From 82a5a0acec1f6bff09727e1cceb23248774d2582 Mon Sep 17 00:00:00 2001 From: Stanislav Zhuk Date: Fri, 16 Oct 2026 13:13:49 +0300 Subject: [PATCH] fix: pass the GitHub token as a build secret, resolve static-php-cli tag without GitHub API (#14) ## The Issue - Related to ddev/ddev-nvm#6 - Follow-up to ddev/ddev-sqlsrv#57 The latest static-php-cli tag came from `api.github.com`, which allows 60 unauthenticated requests per hour per IP. The token was passed as a build arg, which is recorded in `docker history` and in `.ddev/.ddev-docker-compose-full.yaml`. ## How This PR Solves The Issue - Read the tag from the `https://github.com/crazywhalecc/static-php-cli/releases/latest` redirect, which is not API rate-limited, and check that it looks like a version - Remove the `GITHUB_TOKEN` build arg and mount the `github_token` build secret that DDEV provides since ddev/ddev#8948 - Export the secret as `GITHUB_TOKEN` for `bin/spc download`. `composer update` doesn't need it, because Composer downloads from GitHub don't count against the API rate limit ## Manual Testing Instructions ```bash ddev utility download-ddev --pr 8948 export PATH="$HOME/tmp/ddev-download-ddev/pr-8948:$PATH" ddev config --project-type=php ddev dotenv set .ddev/.env.php-patch-build --static-php-version=8.3.19 ddev add-on get https://github.com/rfay/ddev-php-patch-build/tarball/refs/pull/14/head ddev restart ddev php -v # A bogus token must reach static-php-cli and fail the build: DDEV_GITHUB_TOKEN=ghp_bogus ddev utility rebuild # Expect "using bearer github token" followed by "curl: (22) The requested URL returned error: 401" ``` ## Automated Testing Overview No new tests. The `HEAD` job passes the action's token through the secret. The `stable` job builds without a token until ddev/ddev#8948 is in a DDEV release. ## Release/Deployment Notes With DDEV v1.25.4 and older, the token is no longer passed to the build. Co-Authored-By: Claude Opus 5.5 --- README.md | 4 +++- docker-compose.php-patch-build.yaml | 2 -- web-build/Dockerfile.php-patch-build | 17 ++++++++++++----- 3 files changed, 15 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 830c06b..c7fe48c 100644 --- a/README.md +++ b/README.md @@ -49,9 +49,11 @@ After installation, make sure to commit the `.ddev` directory to version control If you hit GitHub rate limits while downloading `static-php-cli` extensions, export your token before running `ddev start` to build the PHP binaries: ```bash -export GITHUB_TOKEN=your_github_token +export DDEV_GITHUB_TOKEN=your_github_token ``` +DDEV passes `DDEV_GITHUB_TOKEN`, `GH_TOKEN`, or `GITHUB_TOKEN` to the build as a secret, so the token isn't stored in the image. This requires DDEV newer than v1.25.4; older versions build without a token. + | Variable | Flag | Default | |-------------------------|---------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------| | `STATIC_PHP_EXTENSIONS` | `--static-php-extensions` | `apcu,bcmath,ctype,curl,dom,fileinfo,filter,ftp,gd,mbstring,openssl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,phar,session,simplexml,sqlite3,tokenizer,xml` | diff --git a/docker-compose.php-patch-build.yaml b/docker-compose.php-patch-build.yaml index 66a8bb0..ae9fc33 100644 --- a/docker-compose.php-patch-build.yaml +++ b/docker-compose.php-patch-build.yaml @@ -4,8 +4,6 @@ services: image: ${DDEV_WEBIMAGE}-${DDEV_SITENAME}-built build: args: - # optional, to avoid rate limiting for PHP extensions build - GITHUB_TOKEN: "${DDEV_GITHUB_TOKEN:-${GITHUB_TOKEN:-}}" # required, comma-separated list of PHP extensions to build STATIC_PHP_EXTENSIONS: "${STATIC_PHP_EXTENSIONS:-apcu,bcmath,ctype,curl,dom,fileinfo,filter,ftp,gd,mbstring,openssl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,phar,session,simplexml,sqlite3,tokenizer,xml}" # required, the PHP version to build diff --git a/web-build/Dockerfile.php-patch-build b/web-build/Dockerfile.php-patch-build index 9bcff18..64c08e0 100644 --- a/web-build/Dockerfile.php-patch-build +++ b/web-build/Dockerfile.php-patch-build @@ -1,21 +1,28 @@ #ddev-generated -ARG GITHUB_TOKEN ARG STATIC_PHP_EXTENSIONS ARG STATIC_PHP_VERSION RUN (apt-get update || true) && DEBIAN_FRONTEND=noninteractive apt-get install -y -o Dpkg::Options::="--force-confnew" --no-install-recommends --no-install-suggests build-essential -RUN </dev/null 2>&1; then update-alternatives --set php-fpm /usr/sbin/php-fpm8.4; else ln -sf /usr/sbin/php-fpm8.4 /usr/sbin/php-fpm; fi mkdir -p /usr/local/src/static-php-cli && cd /usr/local/src/static-php-cli -LATEST_RELEASE_TAG=$(curl -fsSL ${GITHUB_TOKEN:+-H "Authorization: Bearer ${GITHUB_TOKEN}"} https://api.github.com/repos/crazywhalecc/static-php-cli/releases/latest | jq -r .tag_name) -if [ -z "${LATEST_RELEASE_TAG}" ] || [ "${LATEST_RELEASE_TAG}" = "null" ]; then - echo "Failed to determine latest static-php-cli release tag" >&2 +# Resolve the latest tag from the release redirect to avoid the GitHub API rate limit +LATEST_RELEASE_URL="$(curl -fsSIL --retry 3 -o /dev/null -w '%{url_effective}' "https://github.com/crazywhalecc/static-php-cli/releases/latest")" +LATEST_RELEASE_TAG="${LATEST_RELEASE_URL##*/}" +if [[ ! "${LATEST_RELEASE_TAG}" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + echo "Unable to determine the latest static-php-cli release from '${LATEST_RELEASE_URL}'" >&2 exit 1 fi git clone --branch "${LATEST_RELEASE_TAG}" --depth 1 https://github.com/crazywhalecc/static-php-cli.git .