action/image-build
9
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(image-build): document private pull capability

Browse Source 
Authored-By: Codex (GPT-5) <noreply@openai.com>
This commit is contained in:
Dave Kowalski
2026-08-26 13:23:04 +00:00
parent ffb1af3553
commit e20e59ad0d
2 changed files with 13 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+8 -4
View File
@@ -3,9 +3,10 @@
Composite Gitea Action that builds a container image with buildx and optionally
runs a smoke test. **Does not push** — pair with `action/image-push` to publish.
Splitting build from push lets a PR workflow run `image-build` (no secrets, no
side effects) for validation while `main` runs the full build → push → deploy
chain.
Splitting build from push lets a PR workflow run `image-build` without push or
deploy side effects while `main` runs the full build → push → deploy chain. A
PR build that pulls a private base image still needs a registry token limited to
the `read:package` capability; public-base builds need no token.
## Usage
@@ -14,12 +15,14 @@ chain.
- uses: https://code.fritzlab.net/action/image-build@v1
with:
image: code.fritzlab.net/fritzlab/chrony
token: ${{ secrets.PACKAGE_READ_TOKEN }} # read:package; omit for public bases
smoke-test: docker run --rm --entrypoint /usr/sbin/chronyd $IMAGE -v
```
The image is built and tagged as `<image>:<github.run_number>` in the runner's
local Docker daemon. Subsequent steps (e.g. `action/image-push`) can reference
the same tag.
the same tag. `PACKAGE_READ_TOKEN` is an example caller-chosen secret name; the
contract is the token's `read:package` capability.
## Inputs
@@ -31,6 +34,7 @@ the same tag.
| `build-args` | no | — | Multiline `KEY=VALUE` build args. Visible in `docker history` — never put secrets here. |
| `secrets` | no | — | Multiline `id=VALUE` BuildKit secrets (`--secret`). For tokens the build needs (e.g. a ci-bot token to `go mod download` a private module) that must not leak into layers. Reference with `RUN --mount=type=secret,id=<id>`. |
| `smoke-test` | no | — | Shell command run after build. `$IMAGE` is set to `<image>:<run_number>`. Non-zero exit fails the action. |
| `token` | no | — | Registry token with `read:package` capability. Required to pull a private base image; omit for public bases. |
## Outputs