From 2b577d330e7560c76dfa68c7715af337e96da1dc Mon Sep 17 00:00:00 2001 From: Hengfei Yang Date: Thu, 3 Sep 2026 08:36:46 +0000 Subject: [PATCH] ci: send the token on the first github.com request, not only after a 401 (#14148) --- .github/actions/github-auth/action.yml | 15 ++++++---- .github/workflows/build-fork-pr-image.yml | 12 ++++++-- .github/workflows/build-pr-image.yml | 36 +++++++++++++++++++---- 3 files changed, 50 insertions(+), 13 deletions(-) diff --git a/.github/actions/github-auth/action.yml b/.github/actions/github-auth/action.yml index a0fca2a4ce..d46e1df901 100644 --- a/.github/actions/github-auth/action.yml +++ b/.github/actions/github-auth/action.yml @@ -11,10 +11,15 @@ runs: env: TOKEN: ${{ inputs.token }} run: | - # A credential helper is consulted only when GitHub answers 401, so it never conflicts with the - # header actions/checkout keeps for the checked-out repository. - echo "GH_AUTH_TOKEN=$TOKEN" >> "$GITHUB_ENV" - git config --global credential.helper '!f() { echo username=x-access-token; echo "password=$GH_AUTH_TOKEN"; }; f' + # Sent on every github.com request, so throttled anonymous downloads never happen. A credential helper + # or a token in the URL is only used after a 401, and GitHub never challenges for a public repository. + B64=$(printf 'x-access-token:%s' "$TOKEN" | base64 | tr -d '\n') + echo "::add-mask::$B64" + git config --global http.https://github.com/.extraheader "AUTHORIZATION: basic $B64" + # actions/checkout keeps the same header in each checked-out repository; two copies make GitHub answer 400. + for d in "$GITHUB_WORKSPACE" "$GITHUB_WORKSPACE"/*/; do + [ -d "$d/.git" ] && git -C "$d" config --local --unset-all http.https://github.com/.extraheader || true + done echo "GIT_TERMINAL_PROMPT=0" >> "$GITHUB_ENV" - # cargo's libgit2 path does not always consult the helper; the git CLI always does. + # cargo's libgit2 transport ignores http.extraheader; the git CLI honours it. echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV" diff --git a/.github/workflows/build-fork-pr-image.yml b/.github/workflows/build-fork-pr-image.yml index d37d3b73ed..bc1da218ef 100644 --- a/.github/workflows/build-fork-pr-image.yml +++ b/.github/workflows/build-fork-pr-image.yml @@ -55,9 +55,17 @@ jobs: env: TOKEN: ${{ github.token }} run: | - echo "GH_AUTH_TOKEN=$TOKEN" >> "$GITHUB_ENV" - git config --global credential.helper '!f() { echo username=x-access-token; echo "password=$GH_AUTH_TOKEN"; }; f' + # Sent on every github.com request, so throttled anonymous downloads never happen. A credential helper + # or a token in the URL is only used after a 401, and GitHub never challenges for a public repository. + B64=$(printf 'x-access-token:%s' "$TOKEN" | base64 | tr -d '\n') + echo "::add-mask::$B64" + git config --global http.https://github.com/.extraheader "AUTHORIZATION: basic $B64" + # actions/checkout keeps the same header in each checked-out repository; two copies make GitHub answer 400. + for d in "$GITHUB_WORKSPACE" "$GITHUB_WORKSPACE"/*/; do + [ -d "$d/.git" ] && git -C "$d" config --local --unset-all http.https://github.com/.extraheader || true + done echo "GIT_TERMINAL_PROMPT=0" >> "$GITHUB_ENV" + # cargo's libgit2 transport ignores http.extraheader; the git CLI honours it. echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV" - name: Set GIT_TAG env run: | diff --git a/.github/workflows/build-pr-image.yml b/.github/workflows/build-pr-image.yml index 9e3f0b065f..3258683bc0 100644 --- a/.github/workflows/build-pr-image.yml +++ b/.github/workflows/build-pr-image.yml @@ -41,9 +41,17 @@ jobs: env: TOKEN: ${{ github.token }} run: | - echo "GH_AUTH_TOKEN=$TOKEN" >> "$GITHUB_ENV" - git config --global credential.helper '!f() { echo username=x-access-token; echo "password=$GH_AUTH_TOKEN"; }; f' + # Sent on every github.com request, so throttled anonymous downloads never happen. A credential helper + # or a token in the URL is only used after a 401, and GitHub never challenges for a public repository. + B64=$(printf 'x-access-token:%s' "$TOKEN" | base64 | tr -d '\n') + echo "::add-mask::$B64" + git config --global http.https://github.com/.extraheader "AUTHORIZATION: basic $B64" + # actions/checkout keeps the same header in each checked-out repository; two copies make GitHub answer 400. + for d in "$GITHUB_WORKSPACE" "$GITHUB_WORKSPACE"/*/; do + [ -d "$d/.git" ] && git -C "$d" config --local --unset-all http.https://github.com/.extraheader || true + done echo "GIT_TERMINAL_PROMPT=0" >> "$GITHUB_ENV" + # cargo's libgit2 transport ignores http.extraheader; the git CLI honours it. echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV" - name: Set GIT_TAG env id: set-git-tag @@ -121,9 +129,17 @@ jobs: env: TOKEN: ${{ github.token }} run: | - echo "GH_AUTH_TOKEN=$TOKEN" >> "$GITHUB_ENV" - git config --global credential.helper '!f() { echo username=x-access-token; echo "password=$GH_AUTH_TOKEN"; }; f' + # Sent on every github.com request, so throttled anonymous downloads never happen. A credential helper + # or a token in the URL is only used after a 401, and GitHub never challenges for a public repository. + B64=$(printf 'x-access-token:%s' "$TOKEN" | base64 | tr -d '\n') + echo "::add-mask::$B64" + git config --global http.https://github.com/.extraheader "AUTHORIZATION: basic $B64" + # actions/checkout keeps the same header in each checked-out repository; two copies make GitHub answer 400. + for d in "$GITHUB_WORKSPACE" "$GITHUB_WORKSPACE"/*/; do + [ -d "$d/.git" ] && git -C "$d" config --local --unset-all http.https://github.com/.extraheader || true + done echo "GIT_TERMINAL_PROMPT=0" >> "$GITHUB_ENV" + # cargo's libgit2 transport ignores http.extraheader; the git CLI honours it. echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV" - name: Setup Rust Toolchain uses: dtolnay/rust-toolchain@master @@ -221,9 +237,17 @@ jobs: env: TOKEN: ${{ github.token }} run: | - echo "GH_AUTH_TOKEN=$TOKEN" >> "$GITHUB_ENV" - git config --global credential.helper '!f() { echo username=x-access-token; echo "password=$GH_AUTH_TOKEN"; }; f' + # Sent on every github.com request, so throttled anonymous downloads never happen. A credential helper + # or a token in the URL is only used after a 401, and GitHub never challenges for a public repository. + B64=$(printf 'x-access-token:%s' "$TOKEN" | base64 | tr -d '\n') + echo "::add-mask::$B64" + git config --global http.https://github.com/.extraheader "AUTHORIZATION: basic $B64" + # actions/checkout keeps the same header in each checked-out repository; two copies make GitHub answer 400. + for d in "$GITHUB_WORKSPACE" "$GITHUB_WORKSPACE"/*/; do + [ -d "$d/.git" ] && git -C "$d" config --local --unset-all http.https://github.com/.extraheader || true + done echo "GIT_TERMINAL_PROMPT=0" >> "$GITHUB_ENV" + # cargo's libgit2 transport ignores http.extraheader; the git CLI honours it. echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV" - name: Setup Rust Toolchain uses: dtolnay/rust-toolchain@master