docs: Pass GH_TOKEN to cargo-binstall to avoid rate limits

When cargo-binstall fetches pre-built binaries from GitHub, it can hit
API rate limits (403 Forbidden) when unauthenticated. This causes it to
fall back to building from source, which fails for mdbook-linkcheck
because the devenv container lacks openssl-devel and the perl modules
needed to build OpenSSL from source.

Pass the GitHub Actions token through to the container build as a secret,
allowing cargo-binstall to make authenticated requests with higher rate
limits.

Assisted-by: OpenCode (claude-sonnet-4-20250514)
Signed-off-by: Colin Walters <walters@verbum.org>

Author: cgwalters

.github/workflows/docs.yml

@@ -23,6 +23,8 @@ jobs:
         uses: ./.github/actions/bootc-ubuntu-setup
       - name: Build mdbook
         run: mkdir target && just build-mdbook-to target/docs
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Pages
         id: pages
         uses: actions/configure-pages@v5

Justfile

@@ -205,7 +205,14 @@ pullspec-for-os TYPE NAME:
     @jq -r --arg v "{{NAME}}" '."{{TYPE}}"[$v]' < hack/os-image-map.json
 
 build-mdbook:
-    podman build {{generic_buildargs}} -t localhost/bootc-mdbook -f docs/Dockerfile.mdbook .
+    #!/bin/bash
+    set -xeuo pipefail
+    secret_arg=""
+    # Pass GH_TOKEN to avoid API rate limits when cargo-binstall fetches binaries
+    if test -n "${GH_TOKEN:-}"; then
+        secret_arg="--secret=id=GH_TOKEN,env=GH_TOKEN"
+    fi
+    podman build {{generic_buildargs}} ${secret_arg} -t localhost/bootc-mdbook -f docs/Dockerfile.mdbook .
 
 # Generate the rendered HTML to the target DIR directory
 build-mdbook-to DIR: build-mdbook

docs/Dockerfile.mdbook

@@ -1,8 +1,13 @@
 FROM ghcr.io/bootc-dev/devenv-c10s:latest
 USER root
 # Install mdbook tooling via cargo-binstall
-RUN <<EORUN
+# The GH_TOKEN secret is used to avoid GitHub API rate limits when fetching
+# pre-built binaries. Without it, binstall falls back to building from source.
+RUN --mount=type=secret,id=GH_TOKEN <<EORUN
 set -xeuo pipefail
+if test -f /run/secrets/GH_TOKEN; then
+    export GH_TOKEN=$(cat /run/secrets/GH_TOKEN)
+fi
 curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
 deps=(mdbook@0.4.52 
       mdbook-mermaid@0.16.0