chore(rag): drop unused GITHUB_TOKEN/RAGBIO_API_KEY build args + github_token secret - #64
Merged
Merged
Conversation
…ub_token secret
The rag service's build config here (args: GITHUB_TOKEN/RAGBIO_API_KEY,
secrets: github_token) has been dead weight since
omnibioai-rag@9dcddce ("Complete @man4ish -> @OmniBioAI package scope
migration ... gitignore .npmrc to prevent committing GitHub token",
2026-07-25) -- over a month ago. The current Dockerfile resolves
@omnibioai/ui and the pinned omnibioai-iam-client/omnibioai-usage-client
entirely from local build-context sources (COPY'd in from the monorepo,
package.json/pyproject.toml rewritten via sed to point at file:/// paths)
specifically so no GitHub credential is needed at build time -- its own
comments say so directly ("so a GitHub credential is not needed", "this
build requires no GitHub secret"). Grepped the Dockerfile: zero
references to GITHUB_TOKEN, RAGBIO_API_KEY, or GHCR_PULL_TOKEN.
Harmless as dead config (Docker silently ignores unused build ARGs), so
this never broke anything -- just unnecessarily passed a GitHub-scoped
secret into a build stage that no longer consumes it. RAGBIO_API_KEY
stays wired at RUNTIME via the existing environment: block further down
in this same service definition (unchanged) -- this only removes the
build-time copy, which is the one that would otherwise get baked into
image layers.
Surfaced while investigating gitleaks findings from #63: one of the 7
flagged secrets was exactly this pattern (a real RAGBIO_API_KEY value
committed to .env history) -- this doesn't retroactively fix that
history, but stops the compose file from modeling this key as something
a build stage should ever see, which the build stage itself has agreed
with for a month already.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C6Wp4gDKCTsLWm4MzL7YWq
…-github-secret-build-args
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
ragservice's build config (args: GITHUB_TOKEN/RAGBIO_API_KEY,secrets: github_token) has been dead weight sinceomnibioai-rag@9dcddce("Complete @man4ish -> @OmniBioAI package scope migration ... gitignore .npmrc to prevent committing GitHub token", 2026-07-25). The current Dockerfile resolves@omnibioai/uiand the pinnedomnibioai-iam-client/omnibioai-usage-cliententirely from local build-context sources, specifically so no GitHub credential is needed at build time — its own comments say so directly. Grepped: zero references toGITHUB_TOKEN,RAGBIO_API_KEY, orGHCR_PULL_TOKENin the Dockerfile.Harmless as dead config (unused build ARGs are silently ignored), so it never broke anything — just unnecessarily modeled a GitHub-scoped secret as something this build stage should see.
RAGBIO_API_KEYstays wired at runtime via the existingenvironment:block (unchanged) — this only drops the build-time copy, which is the one that risks getting baked into image layers.Surfaced while investigating #63 (gitleaks findings): one of the 7 flagged secrets was exactly this pattern — a real
RAGBIO_API_KEYvalue committed to.envhistory. This doesn't retroactively fix that history, but stops the compose file from modeling this key as build-time input, which the Dockerfile itself has agreed with for a month already.Verified:
docker compose config --quietpasses,docker compose build ragsucceeds.🤖 Generated with Claude Code