61 - Authenticate composer dist downloads and drop the dead registry cache

.forgejo/workflows/ci.yml

@@ -59,8 +59,8 @@ jobs:
           file: docker/build/Dockerfile.ci
           push: true
           tags: forge.lvl0.xyz/lvl0/dishplanner-ci:${{ steps.meta.outputs.tag }}
-          cache-from: type=registry,ref=forge.lvl0.xyz/lvl0/dishplanner-ci:buildcache
-          cache-to: type=registry,ref=forge.lvl0.xyz/lvl0/dishplanner-ci:buildcache,mode=max
+          secrets: |
+            gh_pat=${{ secrets.GH_PAT }}
 
   ci:
     needs: ci-image

docker/build/Dockerfile.ci

@@ -37,13 +37,21 @@ COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
 
 # Bake the project's PHP dependencies (dev included) into the image so CI
 # restores them with a local copy instead of paying a per-run composer install
-# over the network. --prefer-source clones via git instead of fetching dist
-# archives, avoiding the codeload.github.com rate limits the runner hits under
-# --prefer-dist.
+# over the network.
+#
+# The token lifts GitHub's API rate limit from 60 to 5000 requests/hour, which
+# is what forced --prefer-source before; dist archives need no special handling.
 #
 # --no-scripts skips `php artisan package:discover` (the app isn't present
 # here). CI runs `composer install` after restoring vendor, which regenerates
 # bootstrap/cache.
 WORKDIR /opt/deps
 COPY composer.json composer.lock ./
-RUN composer install --no-interaction --no-progress --prefer-source --no-scripts
+RUN --mount=type=secret,id=gh_pat \
+    if [ -s /run/secrets/gh_pat ]; then \
+        composer config --global github-oauth.github.com "$(cat /run/secrets/gh_pat)" || exit 1; \
+    fi; \
+    composer install --no-interaction --no-progress --no-scripts; \
+    STATUS=$?; \
+    composer config --global --unset github-oauth.github.com >/dev/null 2>&1 || true; \
+    exit $STATUS