Supply PAT from secret

.bazelrc

@@ -221,6 +221,7 @@ common --@io_bazel_rules_docker//transitions:enable=false
 # Firecracker tests can only be run on Linux machines with bare execution, and we want to avoid a hard dependency
 # on Docker for development
 test --test_tag_filters=-docker,-bare
+build --build_tag_filters=-secrets
 
 # Use C++17 standard for all C++ compilation
 common:linux --host_cxxopt=-std=c++17

enterprise/server/test/integration/remote_bazel/BUILD

@@ -6,6 +6,7 @@ go_test(
     name = "remote_bazel_test",
     srcs = ["remote_bazel_test.go"],
     exec_properties = {
+        "include-secrets": "true",
         "test.workload-isolation-type": "firecracker",
         # Use an image with bazelisk installed
         "test.container-image": "docker://gcr.io/flame-public/rbe-ubuntu20-04-workflows@sha256:271e5e3704d861159c75b8dd6713dbe5a12272ec8ee73d17f89ed7be8026553f",
@@ -19,6 +20,9 @@ go_test(
         # Use the "docker" tag to only run this on authenticated BB workflows
         # to support runner recycling
         "docker",
+        # Use the "secrets" tag to prevent building this on unauthenticated
+        # builds
+        "secrets",
     ],
     deps = [
         "//cli/remotebazel",

enterprise/server/test/integration/remote_bazel/remote_bazel_test.go

@@ -99,11 +99,10 @@ func TestWithPublicRepo(t *testing.T) {
 
 func TestWithPrivateRepo(t *testing.T) {
 	repoName := "private-test-repo"
+	// If you need to re-generate this PAT, it should only have read access to
+	// `private-test-repo`, and should be saved as a BB secret in all environments.
 	username := "maggie-lou"
-	// This token grants read-only access to a private dummy repo.
-	// Github will invalidate tokens that are committed, so format it so that Github
-	// won't catch it.
-	personalAccessToken := fmt.Sprintf("github_pat_%s", "11ADKOFLI06Ob3cnrygcQa_gwLj0orOD3EILEu2k9pJ9EUkmXW6uM0k47k0uPOWInCDPHNC444JmQ8oN62")
+	personalAccessToken := os.Getenv("PRIVATE_TEST_REPO_GIT_ACCESS_TOKEN")
 	repoURLWithToken := fmt.Sprintf("https://%s:%s@github.com/buildbuddy-io/private-test-repo.git", username, personalAccessToken)
 
 	// Use a dir that is persisted on recycled runners