#375 fix(runtime): authenticate the python-build-standalone API lookup (403 → build fails)

[Anonymous]

Originally created by: Akarsh-Hegde

Why

scripts/build-mlx-runtime.sh resolves the latest python-build-standalone release via an unauthenticated api.github.com call (60 req/hr/IP). CI runners share IPs, so it intermittently 403s (curl exit 56) and the build dies before producing the tarball.

This already bit us: the first auto-publish run after [#372] merged to pre-main failed at the build step on this 403 and only passed on re-run (run 28429586316).

The real risk is production: publish-production is approval-gated (the production-runtime Environment). A 403 there means approve → build 403s → re-run → approve again on a gated, single-shot publish that delivers customer fixes.

Fix

• build-mlx-runtime.sh: add a Authorization: Bearer header to the api.github.com lookup only when a token is present (GH_TOKEN, falling back to GITHUB_TOKEN), raising the limit to 1000/hr. Header is omitted when no token is set, so local builds still work. The asset download is a CDN redirect and is deliberately left unauthenticated.
• build-mlx-runtime.yml: pass secrets.GITHUB_TOKEN into the build step's env.

Validation

• bash -n clean; ruby -ryaml confirms the workflow YAML is valid.
• The conditional array expansion (${PBS_AUTH[@]+...}) is verified safe under set -euo pipefail on bash 3.2.57 — the exact version the macOS runner ships — both with and without a token:
• no token → args: [] (unauthenticated, no unbound-var error)
• with token → -H "Authorization: Bearer …"

Clears the remaining caveat on the pre-main → main promotion path (with [#372] + [#373]).

🤖 Generated with Claude Code

[Anonymous]

Originally posted by: coderabbitai[bot]

[!IMPORTANT]

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d0cd92b6-93d2-4a84-9553-e7eca786200b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:
- [ ] 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

- [ ] Create PR with unit tests - [ ] Commit unit tests in branch `fix/runtime-build-curl-auth`

---

_{Comment @coderabbitai help to get the list of available commands.}

[Anonymous]

Originally posted by: Akarsh-Hegde

Update — review feedback addressed, merge-ready ✅

Pushed cba2b0f3 resolving the least-privilege comment on the build job.

Security hardening (your review point): the workflow now defaults to contents: read, with contents: write granted only to publish-staging / publish-production (the jobs that create/upload the channel release). build (running third-party pip install backends), smoke (running the built runtime), and gate (read-only) all inherit read — none of them hold a release-write token anymore.

Resolved per-job scopes:
| job | contents |
|---|---|
| gate / build / smoke | read (inherited) |
| publish-staging / publish-production | write |

Original fix (this PR's purpose): build-mlx-runtime.sh now authenticates the api.github.com python-build-standalone lookup with a Bearer token when present (60→1000 req/hr), fixing the intermittent 403 that failed the first auto-publish. Header omitted when no token → local builds unaffected. Verified bash -n clean and the array expansion safe on bash 3.2.57 (the runner version).

Validation: workflow YAML parses; per-job permissions resolve as the table above.

Both commits are CI-only (no services/**, no runtime version change). Mergeable / CLEAN. Ready to merge.

[Anonymous]

Ticket changed by: Akarsh-Hegde

• status: open --> closed