Skip to content

feat(docker): Allow authenticated calls to GitHub API during docker build #947

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MaxymVlasov merged 2 commits into from
Nov 20, 2025
+15 −2
Merged

feat(docker): Allow authenticated calls to GitHub API during docker build #947

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4619ea1
feat(docker): Allow authenticated calls to GitHub API
wI2L Nov 16, 2025
54d284e
Merge branch 'master' into docker-github-token
MaxymVlasov Nov 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions Dockerfile
View file
Open in desktop
Copy link
Collaborator

@MaxymVlasov MaxymVlasov Nov 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Regarding failed checks, they are not related to your PR.
Checking with @webknjaz how to fix it, as previously it worked fine.
Sadly, but we will not be able to merge it w/o bypassing branch-protection requirements, so we'll try to figure it out quickly

Copy link
Contributor Author

@wI2L wI2L Nov 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No worries, I'm not in a hurry 👍

Original file line number Diff line number Diff line change
Expand Up @@ -30,19 +30,19 @@
#
# Install tools
#
ARG OPENTOFU_VERSION=${OPENTOFU_VERSION:-false}

Check warning on line 33 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu ARM

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$OPENTOFU_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 33 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$OPENTOFU_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 33 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$OPENTOFU_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
ARG TERRAFORM_VERSION=${TERRAFORM_VERSION:-false}

Check warning on line 34 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu ARM

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$TERRAFORM_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

ARG CHECKOV_VERSION=${CHECKOV_VERSION:-false}

Check warning on line 36 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$CHECKOV_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 36 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$CHECKOV_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
ARG HCLEDIT_VERSION=${HCLEDIT_VERSION:-false}

Check warning on line 37 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu ARM

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$HCLEDIT_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 37 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$HCLEDIT_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
ARG INFRACOST_VERSION=${INFRACOST_VERSION:-false}
ARG TERRAFORM_DOCS_VERSION=${TERRAFORM_DOCS_VERSION:-false}

Check warning on line 39 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$TERRAFORM_DOCS_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 39 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$TERRAFORM_DOCS_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
ARG TERRAGRUNT_VERSION=${TERRAGRUNT_VERSION:-false}

Check warning on line 40 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$TERRAGRUNT_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
ARG TERRASCAN_VERSION=${TERRASCAN_VERSION:-false}

Check warning on line 41 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$TERRASCAN_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
ARG TFLINT_VERSION=${TFLINT_VERSION:-false}

Check warning on line 42 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu ARM

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$TFLINT_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 42 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$TFLINT_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 42 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$TFLINT_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
ARG TFSEC_VERSION=${TFSEC_VERSION:-false}

Check warning on line 43 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu ARM

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$TFSEC_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
ARG TFUPDATE_VERSION=${TFUPDATE_VERSION:-false}

Check warning on line 44 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$TFUPDATE_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
ARG TRIVY_VERSION=${TRIVY_VERSION:-false}

Check warning on line 45 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu ARM

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$TRIVY_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 45 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$TRIVY_VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/


# Tricky thing to install all tools by set only one arg.
Expand All @@ -65,6 +65,8 @@
echo "TRIVY_VERSION=latest" >> /.env \
; fi

ARG GITHUB_TOKEN=${GITHUB_TOKEN:-""}

Check warning on line 68 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu ARM

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "GITHUB_TOKEN")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 68 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu ARM

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$GITHUB_TOKEN'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 68 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$GITHUB_TOKEN'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 68 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "GITHUB_TOKEN")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 68 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "GITHUB_TOKEN")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

# Docker `RUN`s shouldn't be consolidated here
# hadolint global ignore=DL3059
RUN /install/opentofu.sh
Expand Down Expand Up @@ -148,9 +150,9 @@

COPY tools/entrypoint.sh /entrypoint.sh

ENV PRE_COMMIT_COLOR=${PRE_COMMIT_COLOR:-always}

Check warning on line 153 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$PRE_COMMIT_COLOR'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

ENV INFRACOST_API_KEY=${INFRACOST_API_KEY:-}

Check warning on line 155 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu ARM

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$INFRACOST_API_KEY'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 155 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "INFRACOST_API_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 155 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$INFRACOST_API_KEY'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
ENV INFRACOST_SKIP_UPDATE_CHECK=${INFRACOST_SKIP_UPDATE_CHECK:-false}

Check warning on line 156 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu ARM

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$INFRACOST_SKIP_UPDATE_CHECK'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 156 in Dockerfile

View workflow job for this annotation

GitHub Actions / Ubuntu x64

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$INFRACOST_SKIP_UPDATE_CHECK'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

ENTRYPOINT [ "/entrypoint.sh" ]
6 changes: 6 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,6 +136,12 @@ docker build -t pre-commit-terraform \

Set `-e PRE_COMMIT_COLOR=never` to disable the color output in `pre-commit`.

> **NOTE**
> The build install scripts are calling the GitHub API to resolve the release URL. If you need to authenticate those calls, you can pass a GitHub token (the `GITHUB_TOKEN` environment variable is expected to be set with an [access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens)):
> ```bash
> docker build -t pre-commit-terraform --build-arg GITHUB_TOKEN .
> ```

</details>


Expand Down
9 changes: 7 additions & 2 deletions tools/install/_common.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,11 +60,16 @@ function common::install_from_gh_release {

# Download tool
local -r RELEASES="https://api.github.com/repos/${GH_ORG}/${TOOL}/releases"
local CURL_OPTS=()

[[ $GITHUB_TOKEN ]] && CURL_OPTS+=('-H' "Authorization: Bearer $GITHUB_TOKEN")

local -r CURL_CMD=("curl" "${CURL_OPTS[@]}")

if [[ $VERSION == latest ]]; then
curl -L "$(curl -s "${RELEASES}/latest" | grep -o -E -i -m 1 "$GH_RELEASE_REGEX_LATEST")" > "$PKG"
"${CURL_CMD[@]}" -L "$("${CURL_CMD[@]}" -s "${RELEASES}/latest" | grep -o -E -i -m 1 "$GH_RELEASE_REGEX_LATEST")" > "$PKG"
else
curl -L "$(curl -s "$RELEASES" | grep -o -E -i -m 1 "$GH_RELEASE_REGEX_SPECIFIC_VERSION")" > "$PKG"
"${CURL_CMD[@]}" -L "$("${CURL_CMD[@]}" -s "$RELEASES" | grep -o -E -i -m 1 "$GH_RELEASE_REGEX_SPECIFIC_VERSION")" > "$PKG"
fi

# Make tool ready to use
Expand Down
Loading