step 6 (A2): switch space to sdk:docker, install cadgenbench from private LeForge via GH_PAT build secret
Michael Rabinovich+1: Cursor
900c7c1
The HF Spaces Gradio SDK can't substitute Space secrets into requirements.txt
at build time (only at runtime), and embedding the literal token in
requirements.txt is a no-go (would land in git history of the Space).
Switching to sdk: docker collapses two open Step 6 sub-decisions into one
small change:
(A2) private GitHub dep install -- handled by `RUN --mount=type=secret`
in the Dockerfile; the PAT (Space secret GH_PAT) is mounted at
/run/secrets/GH_PAT for that one RUN and never lands in any layer.
(D) Playwright/Chromium for STEP -> PNG rendering -- handled by
`playwright install --with-deps chromium` in the same Dockerfile.
Layer ordering optimises rebuild speed: OS deps + requirements.txt deps
+ Chromium come early (stable), cadgenbench from git comes mid (bumps
on each commit), app.py + results.jsonl come last (changes most).
Front-matter: sdk: gradio -> sdk: docker, drop sdk_version + app_file
(Docker SDK uses Dockerfile CMD), add app_port: 7860. .…
