feat(docker): Allow authenticated calls to GitHub API during `docker build` #947

wI2L · 2025-11-16T18:34:34Z

Accept build arg GITHUB_TOKEN to authenticate calls made to GitHub API in common::install_from_gh_release function.

Closes #946

Put an x into the box if that apply:

This PR introduces breaking change.
This PR fixes a bug.
This PR adds new functionality.
This PR enhances existing functionality.

Description of your changes

Accept build arg GITHUB_TOKEN to authenticate calls made to GitHub API in common::install_from_gh_release function.

How can we test changes

Generate a GitHub PAT and export it in your env.
Run docker build -t pre-commit-terraform --build-arg GITHUB_TOKEN --build-arg INSTALL_ALL=true . to build the pre-commit, using the PAT during build time to authenticate calls.

coderabbitai · 2025-11-16T18:35:02Z

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

📝 Walkthrough

Summary by CodeRabbit

Chores
- Build process now supports optional GitHub token authentication via build arguments, helping reduce rate limiting issues when resolving package releases during installation.
Documentation
- Added build instructions with examples showing how to provide GitHub authentication credentials using docker build arguments for improved API access.

Walkthrough

Added optional build-time GitHub token support: Dockerfile declares ARG GITHUB_TOKEN, install script tools/install/_common.sh uses it to add an Authorization header to curl requests when present, and README.md documents how to pass the token during docker build. (37 words)

Changes

Cohort / File(s)	Summary
Dockerfile (build args) `Dockerfile`	Added `ARG GITHUB_TOKEN=${GITHUB_TOKEN:-""}` to accept a GitHub token at build time; no ENV export added.
Install scripts `tools/install/_common.sh`	Replaced direct curl calls with a unified `CURL_CMD`/`CURL_OPTS` that conditionally includes `Authorization: Bearer <token>` when `GITHUB_TOKEN` is set; preserves `-L` and existing parsing behavior.
Documentation `README.md`	Documented that build install scripts call GitHub to resolve release URLs and added an example `docker build --build-arg GITHUB_TOKEN=...` to provide a token for authenticated requests.

Sequence Diagram(s)

sequenceDiagram
    participant User
    participant DockerBuild as Docker Build
    participant InstallScript as tools/install/_common.sh
    participant GitHubAPI as GitHub API

    User->>DockerBuild: docker build --build-arg GITHUB_TOKEN=ghp_***
    DockerBuild->>InstallScript: ARG GITHUB_TOKEN available at build-time
    InstallScript->>InstallScript: detect if GITHUB_TOKEN set
    alt token present
        InstallScript->>GitHubAPI: curl -H "Authorization: Bearer <token>" -L ...
    else no token
        InstallScript->>GitHubAPI: curl -L ...
    end
    GitHubAPI-->>InstallScript: release JSON / redirect URL
    InstallScript-->>DockerBuild: resolved release URL
    DockerBuild-->>User: image built

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Review items:
- Ensure ARG GITHUB_TOKEN default/quoting is correct and intentionally not exported as ENV.
- Verify CURL_OPTS/CURL_CMD preserves -L and existing parsing (redirects and piping).
- Check that tokens are not printed or logged (no accidental exposure in shell traces).
- Validate README example for correctness.

Pre-merge checks and finishing touches

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains that the PR adds support for a GITHUB_TOKEN build argument to authenticate GitHub API calls in the common::install_from_gh_release function, directly relating to the changeset.
Linked Issues check	✅ Passed	The PR successfully implements the objectives from issue #946: it adds GITHUB_TOKEN support to Dockerfile, documents the feature in README, and implements token-based Authorization header in the bash function to authenticate GitHub API calls.
Out of Scope Changes check	✅ Passed	All changes are scoped to the stated objectives: Dockerfile build argument addition, README documentation, and bash function enhancement for authenticated API calls.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Title check	✅ Passed	The title clearly summarizes the main change: enabling authenticated GitHub API calls during Docker builds via GITHUB_TOKEN support.

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull Request Overview

This PR adds support for authenticated GitHub API calls during Docker image builds by accepting a GITHUB_TOKEN build argument. This addresses API rate limiting issues when installing tools from GitHub releases.

Key Changes:

Modified the common::install_from_gh_release function to conditionally include GitHub token authentication in curl requests
Added GITHUB_TOKEN as a build argument and environment variable in the Dockerfile
Updated documentation with instructions for using the GitHub token during builds

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
tools/install/_common.sh	Modified curl commands to conditionally include Authorization header when GITHUB_TOKEN is set
Dockerfile	Added GITHUB_TOKEN as a build argument and environment variable
README.md	Added documentation note explaining how to use GITHUB_TOKEN for authenticated API calls

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-11-16T18:35:02Z

tools/install/_common.sh

  local -r RELEASES="https://api.github.com/repos/${GH_ORG}/${TOOL}/releases"
+  local CURL_OPTS=()
+
+  [[ "$GITHUB_TOKEN" ]] && CURL_OPTS+=('-H' "Authorization: Bearer $GITHUB_TOKEN")


The GITHUB_TOKEN is not quoted in the Authorization header value. If the token contains spaces or special characters, this could lead to unexpected behavior or header injection. Wrap the variable in quotes: \"Authorization: Bearer ${GITHUB_TOKEN}\"

Suggested change

[[ "$GITHUB_TOKEN" ]] && CURL_OPTS+=('-H' "Authorization: Bearer $GITHUB_TOKEN")

[[ "$GITHUB_TOKEN" ]] && CURL_OPTS+=('-H' "Authorization: Bearer \"$GITHUB_TOKEN\"")

README.md

wI2L · 2025-11-16T18:40:06Z

I don't understand the CI logs, nor do I see how that's related to my changes.

yermulnik

LGTM
@wI2L Have you tested it works as expected with both set and unset GITHUB_TOKEN env var (and respectively with both --build-arg GITHUB_TOKEN present and absent)? Thanks

tools/install/_common.sh

wI2L · 2025-11-16T20:43:03Z

@yermulnik Yes I did, with a set -eux directive in the modified function (that I later removed). I'll provide the build logs of the different scenarios tomorrow, along with the requested syntax/doc changes 👍

coderabbitai

Actionable comments posted: 1

🧹 Nitpick comments (1)

Dockerfile (1)

68-69: Correct token propagation to build environment.

The ARG and ENV declarations properly propagate the GitHub token into the builder stage environment where the install scripts will access it. The empty default ensures backward compatibility.

Operational note: For enhanced security in CI/CD pipelines, consider using Docker BuildKit secrets (--secret GITHUB_TOKEN) instead of build arguments, which prevents the token from being visible in layer metadata. This approach keeps the token out of image history while still making it available during builds.

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 7058185 and 76b30ac.

📒 Files selected for processing (3)

Dockerfile (1 hunks)
README.md (1 hunks)
tools/install/_common.sh (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

README.md

🧰 Additional context used

🧠 Learnings (1)

📚 Learning: 2025-08-12T19:43:31.295Z

Learnt from: actuarysailor
Repo: antonbabenko/pre-commit-terraform PR: 925
File: Dockerfile.tools:92-108
Timestamp: 2025-08-12T19:43:31.295Z
Learning: In Dockerfile.tools, the version checking script at the end of the builder stage is intentionally designed to download the latest versions of tools when not specified in build args and echo the installed versions for verification/debugging purposes during the build process. This behavior is by design to track what actual tool versions end up in the container.

Applied to files:

tools/install/_common.sh
Dockerfile

🔇 Additional comments (2)

tools/install/_common.sh (2)

65-69: Proper token-aware curl construction.

The CURL_OPTS array pattern correctly builds curl options conditionally based on GITHUB_TOKEN presence, and the Authorization header format is correct for GitHub API authentication. The quoting approach aligns with previous feedback.

72-72: Correct nested curl invocations with token support.

The nested curl pattern is correct: inner call retrieves the release asset URL (with auth header if token present), outer call downloads the asset. The array expansion "${CURL_CMD[@]}" properly passes all curl options including the Authorization header to both calls.

Also applies to: 74-74

coderabbitai · 2025-11-17T08:28:46Z

tools/install/_common.sh

      ;;
  esac

+  set -eux


⚠️ Potential issue | 🟡 Minor

Remove debug flag: set -eux should be deleted.

The set -eux flag enables verbose command output (-x) which will clutter build logs during tool installations. The PR description states you previously added this for debugging and then removed it, but it's still present in the code. Remove this line to keep build output clean.

- set -eux - # Download tool

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

set -eux

🤖 Prompt for AI Agents

In tools/install/_common.sh around line 61, remove the debug flag invocation "set -eux" (or replace it with a minimal safe set like "set -e" if you want to keep exit-on-error), so that the script no longer enables verbose command tracing (-x) which clutters build logs; update the file to delete that line and run a quick lint/run of the installer to confirm no unintended side effects.

Will amend to remove that.

@wI2L, thank you for confirming! Looking forward to seeing the updated code. 👍

wI2L · 2025-11-17T08:37:53Z

@yermulnik

Here are the build logs, for 3 different scenarios. I have added a temporary set -eux before the newly added lines in order to show the executed commands in the install scripts:

Without auth/build arg:
build-no-auth.log
Witout auth/with build arg and empty env var:
build-no-auth-empty-env-var.log
With auth/env var set with token:
build-with-auth.log

yermulnik · 2025-11-17T11:43:14Z

Here are the build logs, for 3 different scenarios.

Looks great. Thank you. Hopefully @MaxymVlasov will have a chance to review shortly.

yermulnik

LGTM. Differing approval to @MaxymVlasov

Dockerfile

MaxymVlasov · 2025-11-17T12:56:23Z

Dockerfile

Regarding failed checks, they are not related to your PR.
Checking with @webknjaz how to fix it, as previously it worked fine.
Sadly, but we will not be able to merge it w/o bypassing branch-protection requirements, so we'll try to figure it out quickly

No worries, I'm not in a hurry 👍

README.md

Accept build arg `GITHUB_TOKEN` to authenticate calls made to GitHub API in `common::install_from_gh_release` function. Closes antonbabenko#946

wI2L · 2025-11-20T14:38:02Z

Thank you @MaxymVlasov for the followup

# [1.104.0](v1.103.0...v1.104.0) (2025-11-20) ### Features * **docker:** Allow authenticated calls to GitHub API ([#947](#947)) ([6deaf20](6deaf20))

antonbabenko · 2025-11-20T14:41:12Z

This PR is included in version 1.104.0 🎉

Copilot AI review requested due to automatic review settings November 16, 2025 18:34

wI2L requested review from MaxymVlasov, antonbabenko and yermulnik as code owners November 16, 2025 18:34

Copilot AI reviewed Nov 16, 2025

View reviewed changes

wI2L force-pushed the docker-github-token branch from 71f262d to 2e88a8a Compare November 16, 2025 18:35

wI2L changed the title ~~feat(docker): allow authenticated calls to GitHub API~~ feat(docker): Allow authenticated calls to GitHub API Nov 16, 2025

wI2L force-pushed the docker-github-token branch from 2e88a8a to 7058185 Compare November 16, 2025 18:36

yermulnik reviewed Nov 16, 2025

View reviewed changes

tools/install/_common.sh Outdated Show resolved Hide resolved

wI2L force-pushed the docker-github-token branch from 7058185 to 76b30ac Compare November 17, 2025 08:25

coderabbitai bot reviewed Nov 17, 2025

View reviewed changes

wI2L force-pushed the docker-github-token branch from 76b30ac to 90abf9c Compare November 17, 2025 09:14

yermulnik reviewed Nov 17, 2025

View reviewed changes

MaxymVlasov reviewed Nov 17, 2025

View reviewed changes

wI2L force-pushed the docker-github-token branch from 90abf9c to cc97605 Compare November 17, 2025 13:10

MaxymVlasov reviewed Nov 17, 2025

View reviewed changes

README.md Outdated Show resolved Hide resolved

MaxymVlasov reviewed Nov 17, 2025

View reviewed changes

README.md Outdated Show resolved Hide resolved

wI2L force-pushed the docker-github-token branch from cc97605 to a30feaf Compare November 17, 2025 14:27

feat(docker): Allow authenticated calls to GitHub API

4619ea1

Accept build arg `GITHUB_TOKEN` to authenticate calls made to GitHub API in `common::install_from_gh_release` function. Closes antonbabenko#946

wI2L force-pushed the docker-github-token branch from a30feaf to 4619ea1 Compare November 17, 2025 14:28

MaxymVlasov mentioned this pull request Nov 18, 2025

ci: Drop EOL Python 3.9 and macos-13 #948

Merged

Merge branch 'master' into docker-github-token

54d284e

MaxymVlasov changed the title ~~feat(docker): Allow authenticated calls to GitHub API~~ feat(docker): Allow authenticated calls to GitHub API during docker build Nov 20, 2025

MaxymVlasov approved these changes Nov 20, 2025

View reviewed changes

MaxymVlasov merged commit 6deaf20 into antonbabenko:master Nov 20, 2025
45 checks passed

antonbabenko pushed a commit that referenced this pull request Nov 20, 2025

chore(release): version 1.104.0 [skip ci]

cba8773

# [1.104.0](v1.103.0...v1.104.0) (2025-11-20) ### Features * **docker:** Allow authenticated calls to GitHub API ([#947](#947)) ([6deaf20](6deaf20))

	[[ "$GITHUB_TOKEN" ]] && CURL_OPTS+=('-H' "Authorization: Bearer $GITHUB_TOKEN")
	[[ "$GITHUB_TOKEN" ]] && CURL_OPTS+=('-H' "Authorization: Bearer \"$GITHUB_TOKEN\"")

Uh oh!

feat(docker): Allow authenticated calls to GitHub API during docker build #947

feat(docker): Allow authenticated calls to GitHub API during docker build #947

Conversation

wI2L commented Nov 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description of your changes

How can we test changes

Uh oh!

coderabbitai bot commented Nov 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Other AI code review bot(s) detected

Summary by CodeRabbit

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Pre-merge checks and finishing touches

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Nov 16, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

wI2L commented Nov 16, 2025

Uh oh!

yermulnik left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

wI2L commented Nov 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wI2L Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

wI2L commented Nov 17, 2025

Uh oh!

yermulnik commented Nov 17, 2025

Uh oh!

yermulnik left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

MaxymVlasov Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

wI2L Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

wI2L commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

antonbabenko commented Nov 20, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

feat(docker): Allow authenticated calls to GitHub API during `docker build` #947

feat(docker): Allow authenticated calls to GitHub API during `docker build` #947

wI2L commented Nov 16, 2025 •

edited

Loading

coderabbitai bot commented Nov 16, 2025 •

edited

Loading

yermulnik left a comment •

edited

Loading

wI2L commented Nov 16, 2025 •

edited

Loading

coderabbitai bot Nov 17, 2025 •

edited

Loading

wI2L commented Nov 20, 2025 •

edited

Loading