feat: add secrets input for BuildKit --secret mounts

Lets a build fetch a private fritzlab Go module (or any tokened resource)
without leaking the token into image layers/history the way a build-arg
would. Backward-compatible: empty default, no change for existing callers.
First consumer: fritzlab/agenthub (hub/bridge depends on the private
fritzlab/imessage module).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -28,7 +28,8 @@ the same tag.
 | `image` | yes | — | Full image name without tag (e.g. `code.fritzlab.net/fritzlab/chrony`). |
 | `context` | no | `.` | Docker build context. |
 | `dockerfile` | no | `Dockerfile` (in context) | Path to the Dockerfile, relative to the context (or absolute under `$GITHUB_WORKSPACE`). Use for monorepos where the build context is the repo root but the Dockerfile lives in a subdir, e.g. `dockerfile: api/Dockerfile`. |
-| `build-args` | no | — | Multiline `KEY=VALUE` build args. |
+| `build-args` | no | — | Multiline `KEY=VALUE` build args. Visible in `docker history` — never put secrets here. |
+| `secrets` | no | — | Multiline `id=VALUE` BuildKit secrets (`--secret`). For tokens the build needs (e.g. a ci-bot token to `go mod download` a private module) that must not leak into layers. Reference with `RUN --mount=type=secret,id=<id>`. |
 | `smoke-test` | no | — | Shell command run after build. `$IMAGE` is set to `<image>:<run_number>`. Non-zero exit fails the action. |
 
 ## Outputs

action.yaml

@@ -19,6 +19,15 @@ inputs:
   build-args:
     description: Multiline KEY=VALUE pairs passed to docker build
     required: false
+  secrets:
+    description: |
+      Multiline `id=VALUE` pairs mounted into the build as BuildKit secrets
+      (--secret). Use for tokens the BUILD itself needs — e.g. a ci-bot token
+      to `go mod download` a PRIVATE fritzlab module — that must NOT leak into
+      image layers or `docker history` the way build-args would. Reference in
+      the Dockerfile with `RUN --mount=type=secret,id=<id> ...`.
+    required: false
+    default: ''
   smoke-test:
     description: |
       Shell command run after build. The image is exposed as $IMAGE
@@ -61,6 +70,7 @@ runs:
         provenance: false
         network: host
         build-args: ${{ inputs.build-args }}
+        secrets: ${{ inputs.secrets }}
         tags: ${{ inputs.image }}:${{ github.run_number }}
 
     - name: Smoke test