fix(ci): authenticate simulator-build clones with github.token

[danceratopz]

Passes the Actions job token to the eels simulator image builds in the Hive Consume workflow, so the git clone of execution-specs inside those builds authenticates instead of running anonymously.

Motivation

GitHub rate-limits anonymous git-over-HTTPS per source IP, and the self-hosted runners intermittently hit the limit. When that happens the simulator image build dies before any test runs, e.g. this Engine job on forks/amsterdam:

Step 6/13 : RUN git clone --depth 1 https://github.com/ethereum/execution-specs.git && ...
fatal: could not read Username for 'https://github.com': No such device or address
fatal: expected flush after ref listing

The same failure mode has been hitting ethpandaops/hive-tests dashboard runs and other EF repo CI on the same runner pool. GitHub tightened unauthenticated rate limits in May 2025 and documents authentication as the remedy.

Changes

Add --sim.buildarg github_token=${{ github.token }} to the simulator invocation. The build-arg is consumed by the eels simulator Dockerfiles via ethereum/hive#1606; the token is job-scoped, works for cloning public repos, expires when the job ends, and is masked by the runner in logs and summaries.

Validation

An earlier revision of this PR temporarily pinned the Hive checkout to the ethereum/hive#1606 branch; the Engine, RLP and Sync jobs all built their simulator images with the authenticated clone and passed. The pin is now removed and the checkout is back on ethereum/hive @ master.

Before merge

• internal/libhive,simulators/ethereum/eels: support optional authenticated GitHub clones, redact token from recorded commands hive#1606 merged (until then the build-arg is an inert unused-build-arg warning and the clone stays anonymous)
• Hive checkout restored to ethereum/hive @ master

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.01%. Comparing base (b462ba2) to head (a285d49).
⚠️ Report is 1 commits behind head on forks/amsterdam.

Additional details and impacted files

@@               Coverage Diff                @@
##           forks/amsterdam    #3516   +/-   ##
================================================
  Coverage            94.01%   94.01%           
================================================
  Files                  624      624           
  Lines                36905    36905           
  Branches              3326     3326           
================================================
  Hits                 34695    34695           
  Misses                1533     1533           
  Partials               677      677           

Flag	Coverage Δ
unittests	94.01% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[spencer-tb]

Approving for now. I'll let you decide on whether we include danceratopz/hive#3 in your hive PR first before merging :)

If you prefer it then we need to use the environment-backed BuildKit secret interface from the hive change!

      - name: Run simulator tests
        if: matrix.mode == 'simulator'
        env:
          HIVE_GITHUB_TOKEN: ${{ github.token }}
        run: |
          cd hive
          ./hive --sim '${{ matrix.simulator }}' \
            --sim.parallelism=1 \
            --client ${{ env.CLIENT }} \
            --client-file ../execution-specs/.github/configs/hive/${{ env.CLIENT_FILE }} \
            --sim.buildarg fixtures=${{ env.FIXTURES_URL }} \

[fselmo]

back to draft? 👀

[danceratopz]

back to draft? 👀

Yeah, I think we should pursue a better, all encompassing approach and distribute our simulators via a container registry:
ethereum/hive#1606 (comment)