Problem

CI builds intermittently fail when github-release-install.sh (and github-release-url.sh) call the GitHub API unauthenticated to fetch the latest release for frostyard/updex. Shared GitHub Actions runner IPs hit the 60 req/hour unauthenticated limit, causing curl --fail to exit non-zero and fail the build.

Solution

Pass github.token (5,000 req/hour) as a build secret so the API calls are authenticated. Graceful degradation is preserved: if GITHUB_TOKEN is absent (local builds), the secret mount is skipped and curl runs unauthenticated as before.

Changes

• github-release-install.sh / github-release-url.sh — read /run/secrets/GITHUB_TOKEN if present and pass -H "Authorization: Bearer …" to curl
• Containerfile — add --mount=type=secret,id=GITHUB_TOKEN to the RUN instruction (required defaults to false, so absent secret is a no-op)
• Justfile — conditionally append --secret id=GITHUB_TOKEN,env=GITHUB_TOKEN to BUILD_ARGS when GITHUB_TOKEN is set in the environment
• .github/workflows/build-image.yml — expose GITHUB_TOKEN: ${{ github.token }} on the Build Image step so sudo env PATH="$PATH" forwards it to just