithWorkdir("/tmp") + // Forward GitHub token so API calls are authenticated (avoids 403 rate-limits) + if tok := os.Getenv("GITHUB_TOKEN"); tok != "" { + secret := client.SetSecret("github-token", tok) + testContainer = testContainer. + WithSecretVariable("GITHUB_TOKEN", secret). + WithSecretVariable("GH_TOKEN", secret) + } + // 4. Run bootstrap binary with safe args: --only custom --no-vm --no-ai // We pipe 'y' to satisfy the "Proceed? [y/N]" prompt. fmt.Printf("[%s] Executing bootstrap_environment...\n", target)