test build-with-token - #4516
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
It introduces avoidable secret-exposure risks (logging the environment inside withCredentials, and writing a token-bearing .gitconfig into the Docker build context) that should be addressed before merging.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR updates the build pipeline to support authenticated GitHub fetches during Docker builds (via a token-backed gitconfig secret), while also adjusting a few third-party dependency fetch mechanisms for more deterministic builds.
Changes:
- Add Makefile support for passing a gitconfig as a Docker BuildKit secret when
TOKENis provided. - Update Dockerfiles to mount the gitconfig secret during
git clone/Bazel steps to enable authenticated fetches. - Update dependency pins/fetch methods in
WORKSPACEand switch OpenCV install script fromgit cloneto tag tarball downloads.
File summaries
| File | Description |
|---|---|
WORKSPACE |
Updates mediapipe pin and adjusts dependency fetching (node rules URL change; nlohmann_json to http_archive). |
third_party/opencv/install_opencv.sh |
Switches OpenCV sources acquisition from git clone to tarball extraction. |
Makefile |
Adds token-based gitconfig generation and passes it into Docker builds as a secret. |
Dockerfile.ubuntu |
Uses BuildKit secret mounts for git operations and Bazel builds. |
Dockerfile.redhat |
Uses BuildKit secret mounts for git operations and Bazel builds. |
ci/build_test_OnCommit.groovy |
Wraps Linux image build steps with Jenkins credentials binding for TOKEN. |
.gitignore |
Ignores generated .gitconfig. |
Review details
Suppressed comments (1)
Makefile:223
.gitconfigcontains a GitHub access token; it should be created with restrictive permissions to reduce the chance of accidental disclosure on shared machines/workspaces. Setting a tight umask (or chmod 600) when writing the file avoids it being created world-readable under a permissive umask.
$(GIT_CONFIG_FILE):
@git config --file $@ url."https://x-access-token:$(TOKEN)@github.com/".insteadOf https://github.com/
- Files reviewed: 6/7 changed files
- Comments generated: 3
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| ifneq ($(TOKEN),) | ||
| GIT_CONFIG_FILE := .gitconfig | ||
| GIT_CONFIG_SECRET = --secret id=gitconfig,src=$(GIT_CONFIG_FILE) |
| withCredentials([usernamePassword(credentialsId: 'workflow_lab_mediapipe', usernameVariable: 'GIT_USERNAME', passwordVariable: 'TOKEN')]) { | ||
| sh "env" | ||
| sh "make ovms_builder_image RUN_TESTS=${runTestsFlag} OPTIMIZE_BUILDING_TESTS=1 OVMS_CPP_IMAGE_TAG=${shortCommit} BUILD_IMAGE=openvino/model_server-build:${shortCommit}" |
| name = "mediapipe", | ||
| remote = "https://github.com/openvinotoolkit/mediapipe", | ||
| commit = "12e8d511cfbc5f471c498278a65a02dd250963e8", # top of mediapipe main branch as of 26.11.2025 | ||
| commit = "e57eca54b6190aa482c14ddc8b53a4e7d4088ce3", # top of mediapipe main branch as of 26.11.2025 | ||
| ) |
There was a problem hiding this comment.
mediapipe change needs to be merged first?
| ) | ||
|
|
||
| git_repository( | ||
| http_archive( |
There was a problem hiding this comment.
Since it's passing CI I guess its fine. If I recall there were sometimes issues with resolving dependency names when our dependency used bazel as well. Sometimes this forced us to use git_repository instead of http_archive rule.
Nothing to be done now with that. Leaving for future ourselves in case of issues,
| name = "mediapipe", | ||
| remote = "https://github.com/openvinotoolkit/mediapipe", | ||
| commit = "12e8d511cfbc5f471c498278a65a02dd250963e8", # top of mediapipe main branch as of 26.11.2025 | ||
| commit = "e57eca54b6190aa482c14ddc8b53a4e7d4088ce3", # top of mediapipe main branch as of 26.11.2025 |
There was a problem hiding this comment.
commit changed, but comment did not
🛠 Summary
optional usage of github TOKEN to pull dependencies using authenticated client
json and opencv switched from git clone to downloading tar.gz with src
this PR should mitigate github instability
🧪 Checklist
``