Files

T

Donavan Fritz ffb1af3553 feat: add secrets input for BuildKit --secret mounts

Lets a build fetch a private fritzlab Go module (or any tokened resource)
without leaking the token into image layers/history the way a build-arg
would. Backward-compatible: empty default, no change for existing callers.
First consumer: fritzlab/agenthub (hub/bridge depends on the private
fritzlab/imessage module).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-08 19:32:41 -05:00

2.2 KiB

Raw Blame History

action/image-build

Composite Gitea Action that builds a container image with buildx and optionally runs a smoke test. Does not push — pair with action/image-push to publish.

Splitting build from push lets a PR workflow run image-build (no secrets, no side effects) for validation while main runs the full build → push → deploy chain.

Usage

- uses: actions/checkout@v4
- uses: https://code.fritzlab.net/action/image-build@v1
  with:
    image: code.fritzlab.net/fritzlab/chrony
    smoke-test: docker run --rm --entrypoint /usr/sbin/chronyd $IMAGE -v

The image is built and tagged as <image>:<github.run_number> in the runner's local Docker daemon. Subsequent steps (e.g. action/image-push) can reference the same tag.

Inputs

Name	Required	Default	Description
`image`	yes	—	Full image name without tag (e.g. `code.fritzlab.net/fritzlab/chrony`).
`context`	no	`.`	Docker build context.
`dockerfile`	no	`Dockerfile` (in context)	Path to the Dockerfile, relative to the context (or absolute under `$GITHUB_WORKSPACE`). Use for monorepos where the build context is the repo root but the Dockerfile lives in a subdir, e.g. `dockerfile: api/Dockerfile`.
`build-args`	no	—	Multiline `KEY=VALUE` build args. Visible in `docker history` — never put secrets here.
`secrets`	no	—	Multiline `id=VALUE` BuildKit secrets (`--secret`). For tokens the build needs (e.g. a ci-bot token to `go mod download` a private module) that must not leak into layers. Reference with `RUN --mount=type=secret,id=<id>`.
`smoke-test`	no	—	Shell command run after build. `$IMAGE` is set to `<image>:<run_number>`. Non-zero exit fails the action.

Outputs

Name	Description
`tag`	Numeric tag assigned (= `github.run_number`).

Smoke test patterns

Override entrypoint for a binary that expects no args:

smoke-test: docker run --rm --entrypoint /usr/sbin/chronyd $IMAGE -v

Run a help command that returns non-zero:

smoke-test: docker run --rm $IMAGE --help || true

Multiple checks chained:

smoke-test: |
  docker run --rm $IMAGE --version
  docker run --rm --entrypoint /bin/sh $IMAGE -c 'test -x /usr/local/bin/myapp'