fix: authenticate GitHub API calls to avoid rate limit failures

.github/workflows/build-image.yml

@@ -79,10 +79,12 @@ jobs:
 
       - name: Build Image
         shell: bash
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
           # note: if disabling rechunker, must also disable sudo call
           # just build ${{ matrix.combo.image }}
-          sudo env PATH="$PATH" just build ${{ matrix.combo.image }}
+          sudo env PATH="$PATH" GITHUB_TOKEN="$GITHUB_TOKEN" just build ${{ matrix.combo.image }}
 
       - name: Rechunk Image
         shell: bash

Containerfile

@@ -14,4 +14,5 @@ ARG VERSION=""
 ARG DNF=""
 
 RUN --mount=type=bind,from=ctx,src=/,dst=/ctx \
+    --mount=type=secret,id=GITHUB_TOKEN \
     /ctx/build.sh

Justfile

@@ -164,6 +164,9 @@ build image="bluefin":
     echo "::endgroup::"
 
     echo "::group:: Container Build"
+    if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+        BUILD_ARGS+=("--secret" "id=GITHUB_TOKEN,env=GITHUB_TOKEN")
+    fi
     {{ PODMAN }} build "${BUILD_ARGS[@]}" .
     echo "::endgroup::"
 

github-release-install.sh

@@ -44,8 +44,15 @@ set ${SET_X:+-x} -eou pipefail
 API_JSON=$(mktemp /tmp/api-XXXXXXXX.json)
 API="https://api.github.com/repos/${ORG_PROJ}/releases/${RELTAG}"
 
+# Read GitHub token from secret mount if available (authenticates API to avoid rate limits)
+CURL_AUTH_ARGS=()
+if [[ -r /run/secrets/GITHUB_TOKEN ]]; then
+    GITHUB_TOKEN=$(</run/secrets/GITHUB_TOKEN)
+    CURL_AUTH_ARGS=("-H" "Authorization: Bearer ${GITHUB_TOKEN}")
+fi
 # retry up to 5 times with 5 second delays for any error included HTTP 404 etc
-curl --fail --retry 5 --retry-delay 5 --retry-all-errors -sL "${API}" -o "${API_JSON}"
+curl --fail --retry 5 --retry-delay 5 --retry-all-errors -sL \
+    "${CURL_AUTH_ARGS[@]}" "${API}" -o "${API_JSON}"
 RPM_URLS=$(jq \
     -r \
     --arg arch_filter "${ARCH_FILTER}" \

github-release-url.sh

@@ -44,8 +44,15 @@ set ${SET_X:+-x} -eou pipefail
 API_JSON=$(mktemp /tmp/api-XXXXXXXX.json)
 API="https://api.github.com/repos/${ORG_PROJ}/releases/${RELTAG}"
 
+# Read GitHub token from secret mount if available (authenticates API to avoid rate limits)
+CURL_AUTH_ARGS=()
+if [[ -r /run/secrets/GITHUB_TOKEN ]]; then
+    GITHUB_TOKEN=$(</run/secrets/GITHUB_TOKEN)
+    CURL_AUTH_ARGS=("-H" "Authorization: Bearer ${GITHUB_TOKEN}")
+fi
 # retry up to 5 times with 5 second delays for any error included HTTP 404 etc
-curl --fail --retry 5 --retry-delay 5 --retry-all-errors -sL "${API}" -o "${API_JSON}"
+curl --fail --retry 5 --retry-delay 5 --retry-all-errors -sL \
+    "${CURL_AUTH_ARGS[@]}" "${API}" -o "${API_JSON}"
 TGZ_URLS=$(jq \
     -r \
     --arg arch_filter "${ARCH_FILTER}" \