Skip to content

Use GHA id-token for sccache-dist auth token#7790

Merged
rapids-bot[bot] merged 1 commit intorapidsai:mainfrom
trxcllnt:fea/sccache-dist-id-token
Feb 11, 2026
Merged

Use GHA id-token for sccache-dist auth token#7790
rapids-bot[bot] merged 1 commit intorapidsai:mainfrom
trxcllnt:fea/sccache-dist-id-token

Conversation

@trxcllnt
Copy link
Copy Markdown
Collaborator

Use the GitHub OIDC token for sccache-dist auth instead of the org's secrets.GIST_REPO_READ_ORG_GITHUB_TOKEN personal access token.

This change is already implemented, this PR just removes any references to GIST_REPO_READ_ORG_GITHUB_TOKEN.

@trxcllnt trxcllnt requested a review from a team as a code owner February 10, 2026 22:13
@trxcllnt trxcllnt added the 5 - Ready to Merge Testing and reviews complete, ready to merge label Feb 10, 2026
@trxcllnt trxcllnt requested a review from msarahan February 10, 2026 22:13
@trxcllnt trxcllnt added improvement Improvement / enhancement to an existing function non-breaking Non-breaking change labels Feb 10, 2026
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Feb 10, 2026

📝 Walkthrough

Summary by CodeRabbit

  • Chores
    • Streamlined GitHub Actions workflows by removing unused secret configurations from build and test pipelines
    • Optimized test matrix configurations to improve workflow execution efficiency

Walkthrough

Three GitHub Actions workflow files are modified to remove sccache distribution token secret references from multiple job configurations. Additionally, one workflow removes RAPIDS auxiliary secret references and updates matrix configurations for test dependencies.

Changes

Cohort / File(s) Summary
Sccache Token Secret Removals
.github/workflows/build.yaml, .github/workflows/pr.yaml, .github/workflows/test.yaml
Removed sccache-dist-token-secret-name configuration entries from job and step definitions across all three workflows (26 removals total).
RAPIDS Auxiliary Secret Removal
.github/workflows/pr.yaml
Removed rapids-aux-secret-1 reference and SCCACHE_DIST_AUTH_TOKEN_VAR environment variable from devcontainer configuration.
Matrix Configuration Updates
.github/workflows/pr.yaml, .github/workflows/test.yaml
Expanded and restructured matrix configurations—conda-python-scikit-learn-accel-tests now uses combined matrix with dependency branching; conda-python-cuml-accel-upstream-tests extends matrix_filter expression.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and specifically summarizes the main change: switching sccache-dist authentication from GitHub org secrets to GitHub Actions OIDC id-token.
Description check ✅ Passed The description is directly related to the changeset, explaining the rationale and scope of removing references to GIST_REPO_READ_ORG_GITHUB_TOKEN in favor of OIDC id-token.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

No actionable comments were generated in the recent review. 🎉


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@csadorf
Copy link
Copy Markdown
Contributor

csadorf commented Feb 10, 2026

Blocked by #7788

@trxcllnt
Copy link
Copy Markdown
Collaborator Author

/merge

@rapids-bot rapids-bot Bot merged commit 78ecde8 into rapidsai:main Feb 11, 2026
358 of 364 checks passed
@trxcllnt trxcllnt deleted the fea/sccache-dist-id-token branch February 11, 2026 06:00
dantegd added a commit to dantegd/cuml that referenced this pull request Feb 17, 2026
Use the GitHub OIDC token for sccache-dist auth instead of the org's `secrets.GIST_REPO_READ_ORG_GITHUB_TOKEN` personal access token.

This change is already implemented, this PR just removes any references to `GIST_REPO_READ_ORG_GITHUB_TOKEN`.

Authors:
  - Paul Taylor (https://github.com/trxcllnt)

Approvers:
  - James Lamb (https://github.com/jameslamb)

URL: rapidsai#7790
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

5 - Ready to Merge Testing and reviews complete, ready to merge improvement Improvement / enhancement to an existing function non-breaking Non-breaking change

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants