dockersrc/rust
1
0
Fork 0
mirror of https://github.com/dockersrc/rust synced 2026-08-30 02:01:14 -04:00
Code Issues Actions Packages Projects Releases Wiki Activity

🔑 Accept optional GITHUB_TOKEN secret for cargo-binstall 🔑
Build and Push / build (push) Canceled after 0s
Details

Browse Source 
- Dockerfile: the rust-tools stage's cargo binstall RUN now mounts an
  optional BuildKit secret (github_token -> GITHUB_TOKEN, required=false),
  matching the existing pattern in the sibling go image's Dockerfile. Raises
  the GitHub API rate limit from 60 to 5000 req/hr when a token is supplied.
- TODO.AI.md: logged the verified root cause and impact of this session's
  full multi-platform push build — GitHub API rate-limiting dropped 14/60
  tools on linux/amd64 and 40/60 tools on linux/arm64 during cargo binstall
  resolution, because two concurrent platform builds share one unauthenticated
  budget. Also logged that the shared build wrapper (/usr/local/bin/buildx,
  outside this repo) does not currently pass the secret flag, so this fix
  has no effect until the wrapper is updated or the secret is passed
  manually — flagged as a decision needed from the user. Separately logged
  that mingw-w64-gcc has no arm64 Alpine package (apk "no such package"),
  a platform limitation with no in-repo fix, affecting Windows GNU target
  linking on the arm64 image variant.
This commit is contained in:
jason
2026-08-21 07:58:56 -04:00
parent d363ccf42f
commit 7870bf4859
2 changed files with 58 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+7
View File
@@ -88,8 +88,15 @@ ENV CARGO_INSTALL_ROOT=/rust-tools
# cargo-install fallback) aborts the entire batch and silently installs nothing,
# even for tools that resolved fine. Isolating each tool's `|| true` is required
# for "skip what's missing, keep what's available" to actually work.
# GITHUB_TOKEN is passed as a BuildKit secret, not ARG/ENV, so its value never
# persists in image layers or is visible via `docker history` — pass with
# `docker buildx build --secret id=github_token,env=GITHUB_TOKEN` (optional,
# only raises the GitHub API rate limit from 60 to 5000 req/hr). Without it,
# `cargo binstall` resolving 50+ tools across two concurrent platform builds
# exhausts the unauthenticated limit and silently skips most remaining tools.
RUN --mount=type=cache,id=cargo-registry-native,sharing=shared,target=/usr/local/cargo/registry \
--mount=type=cache,id=cargo-git-native,sharing=locked,target=/usr/local/cargo/git \
--mount=type=secret,id=github_token,env=GITHUB_TOKEN,required=false \
set -o pipefail; \
RUST_TARGET="$(cat /tmp/rust-target)"; \
# Disable telemetry prompt — required for non-interactive builds