CI/dependencies/github_auth.sh

0001 #!/bin/bash
0002 # Make git authenticate its github.com reads with GITHUB_TOKEN, so they count
0003 # against the token's quota instead of the runners' shared anonymous one.
0004 set -e
0005 set -u
0006
0007 if [ -z "${GITHUB_TOKEN:-}" ]; then
0008   echo "GITHUB_TOKEN not set: github.com fetches stay anonymous"
0009   exit 0
0010 fi
0011
0012 # An Authorization header, not credentials in the URL: git does not send
0013 # credentials preemptively. It issues the request anonymously and only re-sends
0014 # it authenticated after a 401 challenge -- and github.com never challenges for
0015 # a *public* repo, it just answers. So the obvious-looking
0016 # `url.https://x-access-token:${GITHUB_TOKEN}@github.com/.insteadOf` leaves
0017 # every read of a public repo anonymous (verifiable: a deliberately bogus token
0018 # in the URL still clones acts-project/ci-dependencies just fine), which is
0019 # precisely the traffic GitHub sheds with "GitHub is temporarily limiting some
0020 # unauthenticated downloads". A header goes out on the first request, so it
0021 # actually authenticates. This is what actions/checkout does for the workspace
0022 # checkout; here we do it globally, for the clones spack makes on its own.
0023 #
0024 # The config key is URL-matched, so it reaches https://github.com/ only -- no
0025 # other host, and not the ssh form. --replace-all keeps it idempotent: extra
0026 # headers accumulate, and a cached spack install can run this more than once.
0027 auth=$(printf '%s' "x-access-token:${GITHUB_TOKEN}" | base64 | tr -d '\n')
0028 if [ -n "${GITHUB_ACTIONS:-}" ]; then
0029   echo "::add-mask::${auth}"
0030 fi
0031 git config --global --replace-all \
0032   "http.https://github.com/.extraheader" \
0033   "AUTHORIZATION: basic ${auth}"
0034 echo "Authenticating https://github.com/ fetches with GITHUB_TOKEN"
0035
0036 # Silently degrading to anonymous is the failure mode this whole file exists to
0037 # prevent, so check rather than assume. The anonymous REST quota is 60/h; any
0038 # accepted token is far above it. Warn only: a hiccup on this probe is no
0039 # reason to fail the job, and the fetches themselves are retried anyway.
0040 rate_limit=$(curl -sS -o /dev/null -D - -m 30 \
0041   -H "Authorization: basic ${auth}" \
0042   https://api.github.com/rate_limit 2>/dev/null |
0043   tr -d '\r' | awk 'tolower($1) == "x-ratelimit-limit:" { print $2 }') || true
0044 if [ -z "${rate_limit}" ]; then
0045   echo "Warning: could not probe the REST rate limit; assuming the token works"
0046 elif [ "${rate_limit}" -le 60 ]; then
0047   echo "Warning: GITHUB_TOKEN was not accepted (rate limit ${rate_limit}/h);" \
0048     "github.com fetches will be treated as anonymous"
0049 else
0050   echo "GITHUB_TOKEN accepted (rate limit ${rate_limit}/h)"
0051 fi