This repository has been archived on 2026-09-06. You can view files and clone it. You cannot open issues or pull requests or push a commit.

mathiasandClaude Sonnet 5 62955c998d fix(ci): authenticate go mod download against the private cad module ...

Build & Import (run #68) failed: mathias/cad is PRIVATE (unlike
mcp-chassis, the only other internal module a cad-* Dockerfile has fetched
so far, which is public) — 'go mod download' inside the Docker build had
no credential and died on 'terminal prompts disabled'.

Fix mirrors this repo's own existing GIT_ASKPASS pattern (cd.yml's
oathcandidate step, for the private swedsl dependency): a BuildKit secret
mount feeds a GIT_ASKPASS helper for the one RUN that needs it. The token
is never written to a persisted layer — the askpass script and its
reference to /run/secrets/gitea_token are created and removed within the
same RUN instruction. cd.yml writes the token to a file only for
build-image.sh's subprocess and passes it via BUILD_SECRETS (the script's
existing mechanism — 'the caller writes the secret to PATH itself').

Verified by running build-image.sh's actual buildctl invocation locally
against the real koala buildkitd (same daemon CI uses) with a real token —
'go mod download' completes in 1.9s, full build succeeds. Reproduced the
CI failure log before writing this fix, per house discipline.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-08-28 13:31:59 +02:00

..

workflows

fix(ci): authenticate go mod download against the private cad module

2026-08-28 13:31:59 +02:00

build-image.sh

ci: call the shared build-image script instead of an inline copy (infra#309)

2026-08-25 11:29:53 +02:00