Skip to content

fix: authenticate camoufox fetch with GITHUB_TOKEN #309

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
l2ysho wants to merge 1 commit into
base: master
Choose a base branch
from
+32 −4
Draft

fix: authenticate camoufox fetch with GITHUB_TOKEN #309

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .github/workflows/release-node-playwright.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,6 +240,8 @@ jobs:
tags: ${{ fromJson(steps.prepare-tags.outputs.result).allTags }}
cache-from: type=gha,scope=${{ matrix.image-name }}-${{ matrix.node-version }}-${{ matrix.playwright-version }}
cache-to: type=gha,mode=max,scope=${{ matrix.image-name }}-${{ matrix.node-version }}-${{ matrix.playwright-version }}
secrets: |
github_token=${{ secrets.GITHUB_TOKEN }}

- name: Test image
run: docker run ${{ fromJson(steps.prepare-tags.outputs.result).firstImageName }}
Expand Down Expand Up @@ -281,6 +283,8 @@ jobs:
type=gha,scope=${{ matrix.image-name }}-${{ matrix.node-version }}-${{ matrix.playwright-version }}-slim
type=gha,scope=${{ matrix.image-name }}-${{ matrix.node-version }}-${{ matrix.playwright-version }}
cache-to: type=gha,mode=max,scope=${{ matrix.image-name }}-${{ matrix.node-version }}-${{ matrix.playwright-version }}-slim
secrets: |
github_token=${{ secrets.GITHUB_TOKEN }}

- name: Test slim image
run: docker run ${{ fromJson(steps.prepare-slim-tags.outputs.result).firstImageName }}
Expand Down Expand Up @@ -351,6 +355,8 @@ jobs:
tags: ${{ fromJson(steps.prepare-tags.outputs.result).allTags }}
outputs: type=image,oci-mediatypes=true
cache-from: type=gha,scope=${{ matrix.image-name }}-${{ matrix.node-version }}-${{ matrix.playwright-version }}
secrets: |
github_token=${{ secrets.GITHUB_TOKEN }}

- name: Build and push slim OCI image
if: github.event_name != 'pull_request'
Expand All @@ -370,6 +376,8 @@ jobs:
cache-from: |
type=gha,scope=${{ matrix.image-name }}-${{ matrix.node-version }}-${{ matrix.playwright-version }}-slim
type=gha,scope=${{ matrix.image-name }}-${{ matrix.node-version }}-${{ matrix.playwright-version }}
secrets: |
github_token=${{ secrets.GITHUB_TOKEN }}

# Aggregate the per-image size reports uploaded by the build matrix and post/update
# a single sticky PR comment comparing current vs new image sizes.
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/release-python-playwright.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,6 +183,8 @@ jobs:
tags: ${{ fromJson(steps.prepare-tags.outputs.result).allTags }}
cache-from: type=gha,scope=${{ matrix.image-name }}-${{ matrix.python-version }}-${{ matrix.playwright-version }}-${{ matrix.camoufox-version }}
cache-to: type=gha,mode=max,scope=${{ matrix.image-name }}-${{ matrix.python-version }}-${{ matrix.playwright-version }}-${{ matrix.camoufox-version }}
secrets: |
github_token=${{ secrets.GITHUB_TOKEN }}

- name: Test image
run: docker run ${{ fromJson(steps.prepare-tags.outputs.result).firstImageName }}
Expand Down Expand Up @@ -245,6 +247,8 @@ jobs:
tags: ${{ fromJson(steps.prepare-tags.outputs.result).allTags }}
outputs: type=image,oci-mediatypes=true
cache-from: type=gha,scope=${{ matrix.image-name }}-${{ matrix.python-version }}-${{ matrix.playwright-version }}-${{ matrix.camoufox-version }}
secrets: |
github_token=${{ secrets.GITHUB_TOKEN }}

# Aggregate the per-image size reports uploaded by the build matrix and post/update
# a single sticky PR comment comparing current vs new image sizes.
Expand Down
11 changes: 9 additions & 2 deletions node-playwright-camoufox/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
ARG NODE_VERSION=

# Use trixie to be consistent across node versions.
FROM node:${NODE_VERSION}-trixie-slim

Check warning on line 5 in node-playwright-camoufox/Dockerfile

View workflow job for this annotation

GitHub Actions / img: node-playwright-camoufox node: 26, apify: ^3.7.2, crawlee: ^3.18.1, pw: 1.60.0, cf: ^0.12.0, is-latest: true

Default value for global ARG results in an empty or invalid base image name 

InvalidDefaultArgInFrom: Default value for ARG node:${NODE_VERSION}-trixie-slim results in empty or invalid base image name
More info: https://docs.docker.com/go/dockerfile/rule/invalid-default-arg-in-from/

Check warning on line 5 in node-playwright-camoufox/Dockerfile

View workflow job for this annotation

GitHub Actions / img: node-playwright-camoufox node: 26, apify: ^3.7.2, crawlee: ^3.18.1, pw: 1.60.0, cf: ^0.12.0, is-latest: true

Default value for global ARG results in an empty or invalid base image name 

InvalidDefaultArgInFrom: Default value for ARG node:${NODE_VERSION}-trixie-slim results in empty or invalid base image name
More info: https://docs.docker.com/go/dockerfile/rule/invalid-default-arg-in-from/

Check warning on line 5 in node-playwright-camoufox/Dockerfile

View workflow job for this annotation

GitHub Actions / img: node-playwright-camoufox node: 24, apify: ^3.7.2, crawlee: ^3.18.1, pw: 1.60.0, cf: ^0.12.0, is-latest: true

Default value for global ARG results in an empty or invalid base image name 

InvalidDefaultArgInFrom: Default value for ARG node:${NODE_VERSION}-trixie-slim results in empty or invalid base image name
More info: https://docs.docker.com/go/dockerfile/rule/invalid-default-arg-in-from/

Check warning on line 5 in node-playwright-camoufox/Dockerfile

View workflow job for this annotation

GitHub Actions / img: node-playwright-camoufox node: 24, apify: ^3.7.2, crawlee: ^3.18.1, pw: 1.60.0, cf: ^0.12.0, is-latest: true

Default value for global ARG results in an empty or invalid base image name 

InvalidDefaultArgInFrom: Default value for ARG node:${NODE_VERSION}-trixie-slim results in empty or invalid base image name
More info: https://docs.docker.com/go/dockerfile/rule/invalid-default-arg-in-from/

Check warning on line 5 in node-playwright-camoufox/Dockerfile

View workflow job for this annotation

GitHub Actions / img: node-playwright-camoufox node: 22, apify: ^3.7.2, crawlee: ^3.18.1, pw: 1.60.0, cf: ^0.12.0, is-latest: true

Default value for global ARG results in an empty or invalid base image name 

InvalidDefaultArgInFrom: Default value for ARG node:${NODE_VERSION}-trixie-slim results in empty or invalid base image name
More info: https://docs.docker.com/go/dockerfile/rule/invalid-default-arg-in-from/

Check warning on line 5 in node-playwright-camoufox/Dockerfile

View workflow job for this annotation

GitHub Actions / img: node-playwright-camoufox node: 22, apify: ^3.7.2, crawlee: ^3.18.1, pw: 1.60.0, cf: ^0.12.0, is-latest: true

Default value for global ARG results in an empty or invalid base image name 

InvalidDefaultArgInFrom: Default value for ARG node:${NODE_VERSION}-trixie-slim results in empty or invalid base image name
More info: https://docs.docker.com/go/dockerfile/rule/invalid-default-arg-in-from/

# Playwright version is passed in the format `v1.57.0-` (matching the tag
# format used by the full node-playwright image). Stripped below before
Expand Down Expand Up @@ -135,10 +135,17 @@
RUN if [ "$SLIM" = "1" ]; then mv package.slim.json package.json; else rm package.slim.json; fi

# Install default dependencies, print versions of everything
RUN npm --quiet set progress=false \
#
# `camoufox-js fetch` reads api.github.com, where the whole matrix shares one 60/hour budget.
# GITHUB_TOKEN lifts it to 1000/hour; a secret, not a build arg, keeps it out of the layers.
# mode=0444 because this stage runs as myuser and secrets default to root-owned 0400.
# Without it the build stays unauthenticated and still works.
Comment on lines +139 to +142

@vladfrangu vladfrangu Sep 9, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

atClaude tldr this

RUN --mount=type=secret,id=github_token,mode=0444 \
npm --quiet set progress=false \
\
# Install Camoufox browser
&& PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=0 npx camoufox-js fetch \
&& GITHUB_TOKEN="$(cat /run/secrets/github_token 2>/dev/null || true)" \

@vladfrangu vladfrangu Sep 9, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel like we should unset the env variable if the file is not present

PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=0 npx camoufox-js fetch \
# Overrides the dynamic library used by Firefox to determine trusted root certificates with p11-kit-trust.so, which loads the system certificates.
&& rm -f /home/myuser/.cache/camoufox/libnssckbi.so \
&& ln -s $(ls -d /usr/lib/*-linux-gnu)/pkcs11/p11-kit-trust.so /home/myuser/.cache/camoufox/libnssckbi.so \
Expand Down
13 changes: 11 additions & 2 deletions python-playwright-camoufox/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
ARG PYTHON_VERSION=

# Use trixie-slim to be consistent across python versions
FROM --platform=linux/amd64 python:${PYTHON_VERSION}-slim-trixie

Check warning on line 5 in python-playwright-camoufox/Dockerfile

View workflow job for this annotation

GitHub Actions / img: python-playwright-camoufox py: 3.13, pw: 1.62.0, cf: 0.5.6, is-latest: true

FROM --platform flag should not use a constant value 

FromPlatformFlagConstDisallowed: FROM --platform flag should not use constant value "linux/amd64"
More info: https://docs.docker.com/go/dockerfile/rule/from-platform-flag-const-disallowed/

Check warning on line 5 in python-playwright-camoufox/Dockerfile

View workflow job for this annotation

GitHub Actions / img: python-playwright-camoufox py: 3.13, pw: 1.62.0, cf: 0.5.6, is-latest: true

Default value for global ARG results in an empty or invalid base image name 

InvalidDefaultArgInFrom: Default value for ARG python:${PYTHON_VERSION}-slim-trixie results in empty or invalid base image name
More info: https://docs.docker.com/go/dockerfile/rule/invalid-default-arg-in-from/

Check warning on line 5 in python-playwright-camoufox/Dockerfile

View workflow job for this annotation

GitHub Actions / img: python-playwright-camoufox py: 3.12, pw: 1.62.0, cf: 0.5.6, is-latest: true

FROM --platform flag should not use a constant value 

FromPlatformFlagConstDisallowed: FROM --platform flag should not use constant value "linux/amd64"
More info: https://docs.docker.com/go/dockerfile/rule/from-platform-flag-const-disallowed/

Check warning on line 5 in python-playwright-camoufox/Dockerfile

View workflow job for this annotation

GitHub Actions / img: python-playwright-camoufox py: 3.12, pw: 1.62.0, cf: 0.5.6, is-latest: true

Default value for global ARG results in an empty or invalid base image name 

InvalidDefaultArgInFrom: Default value for ARG python:${PYTHON_VERSION}-slim-trixie results in empty or invalid base image name
More info: https://docs.docker.com/go/dockerfile/rule/invalid-default-arg-in-from/

Check warning on line 5 in python-playwright-camoufox/Dockerfile

View workflow job for this annotation

GitHub Actions / img: python-playwright-camoufox py: 3.14, pw: 1.62.0, cf: 0.5.6, is-latest: true

FROM --platform flag should not use a constant value 

FromPlatformFlagConstDisallowed: FROM --platform flag should not use constant value "linux/amd64"
More info: https://docs.docker.com/go/dockerfile/rule/from-platform-flag-const-disallowed/

Check warning on line 5 in python-playwright-camoufox/Dockerfile

View workflow job for this annotation

GitHub Actions / img: python-playwright-camoufox py: 3.14, pw: 1.62.0, cf: 0.5.6, is-latest: true

Default value for global ARG results in an empty or invalid base image name 

InvalidDefaultArgInFrom: Default value for ARG python:${PYTHON_VERSION}-slim-trixie results in empty or invalid base image name
More info: https://docs.docker.com/go/dockerfile/rule/invalid-default-arg-in-from/

Check warning on line 5 in python-playwright-camoufox/Dockerfile

View workflow job for this annotation

GitHub Actions / img: python-playwright-camoufox py: 3.11, pw: 1.62.0, cf: 0.5.6, is-latest: true

FROM --platform flag should not use a constant value 

FromPlatformFlagConstDisallowed: FROM --platform flag should not use constant value "linux/amd64"
More info: https://docs.docker.com/go/dockerfile/rule/from-platform-flag-const-disallowed/

Check warning on line 5 in python-playwright-camoufox/Dockerfile

View workflow job for this annotation

GitHub Actions / img: python-playwright-camoufox py: 3.11, pw: 1.62.0, cf: 0.5.6, is-latest: true

Default value for global ARG results in an empty or invalid base image name 

InvalidDefaultArgInFrom: Default value for ARG python:${PYTHON_VERSION}-slim-trixie results in empty or invalid base image name
More info: https://docs.docker.com/go/dockerfile/rule/invalid-default-arg-in-from/

Check warning on line 5 in python-playwright-camoufox/Dockerfile

View workflow job for this annotation

GitHub Actions / img: python-playwright-camoufox py: 3.10, pw: 1.62.0, cf: 0.5.6, is-latest: true

FROM --platform flag should not use a constant value 

FromPlatformFlagConstDisallowed: FROM --platform flag should not use constant value "linux/amd64"
More info: https://docs.docker.com/go/dockerfile/rule/from-platform-flag-const-disallowed/

Check warning on line 5 in python-playwright-camoufox/Dockerfile

View workflow job for this annotation

GitHub Actions / img: python-playwright-camoufox py: 3.10, pw: 1.62.0, cf: 0.5.6, is-latest: true

Default value for global ARG results in an empty or invalid base image name 

InvalidDefaultArgInFrom: Default value for ARG python:${PYTHON_VERSION}-slim-trixie results in empty or invalid base image name
More info: https://docs.docker.com/go/dockerfile/rule/invalid-default-arg-in-from/

# Add labels to the image to identify it as an Apify Actor
LABEL maintainer="support@apify.com" \
Expand Down Expand Up @@ -103,14 +103,23 @@
# - Preinstalls the latest versions of setuptools and wheel to improve package installation speed
# - Installs the specified version of Playwright and Camoufox
# - Fetches the Camoufox browser
RUN python -m pip install --upgrade \
#
# `camoufox fetch` reads api.github.com, where the whole matrix shares one 60/hour budget.
# GITHUB_TOKEN lifts it to 1000/hour; a secret, not a build arg, keeps it out of the layers.
# Without it the build stays unauthenticated and still works.
RUN --mount=type=secret,id=github_token \
python -m pip install --upgrade \
pip \
setuptools \
wheel \
playwright~=${PLAYWRIGHT_VERSION} \
camoufox[geoip]~=${CAMOUFOX_VERSION} \
# Fetch the Camoufox browser
&& python -m camoufox fetch \
&& GITHUB_TOKEN="$(cat /run/secrets/github_token 2>/dev/null || true)" \
python -m camoufox fetch \
# `camoufox fetch` swallows sync errors and exits 0, so check what the runtime checks
# rather than ship an image that only fails at launch.
&& python -c "from camoufox.pkgman import installed_verstr; print('Camoufox installed:', installed_verstr())" \
# Overrides the dynamic library used by Firefox to determine trusted root certificates with p11-kit-trust.so, which loads the system certificates.
&& rm -f /root/.cache/camoufox/libnssckbi.so \
&& ln -s /usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-trust.so /root/.cache/camoufox/libnssckbi.so
Expand Down
Loading