From 2cbcc0675199c60395165ca811f9715a1dc28bce Mon Sep 17 00:00:00 2001
From: casjay <git-admin@casjaysdev.pro>
Date: Mon, 27 Jul 2026 22:51:57 -0400
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20Stop=20baking=20GITHUB=5FTOKEN?=
 =?UTF-8?q?=20into=20image=20layer=20history=20=F0=9F=94=92?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Dockerfile: `ARG GITHUB_TOKEN=""` and the matching `ENV GITHUB_TOKEN=`
  persisted whatever value was passed via `--build-arg` into the image's
  layer history, visible via `docker history` regardless of whether the
  value was ever actually used — flagged by BuildKit's own
  SecretsUsedInArgOrEnv check ("2 warnings found" on every build).
  GITHUB_TOKEN is only ever read at build time by
  rootfs/root/docker/setup/05-custom.sh to raise the GitHub API rate limit
  during tool downloads; it has no reason to touch a layer at all. Replaced
  both with `RUN --mount=type=secret,id=github_token,env=GITHUB_TOKEN,
  required=false` on the RUN step that executes 05-custom.sh — the value is
  now only visible inside that one RUN's environment and is never written to
  a layer. 05-custom.sh needed no change since it already just reads
  `${GITHUB_TOKEN:-}`. Added `# syntax=docker/dockerfile:1` at the top since
  the secret-mount `env=` option requires Dockerfile frontend 1.4+. Callers
  now pass `--secret id=github_token,env=GITHUB_TOKEN` instead of
  `--build-arg GITHUB_TOKEN=...`. Verified with
  `docker buildx build --check` — "Check complete, no warnings found."
  Found while investigating the SecretsUsedInArgOrEnv warnings surfaced
  during the entrypoint.sh functional-test rebuilds.
---
 Dockerfile | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index bf3071c..0715f01 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile:1
 # Docker image for go using the alpine template
 ARG IMAGE_NAME="go"
 ARG PHP_SERVER="go"
@@ -58,9 +59,6 @@ FROM ${PULL_URL}:${DISTRO_VERSION} AS build
 ARG TZ
 ARG USER
 ARG LICENSE
-# Optional: pass --build-arg GITHUB_TOKEN=$(gh auth token) to raise the API rate
-# limit from 60 to 5000 req/hr — avoids 403s in parallel multi-platform builds.
-ARG GITHUB_TOKEN=""
 ARG TIMEZONE
 ARG LANGUAGE
 ARG IMAGE_NAME
@@ -100,7 +98,6 @@ ENV GOTOOLCHAIN="auto"
 ENV GOFLAGS="-buildvcs=false"
 ENV GOTELEMETRY="off"
 ENV GOPROXY="https://proxy.golang.org,direct"
-ENV GITHUB_TOKEN="${GITHUB_TOKEN}"
 
 USER ${USER}
 WORKDIR /root
@@ -205,7 +202,12 @@ echo ""
 COPY --from=go-toolchain /usr/local/go/ /usr/local/go/
 COPY --from=go-tools /go/bin/ /usr/local/bin/
 
-RUN echo "Running custom commands"; \
+# GITHUB_TOKEN is passed as a BuildKit secret, not ARG/ENV, so its value never
+# persists in image layers or is visible via `docker history` — pass with
+# `docker buildx build --secret id=github_token,env=GITHUB_TOKEN` (optional,
+# only raises the GitHub API rate limit from 60 to 5000 req/hr).
+RUN --mount=type=secret,id=github_token,env=GITHUB_TOKEN,required=false \
+  echo "Running custom commands"; \
   if [ -f "/root/docker/setup/05-custom.sh" ];then echo "Running the custom script";/root/docker/setup/05-custom.sh||{ echo "Failed to execute /root/docker/setup/05-custom.sh" && exit 10; };echo "Done running the custom script";fi; \
   echo ""