fix(docker): auth private hanzoai forks (sqlite, datastore-go) in backend build (#43)

The cmd/community image build 128'd on git ls-remote https://github.com/hanzoai/sqlite
(could not read Username — terminal prompts disabled) — red on every main push since
~2026-07-13. Root cause: the sqlite + datastore-go driver swap added PRIVATE hanzoai/*
deps, but the Dockerfile assumed all hanzoai forks are public and mounted no git token.
Mirror the base/cloud pattern: mount a gh_token build secret (docker.yaml passes
secrets.GH_PAT) and git url.insteadOf before go build. Unblocks the first post-rebrand
(o11y_traces) backend image.

Co-authored-by: Hanzo AI <ai@hanzo.ai>

.github/workflows/docker.yaml

@@ -61,6 +61,12 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           provenance: false
+          # cmd/community pulls PRIVATE hanzoai forks (sqlite, datastore-go); the
+          # Dockerfile mounts this as secret id `gh_token` and configs
+          # url.insteadOf before `go build`. Without it the build 128s on
+          # `git ls-remote https://github.com/hanzoai/sqlite` (auth required).
+          secrets: |
+            gh_token=${{ secrets.GH_PAT }}
           build-args: |
             VERSION=${{ steps.meta.outputs.version }}
             COMMIT_HASH=${{ github.sha }}

Dockerfile

@@ -8,9 +8,12 @@
 # and no sibling checkout is required — cloud lives only in the root `mount.go`
 # cloud-embed adapter, which `cmd/community` never pulls in.
 #
-# All external modules in cmd/community's graph are public (hanzoai/* forks of
-# otel-collector, govaluate, clickhouse-go-mock, expr), so the module
-# fetch needs no private git auth — only GOPRIVATE + GOSUMDB=off.
+# cmd/community's graph pulls PRIVATE hanzoai/* forks (hanzoai/sqlite +
+# hanzoai/datastore-go — the sqlite + datastore drivers added by the driver
+# swap), so the module fetch DOES need git auth. A `gh_token` build secret
+# (docker.yaml passes secrets.GH_PAT) is mounted and wired via git
+# url.insteadOf before the build; GOPRIVATE + GOSUMDB=off route hanzoai/*
+# direct and skip the sumdb.
 #
 # The browser SPA is served at the edge by hanzoai/static (house-native static
 # plugin), not bundled here, so the server runs headless (O11Y_WEB_ENABLED=false).
@@ -24,7 +27,8 @@ FROM golang:1.26.4-alpine AS backend
 RUN apk add --no-cache git ca-certificates
 WORKDIR /src
 
-# hanzoai/* modules are fetched via direct git (all public); trust go.sum.
+# hanzoai/* modules fetched via direct git (some private — auth'd by the
+# gh_token secret mounted on the build RUN below); trust go.sum.
 ENV GOPRIVATE=github.com/hanzoai/* \
     GOSUMDB=off \
     CGO_ENABLED=0 \
@@ -46,6 +50,10 @@ ARG VARIANT=community
 # not include cloud.
 RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=secret,id=gh_token \
+    if [ -s /run/secrets/gh_token ]; then \
+      git config --global url."https://x-access-token:$(cat /run/secrets/gh_token)@github.com/".insteadOf "https://github.com/"; \
+    fi && \
     VERPKG=github.com/hanzoai/o11y/pkg/version && \
     go build -trimpath -tags timetzdata \
       -ldflags "-s -w \

LLM.md

@@ -77,10 +77,18 @@ This replaces an unrelated upstream image that previously squatted the tags.
   no cloud sibling is checked out. (Cloud lives only in root `mount.go`, compiled by
   the `go build ./...` CI job — so `ci.yaml` still needs the sibling; the container
   does not.) A bare `go mod download` WOULD fail (cloud→../cloud); build the one pkg.
-- All external deps in its graph are PUBLIC hanzoai/* forks (otel-collector,
-  govaluate, clickhouse-go-mock, expr) → no private git auth, just
-  `GOPRIVATE=github.com/hanzoai/* GOSUMDB=off`. GHCR push uses `GH_PAT || GITHUB_TOKEN`
-  (the package is linked to hanzoai/o11y, so GITHUB_TOKEN+`packages: write` suffices).
+- Its graph pulls **PRIVATE** hanzoai/* forks — `hanzoai/sqlite` and
+  `hanzoai/datastore-go` (the sqlite + datastore drivers added by the driver
+  swap) — alongside the public ones (otel-collector, govaluate,
+  clickhouse-go-mock, expr). So the module fetch DOES need git auth: the
+  Dockerfile mounts a `gh_token` build secret (docker.yaml passes
+  `secrets.GH_PAT`) and wires `git url.insteadOf` before `go build`. Without it
+  the build 128s on `git ls-remote https://github.com/hanzoai/sqlite` ("could
+  not read Username … terminal prompts disabled"). `GOPRIVATE=github.com/hanzoai/*
+  GOSUMDB=off` still route hanzoai/* direct and skip the sumdb. GHCR push uses
+  `GH_PAT || GITHUB_TOKEN` (package linked to hanzoai/o11y, so
+  GITHUB_TOKEN+`packages: write` suffices for the push; GH_PAT is needed for the
+  cross-repo private module fetch).
 - Runs headless: `O11Y_WEB_ENABLED=false`. `routerweb` os.Stat()s its web dir at
   boot and fatals if missing; the SPA is served by hanzoai/static at the edge. The
   `frontend/` tree is NOT bundled — its `pnpm-lock.yaml` is STALE vs `package.json`