don't depend on the GitHub API to check release

Signed-off-by: CrazyMax <[email protected]>

.github/workflows/test.yml

@@ -30,8 +30,6 @@ jobs:
  uses: docker/bake-action@v2
  with:
  targets: test
- env:
- GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  -
  name: Upload coverage
  uses: codecov/codecov-action@v3

README.md

@@ -28,7 +28,6 @@ ___
 * [Notes](#notes)
  * [`nodes` output](#nodes-output)
  * [BuildKit container logs](#buildkit-container-logs)
-* [Using on GHES](#using-on-ghes)
 * [Contributing](#contributing)
 
 ## Usage
@@ -175,35 +174,6 @@ The following [official docker environment variables](https://docs.docker.com/en
 
 See https://docs.docker.com/build/ci/github-actions/configure-builder/#buildkit-container-logs
 
-## Using on GHES
-
-GitHub Runners come [pre-installed with Docker Buildx](https://github.com/actions/runner-images/blob/main/images/linux/Ubuntu2204-Readme.md)
-following your virtual environment. If you specify a version or `latest` of
-Docker Buildx in your workflow, the version will be downloaded from [GitHub Releases in `docker/buildx`](https://github.com/docker/buildx/releases)
-repository. These calls to `docker/buildx` are made via unauthenticated requests,
-which are limited to [60 requests per hour per IP](https://docs.github.com/en/rest/overview/resources-in-the-rest-api#rate-limiting).
-
-If more requests are made within the time frame, then you will start to see
-rate-limit errors during downloading that looks like:
-
-```
-##[error]API rate limit exceeded for...
-```
-
-To get a higher rate limit, you can [generate a personal access token on github.com](https://github.com/settings/tokens/new)
-and pass it as the `github_token` input for the action:
-
-```yaml
-uses: docker/setup-buildx-action@v2
-with:
- github_token: ${{ secrets.GH_DOTCOM_TOKEN }}
- version: v0.10.1
-```
-
-If the runner is not able to access `github.com`, it will take the default one
-available on the GitHub Runner or runner's tool cache. See "[Setting up the tool cache on self-hosted runners without internet access](https://docs.github.com/en/enterprise-server/admin/github-actions/managing-access-to-actions-from-githubcom/setting-up-the-tool-cache-on-self-hosted-runners-without-internet-access)"
-for more information.
-
 ## Contributing
 
 Want to contribute? Awesome! You can find information about contributing to

__tests__/buildx.test.ts

@@ -28,6 +28,34 @@ describe('isAvailable', () => {
  });
 });
 
+describe('getRelease', () => {
+ it('returns latest buildx GitHub release', async () => {
+ const release = await buildx.getRelease('latest');
+ expect(release).not.toBeNull();
+ expect(release?.tag_name).not.toEqual('');
+ });
+
+ it('returns v0.10.1 buildx GitHub release', async () => {
+ const release = await buildx.getRelease('v0.10.1');
+ expect(release).not.toBeNull();
+ expect(release?.id).toEqual(90346950);
+ expect(release?.tag_name).toEqual('v0.10.1');
+ expect(release?.html_url).toEqual('https://github.com/docker/buildx/releases/tag/v0.10.1');
+ });
+
+ it('returns v0.2.2 buildx GitHub release', async () => {
+ const release = await buildx.getRelease('v0.2.2');
+ expect(release).not.toBeNull();
+ expect(release?.id).toEqual(17671545);
+ expect(release?.tag_name).toEqual('v0.2.2');
+ expect(release?.html_url).toEqual('https://github.com/docker/buildx/releases/tag/v0.2.2');
+ });
+
+ it('unknown release', async () => {
+ await expect(buildx.getRelease('foo')).rejects.toThrowError(new Error('Cannot find Buildx release foo in https://raw.githubusercontent.com/docker/buildx/master/.github/releases.json'));
+ });
+});
+
 describe('isAvailable standalone', () => {
  const execSpy = jest.spyOn(exec, 'getExecOutput');
  buildx.isAvailable(true);
@@ -221,7 +249,7 @@ describe('install', () => {
  ])(
  'acquires %p of buildx (standalone: %p)',
  async (version, standalone) => {
- const buildxBin = await buildx.install(version, process.env.GITHUB_TOKEN || '', tmpDir, standalone);
+ const buildxBin = await buildx.install(version, tmpDir, standalone);
  expect(fs.existsSync(buildxBin)).toBe(true);
  },
  100000

action.yml

@@ -44,15 +44,6 @@ inputs:
  append:
  description: 'Append additional nodes to the builder'
  required: false
- github_token:
- # https://github.com/actions/setup-go/blob/21459d0b7b1d63741429b748885bf5a4974593b4/action.yml#L12-L14
- description: >
- Used to verifiy the Git tag exists on docker/buildx repo. Since there's a
- default, this is typically not supplied by the user. When running this
- action on github.com, the default value is sufficient. When running on
- GHES, you can pass a personal access token for github.com if you are
- experiencing rate limiting.
- default: ${{ github.server_url == 'https://github.com' && github.token || '' }}
 
 outputs:
  name:

dev.Dockerfile

@@ -72,8 +72,7 @@ RUN --mount=type=bind,target=.,rw \
  --mount=type=cache,target=/src/node_modules \
  --mount=type=bind,from=docker,source=/usr/local/bin/docker,target=/usr/bin/docker \
  --mount=type=bind,from=buildx,source=/buildx,target=/usr/libexec/docker/cli-plugins/docker-buildx \
- --mount=type=secret,id=GITHUB_TOKEN \
- GITHUB_TOKEN=$(cat /run/secrets/GITHUB_TOKEN) yarn run test --coverageDirectory=/tmp/coverage
+ yarn run test --coverageDirectory=/tmp/coverage
 
 FROM scratch AS test-coverage
 COPY --from=test /tmp/coverage /

docker-bake.hcl

@@ -50,5 +50,4 @@ target "test" {
  dockerfile = "dev.Dockerfile"
  target = "test-coverage"
  output = ["./coverage"]
- secret = ["id=GITHUB_TOKEN,env=GITHUB_TOKEN"]
 }

package.json

@@ -29,7 +29,7 @@
  "dependencies": {
  "@actions/core": "^1.10.0",
  "@actions/exec": "^1.1.1",
- "@actions/github": "^5.1.1",
+ "@actions/http-client": "^2.0.1",
  "@actions/tool-cache": "^2.0.1",
  "csv-parse": "^5.3.3",
  "js-yaml": "^4.1.0",

src/buildx.ts

@@ -4,9 +4,9 @@ import * as semver from 'semver';
 import * as util from 'util';
 import * as context from './context';
 import * as git from './git';
-import * as github from './github';
 import * as core from '@actions/core';
 import * as exec from '@actions/exec';
+import * as httpm from '@actions/http-client';
 import * as tc from '@actions/tool-cache';
 
 export type Builder = {
@@ -25,6 +25,29 @@ export type Node = {
  platforms?: string;
 };
 
+export interface GitHubRelease {
+ id: number;
+ tag_name: string;
+ html_url: string;
+ assets: Array<string>;
+}
+
+export const getRelease = async (version: string): Promise<GitHubRelease> => {
+ const url = `https://raw.githubusercontent.com/docker/buildx/master/.github/releases.json`;
+ const http: httpm.HttpClient = new httpm.HttpClient('setup-buildx');
+ const resp: httpm.HttpClientResponse = await http.get(url);
+ const body = await resp.readBody();
+ const statusCode = resp.message.statusCode || 500;
+ if (statusCode >= 400) {
+ throw new Error(`Failed to get Buildx release ${version} from ${url} with status code ${statusCode}: ${body}`);
+ }
+ const releases = <Record<string, GitHubRelease>>JSON.parse(body);
+ if (!releases[version]) {
+ throw new Error(`Cannot find Buildx release ${version} in ${url}`);
+ }
+ return releases[version];
+};
+
 export async function getConfigInline(s: string): Promise<string> {
  return getConfig(s, false);
 }
@@ -237,13 +260,8 @@ export async function build(inputBuildRef: string, dest: string, standalone: boo
  return setPlugin(toolPath, dest);
 }
 
-export async function install(inputVersion: string, githubToken: string, dest: string, standalone: boolean): Promise<string> {
- let release: github.Release;
- if (inputVersion == 'latest') {
- release = await github.getLatestRelease(githubToken);
- } else {
- release = await github.getReleaseTag(inputVersion, githubToken);
- }
+export async function install(inputVersion: string, dest: string, standalone: boolean): Promise<string> {
+ const release: GitHubRelease = await getRelease(inputVersion);
  core.debug(`Release ${release.tag_name} found`);
  const version = release.tag_name.replace(/^v+|v+$/g, '');
 

src/context.ts

@@ -36,7 +36,6 @@ export interface Inputs {
  config: string;
  configInline: string;
  append: string;
- githubToken: string;
 }
 
 export async function getInputs(): Promise<Inputs> {
@@ -52,8 +51,7 @@ export async function getInputs(): Promise<Inputs> {
  endpoint: core.getInput('endpoint'),
  config: core.getInput('config'),
  configInline: core.getInput('config-inline'),
- append: core.getInput('append'),
- githubToken: core.getInput('github_token')
+ append: core.getInput('append')
  };
 }
 

src/main.ts

@@ -42,7 +42,7 @@ async function run(): Promise<void> {
  core.endGroup();
  } else if (!(await buildx.isAvailable(standalone)) || inputs.version) {
  core.startGroup(`Download and install buildx`);
- await buildx.install(inputs.version || 'latest', inputs.githubToken, standalone ? context.tmpDir() : dockerConfigHome, standalone);
+ await buildx.install(inputs.version || 'latest', standalone ? context.tmpDir() : dockerConfigHome, standalone);
  core.endGroup();
  }