fix: authenticate private GitHub repos in containerized sandbox

[srathod-apphelix]

Summary

Fixes containerized sandbox edxapp (LMS/CMS) Docker image build failures when
cloning private edx/edx-platform from GitHub.

Jira - GSRE-4332

Purpose

Containerized sandboxes (edxapp_container_enabled=true) no longer build from an
in-repo Dockerfile. They use:

• public-dockerfiles/dockerfiles/edx-platform.Dockerfile for the base image
• internal-dockerfiles/edx-platform-private for the private overlay

The public Dockerfile fetches edx-platform inside the image with:

ADD https://github.com/${EDX_PLATFORM_REPO}.git#${EDX_PLATFORM_VERSION}

For sandbox, EDX_PLATFORM_REPO=edx/edx-platform (private). BuildKit requires
a GitHub PAT passed as --secret id=GIT_AUTH_TOKEN,env=GITHUB_TOKEN, matching
the production GoCD edxapp build pattern.

Changes

• ansible-provision.sh

  • Read LOCAL_GIT_PAT_TOKEN from configuration_secure_secret (AWS Secrets Manager)
  • Pass it to LMS/CMS container provisioning as app_git_pat_token

• app-container-provisioner.sh

  • Export GITHUB_TOKEN from app_git_pat_token during edx-platform image build
  • Pass --secret id=GIT_AUTH_TOKEN,env=GITHUB_TOKEN to:
    • public edx-platform.Dockerfile base build
    • private edx-platform-private LMS/CMS overlay build

[Copilot]

Pull request overview

This PR updates the containerized sandbox (edxapp LMS/CMS) image build flow to authenticate GitHub when BuildKit fetches a private edx/edx-platform repository during Docker builds.

Changes:

• Switch the container build process to export GITHUB_TOKEN from a new app_git_pat_token variable for BuildKit git auth.
• Read LOCAL_GIT_PAT_TOKEN from configuration_secure_secret (AWS Secrets Manager) and plumb it into the provisioning scripts.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
util/jenkins/app-container-provisioner.sh	Exports GITHUB_TOKEN from app_git_pat_token before BuildKit-based docker build steps that require GitHub auth.
util/jenkins/ansible-provision.sh	Reads LOCAL_GIT_PAT_TOKEN from Secrets Manager into app_git_pat_token for downstream container provisioning.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.