Docker build: Call Github API with authentication

[nvuillam]

Github api limits seem to be reached more and more often, because of all CI jobs that run in parallel, and that makes CI jobs fail more and more often during the docker build

Using GITHUB_TOKEN we can go to 1000 calls per hour, that should be large enough -> https://docs.github.com/en/rest/overview/resources-in-the-rest-api?apiVersion=2022-11-28#rate-limits-for-requests-from-github-actions

We need to test and update our calls to Github API to add GITHUB_TOKEN as HTTP header, something like:

-H "Authorization: Bearer $(cat /run/secrets/GITHUB_TOKEN)" \

The neighbors of SuperLinter implemented the way to fix that, but doing authenticated calls to Github API

https://github.com/github/super-linter/blob/main/scripts/install-pwsh.sh

Using docker build action would probably help too and decrease our sh files maintenance

https://github.com/github/super-linter/blob/13e5f8b29a34bbf7ce2476292477fa385bec2578/.github/workflows/ci.yml#L34

[bdovaz]

@nvuillam trying to understand the functionality that needs to be done:

1. check the descriptors that make calls to api.github.com and authenticate the calls. I only see 3 so I understand that at least this PR is easy to do, isn't it?

2. Refactor the workflows to remove the upload-docker.sh script and use https://github.com/docker/build-push-action

This part is more complex because first we have to understand what the sh script actually does.

I see clear to use: https://docs.github.com/en/actions/using-workflows/reusing-workflows#creating-a-reusable-workflow

Since we want to reuse as much as possible between workflows and repeat as little as possible.

[nvuillam]

We basically need to do the same than hat the super-linter neighbours did :)

Meaning update install section of impacted descriptors, and use docker build action

The current .sh is inherited from SuperLinter, so if they got rid of it, we probably can make the same without suffering too much

I wanted to do that but was afraid to create too many conflicts for multi-arch PR

[bdovaz]

@nvuillam I just created a PR that at least makes the API calls authenticated, something will help.

[nvuillam]

@bdovaz cat: can't open '/run/secrets/GITHUB_TOKEN': No such file or directory

I think the secret is set by the use of docker build Github action ^^

[bdovaz]

I wanted to do that but was afraid to create too many conflicts for multi-arch PR

@nvuillam For the PR you mention don't worry because the action we mentioned docker/setup-buildx-action@v2 has a platforms parameter so it is very easy to fix.

@bdovaz cat: can't open '/run/secrets/GITHUB_TOKEN': No such file or directory

I think the secret is set by the use of docker build Github action ^^

The first thing to do is to remove the sh script.

Are you going to do that soon? Do you have experience with it? Because I see that it blocks me in being able to test #2294 quickly and I almost prefer before solving this issue to continue with the other one.

[nvuillam]

If you want to try to replace sh by build scriot, plz be my guest:)
I have many tasks on my rent paying job so i probably won't be able to find enough time before next weekend:/

[bdovaz]

@nvuillam we can consider this issue fixed, can't we?

[nvuillam]

I think it is with our PRs :)