From ffb1af35535b53bb1d215b2ff637c1596077fb9b Mon Sep 17 00:00:00 2001 From: Donavan Fritz Date: Wed, 8 Jul 2026 19:32:41 -0500 Subject: [PATCH] feat: add `secrets` input for BuildKit --secret mounts Lets a build fetch a private fritzlab Go module (or any tokened resource) without leaking the token into image layers/history the way a build-arg would. Backward-compatible: empty default, no change for existing callers. First consumer: fritzlab/agenthub (hub/bridge depends on the private fritzlab/imessage module). Co-Authored-By: Claude Opus 4.8 (1M context) --- README.md | 3 ++- action.yaml | 10 ++++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 4516edd..153154a 100644 --- a/README.md +++ b/README.md @@ -28,7 +28,8 @@ the same tag. | `image` | yes | — | Full image name without tag (e.g. `code.fritzlab.net/fritzlab/chrony`). | | `context` | no | `.` | Docker build context. | | `dockerfile` | no | `Dockerfile` (in context) | Path to the Dockerfile, relative to the context (or absolute under `$GITHUB_WORKSPACE`). Use for monorepos where the build context is the repo root but the Dockerfile lives in a subdir, e.g. `dockerfile: api/Dockerfile`. | -| `build-args` | no | — | Multiline `KEY=VALUE` build args. | +| `build-args` | no | — | Multiline `KEY=VALUE` build args. Visible in `docker history` — never put secrets here. | +| `secrets` | no | — | Multiline `id=VALUE` BuildKit secrets (`--secret`). For tokens the build needs (e.g. a ci-bot token to `go mod download` a private module) that must not leak into layers. Reference with `RUN --mount=type=secret,id=`. | | `smoke-test` | no | — | Shell command run after build. `$IMAGE` is set to `:`. Non-zero exit fails the action. | ## Outputs diff --git a/action.yaml b/action.yaml index 418fc46..5d865dc 100644 --- a/action.yaml +++ b/action.yaml @@ -19,6 +19,15 @@ inputs: build-args: description: Multiline KEY=VALUE pairs passed to docker build required: false + secrets: + description: | + Multiline `id=VALUE` pairs mounted into the build as BuildKit secrets + (--secret). Use for tokens the BUILD itself needs — e.g. a ci-bot token + to `go mod download` a PRIVATE fritzlab module — that must NOT leak into + image layers or `docker history` the way build-args would. Reference in + the Dockerfile with `RUN --mount=type=secret,id= ...`. + required: false + default: '' smoke-test: description: | Shell command run after build. The image is exposed as $IMAGE @@ -61,6 +70,7 @@ runs: provenance: false network: host build-args: ${{ inputs.build-args }} + secrets: ${{ inputs.secrets }} tags: ${{ inputs.image }}:${{ github.run_number }} - name: Smoke test