[Build Infra] lean-ctx install step fails with HTTP 403 — GitHub API rate limit blocks CI

[tryweb]

Summary

The Dockerfile RUN curl -fsSL https://leanctx.com/install.sh | sh step (Dockerfile:135) is failing with HTTP 403 in CI because the leanctx.com install script fetches the latest lean-ctx release from https://api.github.com/repos/yvgude/lean-ctx/releases/latest without authentication, and the GitHub API is returning 403 to anonymous clients (rate limit or policy change).

This blocks all CI runs on PRs that touch the Dockerfile, including the automated dependency-update PR #44.

Evidence

CI run on PR #44 (workflow_dispatch):

• Run #28910144775 — failure at Build Image → Build image (Dockerfile:135)

Failing step log:

#19 [13/30] RUN curl -fsSL https://leanctx.com/install.sh | sh
#19 0.928 lean-ctx installer
#19 0.928 Mode: download pre-built binary
#19 0.928 Platform: x86_64-unknown-linux-gnu
#19 0.928 Fetching latest release...
#19 1.037 curl: (22) The requested URL returned error: 403
#19 1.039 Error: could not determine latest release.
ERROR: process "/bin/sh -c curl -fsSL https://leanctx.com/install.sh | sh" did not complete successfully: exit code: 1

Installer source (line referencing the API call):

REPO="yvgude/lean-ctx"
...
latest="$(curl -fsSL "https://api.github.com/repos/${REPO}/releases/latest" \```

## Impact

- **CI for any PR touching the Dockerfile is now red.** Latest successful `main` CI: 2026-07-07 03:49 UTC. Every run since has hit this 403.
- PR #44 (`chore: update Dockerfile pinned versions`) is held and cannot be auto-merged even though its content is purely version bumps — see [PR #44 comment](https://github.com/tryweb/ai-engkit/pull/44#issuecomment-4910707037).
- Dependency-update workflow's local test (which runs in a different network context) does **not** catch this; the failure only appears in the GitHub Actions runner.

## Suggested Fixes (any one is acceptable)

### Option A — Pin lean-ctx to a specific release (preferred, smallest blast radius)
Replace the unversioned installer call with an explicit tag and a sha256-verified asset URL:
```dockerfile
ARG LEANCTX_VERSION=v3.9.2
RUN set -eux; \
    curl -fsSL -o /tmp/lean-ctx.tar.gz \
      "https://github.com/yvgude/lean-ctx/releases/download/${LEANCTX_VERSION}/lean-ctx-x86_64-unknown-linux-gnu.tar.gz" \
    && tar -xzf /tmp/lean-ctx.tar.gz -C /usr/local/bin/ \
    && rm /tmp/lean-ctx.tar.gz

Pros: deterministic builds, no API call, immune to rate limits.
Cons: deviates from upstream's install.sh contract; we own the upgrade.

Option B — Pass a GITHUB_TOKEN build-arg into the installer

ARG GITHUB_TOKEN
RUN curl -fsSL -H "Authorization: Bearer ${GITHUB_TOKEN}" \
      https://leanctx.com/install.sh | sh -s -- --download

But the upstream installer doesn't accept auth headers for its internal api.github.com call — this likely requires an upstream patch.

Option C — Use actions/checkout of the lean-ctx repo at a pinned tag

Pre-clone yvgude/lean-ctx into the image at a specific tag and run its installer locally:

ARG LEANCTX_VERSION=v3.9.2
ADD https://github.com/yvgude/lean-ctx/archive/refs/tags/${LEANCTX_VERSION}.tar.gz /tmp/lean-ctx.tar.gz
RUN tar -xzf /tmp/lean-ctx.tar.gz -C /tmp/ && bash /tmp/lean-ctx-${LEANCTX_VERSION#v}/install.sh

Pros: no API call to api.github.com, deterministic.
Cons: larger intermediate image layer.

Recommended Action

1. Pick one of the options above and open a follow-up PR.
2. Re-run the dependency-update workflow (or wait for the next scheduled run) to re-dispatch CI.
3. Once CI is green, PR chore: update Dockerfile pinned versions #44 can be auto-merged.

Related

• PR: #44 — chore: update Dockerfile pinned versions (blocked by this)
• CI runs: #28910143078, #28910144775

---

Auto-filed by the PR triage bot — not auto-merging any dependency PR while CI is red.

[tryweb]

Resolved in e0ba3cc.

What changed:

• pinned lean-ctx in Dockerfile to the release tarball URL instead of calling the latest-resolving install script
• added SHA256 verification for the pinned lean-ctx asset
• updated dependency-update workflow to track LEANCTX_VERSION + LEANCTX_SHA256 as pinned inputs and resolve the matching checksum from the tagged GitHub release

Validation:

• docker build -t ai-engkit:test .
• docker compose -f docker-compose.dev.yml build
• docker compose -f docker-compose.dev.yml up -d
• ./test/run-tests.sh ai-engkit-dev -> 93 passed, 0 failed, 0 skipped
• docker compose -f docker-compose.dev.yml down -v --remove-orphans