don't depend on the GitHub API to check release

crazy-max · crazy-max · commit 39322d905726 · 2023-01-30T11:56:13.000+01:00
Signed-off-by: CrazyMax &lt;crazy-max@users.noreply.github.com&gt;
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -30,8 +30,6 @@ jobs:
         uses: docker/bake-action@v2
         with:
           targets: test
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       -
         name: Upload coverage
         uses: codecov/codecov-action@v3
diff --git a/README.md b/README.md
@@ -28,7 +28,6 @@ ___
 * [Notes](#notes)
   * [`nodes` output](#nodes-output)
   * [BuildKit container logs](#buildkit-container-logs)
-* [Using on GHES](#using-on-ghes)
 * [Contributing](#contributing)
 
 ## Usage
@@ -175,35 +174,6 @@ The following [official docker environment variables](https://docs.docker.com/en
 
 See https://docs.docker.com/build/ci/github-actions/configure-builder/#buildkit-container-logs
 
-## Using on GHES
-
-GitHub Runners come [pre-installed with Docker Buildx](https://github.com/actions/runner-images/blob/main/images/linux/Ubuntu2204-Readme.md)
-following your virtual environment. If you specify a version or `latest` of
-Docker Buildx in your workflow, the version will be downloaded from [GitHub Releases in `docker/buildx`](https://github.com/docker/buildx/releases)
-repository. These calls to `docker/buildx` are made via unauthenticated requests,
-which are limited to [60 requests per hour per IP](https://docs.github.com/en/rest/overview/resources-in-the-rest-api#rate-limiting).
-
-If more requests are made within the time frame, then you will start to see
-rate-limit errors during downloading that looks like:
-
-```
-##[error]API rate limit exceeded for...
-```
-
-To get a higher rate limit, you can [generate a personal access token on github.com](https://github.com/settings/tokens/new)
-and pass it as the `github_token` input for the action:
-
-```yaml
-uses: docker/setup-buildx-action@v2
-with:
-  github_token: ${{ secrets.GH_DOTCOM_TOKEN }}
-  version: v0.10.1
-```
-
-If the runner is not able to access `github.com`, it will take the default one
-available on the GitHub Runner or runner's tool cache. See "[Setting up the tool cache on self-hosted runners without internet access](https://docs.github.com/en/enterprise-server/admin/github-actions/managing-access-to-actions-from-githubcom/setting-up-the-tool-cache-on-self-hosted-runners-without-internet-access)"
-for more information.
-
 ## Contributing
 
 Want to contribute? Awesome! You can find information about contributing to
diff --git a/__tests__/buildx.test.ts b/__tests__/buildx.test.ts
@@ -28,6 +28,34 @@ describe('isAvailable', () => {
   });
 });
 
+describe('getRelease', () => {
+  it('returns latest buildx GitHub release', async () => {
+    const release = await buildx.getRelease('latest');
+    expect(release).not.toBeNull();
+    expect(release?.tag_name).not.toEqual('');
+  });
+
+  it('returns v0.10.1 buildx GitHub release', async () => {
+    const release = await buildx.getRelease('v0.10.1');
+    expect(release).not.toBeNull();
+    expect(release?.id).toEqual(90346950);
+    expect(release?.tag_name).toEqual('v0.10.1');
+    expect(release?.html_url).toEqual('https://github.com/docker/buildx/releases/tag/v0.10.1');
+  });
+
+  it('returns v0.2.2 buildx GitHub release', async () => {
+    const release = await buildx.getRelease('v0.2.2');
+    expect(release).not.toBeNull();
+    expect(release?.id).toEqual(17671545);
+    expect(release?.tag_name).toEqual('v0.2.2');
+    expect(release?.html_url).toEqual('https://github.com/docker/buildx/releases/tag/v0.2.2');
+  });
+
+  it('unknown release', async () => {
+    await expect(buildx.getRelease('foo')).rejects.toThrowError(new Error('Cannot find Buildx release foo in https://raw.githubusercontent.com/docker/buildx/master/.github/releases.json'));
+  });
+});
+
 describe('isAvailable standalone', () => {
   const execSpy = jest.spyOn(exec, 'getExecOutput');
   buildx.isAvailable(true);
@@ -221,7 +249,7 @@ describe('install', () => {
   ])(
     'acquires %p of buildx (standalone: %p)',
     async (version, standalone) => {
-      const buildxBin = await buildx.install(version, process.env.GITHUB_TOKEN || '', tmpDir, standalone);
+      const buildxBin = await buildx.install(version, tmpDir, standalone);
       expect(fs.existsSync(buildxBin)).toBe(true);
     },
     100000
diff --git a/__tests__/github.test.ts b/__tests__/github.test.ts
diff --git a/action.yml b/action.yml
@@ -44,15 +44,6 @@ inputs:
   append:
     description: 'Append additional nodes to the builder'
     required: false
-  github_token:
-    # https://github.com/actions/setup-go/blob/21459d0b7b1d63741429b748885bf5a4974593b4/action.yml#L12-L14
-    description: >
-      Used to verifiy the Git tag exists on docker/buildx repo. Since there's a
-      default, this is typically not supplied by the user. When running this
-      action on github.com, the default value is sufficient. When running on
-      GHES, you can pass a personal access token for github.com if you are
-      experiencing rate limiting.
-    default: ${{ github.server_url == 'https://github.com' && github.token || '' }}
 
 outputs:
   name:
diff --git a/dev.Dockerfile b/dev.Dockerfile
@@ -72,8 +72,7 @@ RUN --mount=type=bind,target=.,rw \
   --mount=type=cache,target=/src/node_modules \
   --mount=type=bind,from=docker,source=/usr/local/bin/docker,target=/usr/bin/docker \
   --mount=type=bind,from=buildx,source=/buildx,target=/usr/libexec/docker/cli-plugins/docker-buildx \
-  --mount=type=secret,id=GITHUB_TOKEN \
-  GITHUB_TOKEN=$(cat /run/secrets/GITHUB_TOKEN) yarn run test --coverageDirectory=/tmp/coverage
+  yarn run test --coverageDirectory=/tmp/coverage
 
 FROM scratch AS test-coverage
 COPY --from=test /tmp/coverage /
diff --git a/docker-bake.hcl b/docker-bake.hcl
@@ -50,5 +50,4 @@ target "test" {
   dockerfile = "dev.Dockerfile"
   target = "test-coverage"
   output = ["./coverage"]
-  secret = ["id=GITHUB_TOKEN,env=GITHUB_TOKEN"]
 }
diff --git a/package.json b/package.json
@@ -29,7 +29,7 @@
   "dependencies": {
     "@actions/core": "^1.10.0",
     "@actions/exec": "^1.1.1",
-    "@actions/github": "^5.1.1",
+    "@actions/http-client": "^2.0.1",
     "@actions/tool-cache": "^2.0.1",
     "csv-parse": "^5.3.3",
     "js-yaml": "^4.1.0",
diff --git a/src/buildx.ts b/src/buildx.ts
@@ -4,9 +4,9 @@ import * as semver from 'semver';
 import * as util from 'util';
 import * as context from './context';
 import * as git from './git';
-import * as github from './github';
 import * as core from '@actions/core';
 import * as exec from '@actions/exec';
+import * as httpm from '@actions/http-client';
 import * as tc from '@actions/tool-cache';
 
 export type Builder = {
@@ -25,6 +25,29 @@ export type Node = {
   platforms?: string;
 };
 
+export interface GitHubRelease {
+  id: number;
+  tag_name: string;
+  html_url: string;
+  assets: Array<string>;
+}
+
+export const getRelease = async (version: string): Promise<GitHubRelease> => {
+  const url = `https://raw.githubusercontent.com/docker/buildx/master/.github/releases.json`;
+  const http: httpm.HttpClient = new httpm.HttpClient('setup-buildx');
+  const resp: httpm.HttpClientResponse = await http.get(url);
+  const body = await resp.readBody();
+  const statusCode = resp.message.statusCode || 500;
+  if (statusCode >= 400) {
+    throw new Error(`Failed to get Buildx release ${version} from ${url} with status code ${statusCode}: ${body}`);
+  }
+  const releases = <Record<string, GitHubRelease>>JSON.parse(body);
+  if (!releases[version]) {
+    throw new Error(`Cannot find Buildx release ${version} in ${url}`);
+  }
+  return releases[version];
+};
+
 export async function getConfigInline(s: string): Promise<string> {
   return getConfig(s, false);
 }
@@ -237,13 +260,8 @@ export async function build(inputBuildRef: string, dest: string, standalone: boo
   return setPlugin(toolPath, dest);
 }
 
-export async function install(inputVersion: string, githubToken: string, dest: string, standalone: boolean): Promise<string> {
-  let release: github.Release;
-  if (inputVersion == 'latest') {
-    release = await github.getLatestRelease(githubToken);
-  } else {
-    release = await github.getReleaseTag(inputVersion, githubToken);
-  }
+export async function install(inputVersion: string, dest: string, standalone: boolean): Promise<string> {
+  const release: GitHubRelease = await getRelease(inputVersion);
   core.debug(`Release ${release.tag_name} found`);
   const version = release.tag_name.replace(/^v+|v+$/g, '');
 
diff --git a/src/context.ts b/src/context.ts
@@ -36,7 +36,6 @@ export interface Inputs {
   config: string;
   configInline: string;
   append: string;
-  githubToken: string;
 }
 
 export async function getInputs(): Promise<Inputs> {
@@ -52,8 +51,7 @@ export async function getInputs(): Promise<Inputs> {
     endpoint: core.getInput('endpoint'),
     config: core.getInput('config'),
     configInline: core.getInput('config-inline'),
-    append: core.getInput('append'),
-    githubToken: core.getInput('github_token')
+    append: core.getInput('append')
   };
 }
 
diff --git a/src/github.ts b/src/github.ts
diff --git a/src/main.ts b/src/main.ts
@@ -42,7 +42,7 @@ async function run(): Promise<void> {
       core.endGroup();
     } else if (!(await buildx.isAvailable(standalone)) || inputs.version) {
       core.startGroup(`Download and install buildx`);
-      await buildx.install(inputs.version || 'latest', inputs.githubToken, standalone ? context.tmpDir() : dockerConfigHome, standalone);
+      await buildx.install(inputs.version || 'latest', standalone ? context.tmpDir() : dockerConfigHome, standalone);
       core.endGroup();
     }
 
diff --git a/yarn.lock b/yarn.lock

Original file line number	Diff line number	Diff line change
`@@ -30,8 +30,6 @@ jobs:`
`30`	`30`	`uses: docker/bake-action@v2`
`31`	`31`	`with:`
`32`	`32`	`targets: test`
`33`		`- env:`
`34`		`- GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}`
`35`	`33`	`-`
`36`	`34`	`name: Upload coverage`
`37`	`35`	`uses: codecov/codecov-action@v3`
Original file line number	Diff line number	Diff line change
`@@ -50,5 +50,4 @@ target "test" {`
`50`	`50`	`dockerfile = "dev.Dockerfile"`
`51`	`51`	`target = "test-coverage"`
`52`	`52`	`output = ["./coverage"]`
`53`		`- secret = ["id=GITHUB_TOKEN,env=GITHUB_TOKEN"]`
`54`	`53`	`}`