From cfad3dcb1b9eae2d788794ed572b9b1c9b81c6b3 Mon Sep 17 00:00:00 2001
From: myrmidex <myrmidex@myrmidex.net>
Date: Wed, 19 Aug 2026 15:49:09 +0200
Subject: [PATCH] 61 - Authenticate composer dist downloads and drop the dead
 registry cache

---
 .forgejo/workflows/ci.yml  |  4 ++--
 docker/build/Dockerfile.ci | 16 ++++++++++++----
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 1a06c12..7a5e14c 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -59,8 +59,8 @@ jobs:
           file: docker/build/Dockerfile.ci
           push: true
           tags: forge.lvl0.xyz/lvl0/dishplanner-ci:${{ steps.meta.outputs.tag }}
-          cache-from: type=registry,ref=forge.lvl0.xyz/lvl0/dishplanner-ci:buildcache
-          cache-to: type=registry,ref=forge.lvl0.xyz/lvl0/dishplanner-ci:buildcache,mode=max
+          secrets: |
+            gh_pat=${{ secrets.GH_PAT }}
 
   ci:
     needs: ci-image
diff --git a/docker/build/Dockerfile.ci b/docker/build/Dockerfile.ci
index 193f27c..0e3b35e 100644
--- a/docker/build/Dockerfile.ci
+++ b/docker/build/Dockerfile.ci
@@ -37,13 +37,21 @@ COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
 
 # Bake the project's PHP dependencies (dev included) into the image so CI
 # restores them with a local copy instead of paying a per-run composer install
-# over the network. --prefer-source clones via git instead of fetching dist
-# archives, avoiding the codeload.github.com rate limits the runner hits under
-# --prefer-dist.
+# over the network.
+#
+# The token lifts GitHub's API rate limit from 60 to 5000 requests/hour, which
+# is what forced --prefer-source before; dist archives need no special handling.
 #
 # --no-scripts skips `php artisan package:discover` (the app isn't present
 # here). CI runs `composer install` after restoring vendor, which regenerates
 # bootstrap/cache.
 WORKDIR /opt/deps
 COPY composer.json composer.lock ./
-RUN composer install --no-interaction --no-progress --prefer-source --no-scripts
+RUN --mount=type=secret,id=gh_pat \
+    if [ -s /run/secrets/gh_pat ]; then \
+        composer config --global github-oauth.github.com "$(cat /run/secrets/gh_pat)" || exit 1; \
+    fi; \
+    composer install --no-interaction --no-progress --no-scripts; \
+    STATUS=$?; \
+    composer config --global --unset github-oauth.github.com >/dev/null 2>&1 || true; \
+    exit $STATUS