build: mount token secret for apptainer dependency download - #3860
Merged
Conversation
Apptainer's own scripts/download-dependencies already supports GITHUB_TOKEN for authenticated GitHub API patch downloads, avoiding the unauthenticated per-IP rate limit (60/hr) that was failing sbsa (arm64) builds with HTTP 429 while fetching e2fsprogs patches. Mount the GITHUB_TOKEN secret (forwarded by nemo-ci CI) into the custom-setup RUN step so install_apptainer.sh's arm64 source build picks it up. Signed-off-by: Kajal Jain <kajalj@nvidia.com>
Use a purpose-named secret id instead of the generic GITHUB_TOKEN, so it's structurally clear this slot expects a dedicated, minimally scoped (public-repo, read-only) credential rather than inviting reuse of a broader-scope org GitHub token. The env var exposed inside the RUN step stays GITHUB_TOKEN since that's what Apptainer's own scripts/download-dependencies checks for. Signed-off-by: Kajal Jain <kajalj@nvidia.com>
chtruong814
approved these changes
Sep 2, 2026
Contributor
Author
|
/ok to test c1c0f4d |
Contributor
Author
|
Tests also failing on the main branch - not due to this PR |
Contributor
Author
|
/ok to test d7ad24c |
kajalj22
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sbsa (arm64) builds fail with HTTP 429 fetching Apptainer's e2fsprogs patches during the custom-setup step, due to GitHub's unauthenticated per-IP rate limit (60/hr) on the shared CI runner.
Apptainer's own
scripts/download-dependencies(run byinstall_apptainer.sh's arm64 source build) supports an authenticated fallback via$GITHUB_TOKEN. This mounts that secret into the custom-setupRUNstep.The secret
idisAPPTAINER_GITHUB_TOKEN(not the genericGITHUB_TOKEN), so it's structurally clear this slot expects a dedicated, minimally-scoped credential (public-repo, read-only) rather than a broader-scope org token. The env var exposed inside the RUN step staysGITHUB_TOKEN, since that's the literal name Apptainer's upstream script checks for.Pairs with dl/JoC/nemo-ci!2850, which forwards
APPTAINER_GITHUB_TOKENas this buildx secret.Verification
Manual pipeline run on both paired branches (single nightly test,
cw_dfw, forced fresh build): https://gitlab-master.nvidia.com/dl/JoC/nemo-ci/-/pipelines/65781582Test plan