From 209a766c8c7769c2d11d50771b259afdff1d1216 Mon Sep 17 00:00:00 2001 From: Darko Gjorgjijoski Date: Mon, 15 Jun 2026 00:31:25 +0200 Subject: [PATCH] ci(docker): authenticate composer against GitHub in the image build Multi-arch builds run composer (incl. the merge-plugin's update) twice and exhausted GitHub's unauthenticated API rate limit, failing with 'Could not authenticate against github.com'. Pass the Actions token as a build secret and feed it to composer via COMPOSER_AUTH (build-time only, never in the image). Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/docker.yaml | 4 ++++ docker/production/Dockerfile | 9 ++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml index db3de079..d99c679f 100644 --- a/.github/workflows/docker.yaml +++ b/.github/workflows/docker.yaml @@ -174,6 +174,8 @@ jobs: labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max + secrets: | + composer_auth={"github-oauth":{"github.com":"${{ secrets.GITHUB_TOKEN }}"}} manual_docker_build: name: 🛠️ Manual Docker Build @@ -204,3 +206,5 @@ jobs: tags: invoiceshelf/invoiceshelf:${{ github.event.inputs.tag }} cache-from: type=gha cache-to: type=gha,mode=max + secrets: | + composer_auth={"github-oauth":{"github.com":"${{ secrets.GITHUB_TOKEN }}"}} diff --git a/docker/production/Dockerfile b/docker/production/Dockerfile index d2e8198f..f3b8dbe6 100644 --- a/docker/production/Dockerfile +++ b/docker/production/Dockerfile @@ -1,3 +1,4 @@ +# syntax=docker/dockerfile:1 FROM --platform=$BUILDPLATFORM node:24 AS static_builder WORKDIR /var/www/html COPY . /var/www/html @@ -38,7 +39,13 @@ FROM base AS production # never clobber the fresh one produced by static_builder. COPY --chown=www-data:www-data . /var/www/html COPY --from=static_builder --chown=www-data:www-data /var/www/html/public/build /var/www/html/public/build - RUN composer install --prefer-dist --no-dev --optimize-autoloader + # Authenticate composer against GitHub when a token is provided (build secret), + # so multi-arch builds don't exhaust the unauthenticated API rate limit while the + # merge-plugin resolves modules. The secret is build-time only (never in the image), + # and the step still works without it for local builds. + RUN --mount=type=secret,id=composer_auth,mode=0444 \ + COMPOSER_AUTH="$(cat /run/secrets/composer_auth 2>/dev/null || true)" \ + composer install --prefer-dist --no-dev --optimize-autoloader # Copy entrypoint and inject script, and make sure they are executable COPY --chmod=755 docker/production/inject.sh /inject.sh