fix: pass the GitHub token as a build secret, resolve static-php-cli tag without GitHub API

README.md

@@ -49,9 +49,11 @@ After installation, make sure to commit the `.ddev` directory to version control
 If you hit GitHub rate limits while downloading `static-php-cli` extensions, export your token before running `ddev start` to build the PHP binaries:
 
 ```bash
-export GITHUB_TOKEN=your_github_token
+export DDEV_GITHUB_TOKEN=your_github_token
 ```
 
+DDEV passes `DDEV_GITHUB_TOKEN`, `GH_TOKEN`, or `GITHUB_TOKEN` to the build as a secret, so the token isn't stored in the image. This requires DDEV newer than v1.25.4; older versions build without a token.
+
 | Variable                | Flag                      | Default                                                                                                                                              |
 |-------------------------|---------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `STATIC_PHP_EXTENSIONS` | `--static-php-extensions` | `apcu,bcmath,ctype,curl,dom,fileinfo,filter,ftp,gd,mbstring,openssl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,phar,session,simplexml,sqlite3,tokenizer,xml` |

docker-compose.php-patch-build.yaml

@@ -4,8 +4,6 @@ services:
     image: ${DDEV_WEBIMAGE}-${DDEV_SITENAME}-built
     build:
       args:
-        # optional, to avoid rate limiting for PHP extensions build
-        GITHUB_TOKEN: "${DDEV_GITHUB_TOKEN:-${GITHUB_TOKEN:-}}"
         # required, comma-separated list of PHP extensions to build
         STATIC_PHP_EXTENSIONS: "${STATIC_PHP_EXTENSIONS:-apcu,bcmath,ctype,curl,dom,fileinfo,filter,ftp,gd,mbstring,openssl,pdo,pdo_mysql,pdo_pgsql,pdo_sqlite,phar,session,simplexml,sqlite3,tokenizer,xml}"
         # required, the PHP version to build

web-build/Dockerfile.php-patch-build

@@ -1,21 +1,28 @@
 #ddev-generated
-ARG GITHUB_TOKEN
 ARG STATIC_PHP_EXTENSIONS
 ARG STATIC_PHP_VERSION
 
 RUN (apt-get update || true) && DEBIAN_FRONTEND=noninteractive apt-get install -y -o Dpkg::Options::="--force-confnew" --no-install-recommends --no-install-suggests build-essential
 
-RUN <<EOF
+RUN --mount=type=secret,id=github_token <<EOF
 set -eu -o pipefail
 
+# Optional token to avoid GitHub API rate limiting in static-php-cli downloads
+if [ -s /run/secrets/github_token ]; then
+  GITHUB_TOKEN="$(cat /run/secrets/github_token)"
+  export GITHUB_TOKEN
+fi
+
 # static-php-cli requires at least PHP 8.4 to build
 update-alternatives --set php /usr/bin/php8.4
 if update-alternatives --display php-fpm >/dev/null 2>&1; then update-alternatives --set php-fpm /usr/sbin/php-fpm8.4; else ln -sf /usr/sbin/php-fpm8.4 /usr/sbin/php-fpm; fi
 
 mkdir -p /usr/local/src/static-php-cli && cd /usr/local/src/static-php-cli
-LATEST_RELEASE_TAG=$(curl -fsSL ${GITHUB_TOKEN:+-H "Authorization: Bearer ${GITHUB_TOKEN}"} https://api.github.com/repos/crazywhalecc/static-php-cli/releases/latest | jq -r .tag_name)
-if [ -z "${LATEST_RELEASE_TAG}" ] || [ "${LATEST_RELEASE_TAG}" = "null" ]; then
-  echo "Failed to determine latest static-php-cli release tag" >&2
+# Resolve the latest tag from the release redirect to avoid the GitHub API rate limit
+LATEST_RELEASE_URL="$(curl -fsSIL --retry 3 -o /dev/null -w '%{url_effective}' "https://github.com/crazywhalecc/static-php-cli/releases/latest")"
+LATEST_RELEASE_TAG="${LATEST_RELEASE_URL##*/}"
+if [[ ! "${LATEST_RELEASE_TAG}" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+  echo "Unable to determine the latest static-php-cli release from '${LATEST_RELEASE_URL}'" >&2
   exit 1
 fi
 git clone --branch "${LATEST_RELEASE_TAG}" --depth 1 https://github.com/crazywhalecc/static-php-cli.git .