Lets a build fetch a private fritzlab Go module (or any tokened resource)
without leaking the token into image layers/history the way a build-arg
would. Backward-compatible: empty default, no change for existing callers.
First consumer: fritzlab/agenthub (hub/bridge depends on the private
fritzlab/imessage module).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Org is 'limited' so buildx 401s pulling a private FROM base. Add an optional ci-bot token input; when set, docker/login-action authenticates before build (mirrors image-push). Public-base builds (base = FROM debian) omit it. Removes the need for a separate per-workflow login step.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Lets a caller point at a non-default Dockerfile while keeping the
build context broader. Needed for repos with multiple binaries sharing
internal packages (api/Dockerfile + worker/Dockerfile, build context
at repo root). Empty default preserves prior behavior.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Evelyn Chen