action/image-build
8
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add secrets input for BuildKit --secret mounts

Browse Source 
Lets a build fetch a private fritzlab Go module (or any tokened resource)
without leaking the token into image layers/history the way a build-arg
would. Backward-compatible: empty default, no change for existing callers.
First consumer: fritzlab/agenthub (hub/bridge depends on the private
fritzlab/imessage module).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Donavan Fritz
2026-07-08 19:32:41 -05:00
parent b371af7f37
commit ffb1af3553
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+2 -1
View File
@@ -28,7 +28,8 @@ the same tag.
| `image` | yes | — | Full image name without tag (e.g. `code.fritzlab.net/fritzlab/chrony`). |
| `context` | no | `.` | Docker build context. |
| `dockerfile` | no | `Dockerfile` (in context) | Path to the Dockerfile, relative to the context (or absolute under `$GITHUB_WORKSPACE`). Use for monorepos where the build context is the repo root but the Dockerfile lives in a subdir, e.g. `dockerfile: api/Dockerfile`. |
| `build-args` | no | — | Multiline `KEY=VALUE` build args. |
| `build-args` | no | — | Multiline `KEY=VALUE` build args. Visible in `docker history` — never put secrets here. |
| `secrets` | no | — | Multiline `id=VALUE` BuildKit secrets (`--secret`). For tokens the build needs (e.g. a ci-bot token to `go mod download` a private module) that must not leak into layers. Reference with `RUN --mount=type=secret,id=<id>`. |
| `smoke-test` | no | — | Shell command run after build. `$IMAGE` is set to `<image>:<run_number>`. Non-zero exit fails the action. |
## Outputs