[WIP] Update GPU drivers. - #4505
Open
rasapala wants to merge 9 commits into
Open
Conversation
Make it secure
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The Dockerfiles currently mount the secret in a way that makes it mandatory despite being documented as optional, which can break builds that don’t provide the secret.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR introduces optional GitHub token support during Docker image builds to reduce GitHub anonymous-fetch throttling when Bazel git_repository() rules fetch dependencies (via BuildKit secrets and a temporary git credential helper).
Changes:
- Add
GITHUB_TOKEN/--secretwiring in the Makefile for the builder image build. - Update Ubuntu/Red Hat Dockerfiles to mount the token as a BuildKit secret and temporarily configure git credentials during the dependency prebuild step.
- Switch the builder-image build invocation to
docker buildx build.
File summaries
| File | Description |
|---|---|
| Makefile | Adds optional GitHub token secret args and updates the builder image build command. |
| Dockerfile.ubuntu | Mounts github_token secret and configures git credentials for Bazel dependency fetching. |
| Dockerfile.redhat | Same as Ubuntu, plus preserves Konflux gating behavior. |
Review details
Suppressed comments (2)
Dockerfile.ubuntu:297
RUN --mount=type=secret,id=github_tokenmakes the secret mandatory; builds that don't pass--secret id=github_token,...will fail even though the token is documented as optional. Mark the mount as optional withrequired=false.
RUN --mount=type=secret,id=github_token \
Dockerfile.redhat:306
RUN --mount=type=secret,id=github_tokenmakes the secret mandatory; builds that don't pass--secret id=github_token,...will fail even though the token is documented as optional. Mark the mount as optional withrequired=false.
RUN --mount=type=secret,id=github_token \
- Files reviewed: 3/3 changed files
- Comments generated: 4
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| RUN if [ "$KONFLUX" == "0" ] ; then true ; else exit 0 ; fi ; \ | ||
| bazel build --jobs=$JOBS ${debug_bazel_flags} //:ovms_dependencies @com_google_googletest//:gtest | ||
| # GITHUB_TOKEN (optional) avoids GitHub anonymous-fetch throttling for WORKSPACE git_repository() rules. | ||
| # Mounted as a BuildKit secret and read only by git's own credential-helper subprocess, so `set -x` below never echoes it. |
|
|
||
| # prebuild dependencies before copying sources & test dependencies for caching | ||
| # GITHUB_TOKEN (optional) avoids GitHub anonymous-fetch throttling for WORKSPACE git_repository() rules. | ||
| # Mounted as a BuildKit secret and read only by git's own credential-helper subprocess, so `set -x` below never echoes it. |
Comment on lines
+34
to
+36
| # Optional: avoids GitHub anonymous-fetch throttling during WORKSPACE git_repository() fetches. | ||
| # Passed as a BuildKit --secret (never --build-arg) so the token is never written to an image layer or history. | ||
| GITHUB_TOKEN ?= |
| endif | ||
| @cat .workspace/metadata.json | ||
| docker $(BUILDX) build $(NO_CACHE_OPTION) -f Dockerfile.$(DIST_OS) . \ | ||
| docker buildx build $(NO_CACHE_OPTION) -f Dockerfile.$(DIST_OS) . \ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Testing new drivers.
🛠 Summary
JIRA/Issue if applicable.
Describe the changes.
🧪 Checklist
``