Skip to content

Commit db03eac

Browse files
neilimeneilime
committed
feat(docker/build-image): support secret-envs
Signed-off-by: Emilien Escalle <[email protected]>
1 parent 5dc22de commit db03eac

File tree

5 files changed

+42
-9
lines changed

5 files changed

+42
-9
lines changed

‎.github/workflows/__test-workflow-docker-build-images.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,10 @@ jobs:
6464
"BUILD_RUN_ID": "${{ github.run_id }}",
6565
"BUILD_REPOSITORY_OWNER": "${{ github.repository_owner }}",
6666
"BUILD_REPOSITORY": "${{ github.repository }}"
67+
},
68+
"secret-envs": {
69+
"SECRET_ENV_REPOSITORY_OWNER": "GITHUB_REPOSITORY_OWNER",
70+
"SECRET_ENV_REPOSITORY": "GITHUB_REPOSITORY"
6771
}
6872
}
6973
]

‎.github/workflows/docker-build-images.md‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,9 @@ jobs:
7575
# "APP_PATH": "./application/",
7676
# "PROD_MODE": "true"
7777
# },
78+
# "secret-envs": {
79+
# "GH_TOKEN": "GITHUB_TOKEN"
80+
# },
7881
# "platforms": [
7982
# "linux/amd64",
8083
# {
@@ -114,15 +117,16 @@ jobs:
114117

115118
### Images entry parameters
116119

117-
| **Parameter** | **Description** | **Default** | **Required** |
118-
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | ------------ |
119-
| **<code>name</code>** | Image name. Must be unique. It is used as `image` in [Docker build-image action](../../actions/docker/build-image/README.md) | | **true** |
120-
| **<code>repository</code>** | Repository name. See [Docker build-image action](../../actions/docker/build-image/README.md) | | **false** |
121-
| **<code>context</code>** | Build context. See [Docker build-image action](../../actions/docker/build-image/README.md) | <code>.</code> | **false** |
122-
| **<code>dockerfile</code>** | Location of Dockerfile. See [Docker build-image action](../../actions/docker/build-image/README.md) | <code>Dockerfile</code> | **false** |
123-
| **<code>target</code>** | Sets the target stage to build. See [Docker build-image action](../../actions/docker/build-image/README.md) | | **true** |
124-
| **<code>build-args</code>** | List of build-time variables. See [Docker build-image action](../../actions/docker/build-image/README.md) | | **false** |
125-
| **<code>platforms</code>** | List of platforms to build for. It is used as `platform` in [Docker build-image action](../../actions/docker/build-image/README.md). Can be a string (Example: `linux/amd64`) or an object (Example: `{"name": "darwin/amd64","runs-on": "macos-latest"}`) | | **true** |
120+
| **Parameter** | **Description** | **Default** | **Required** |
121+
| ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------- | ------------ |
122+
| **<code>name</code>** | Image name. Must be unique. It is used as `image` in [Docker build-image action](../../actions/docker/build-image/README.md) | | **true** |
123+
| **<code>repository</code>** | Repository name. See [Docker build-image action](../../actions/docker/build-image/README.md) | | **false** |
124+
| **<code>context</code>** | Build context. See [Docker build-image action](../../actions/docker/build-image/README.md) | <code>.</code> | **false** |
125+
| **<code>dockerfile</code>** | Location of Dockerfile. See [Docker build-image action](../../actions/docker/build-image/README.md) | <code>Dockerfile</code> | **false** |
126+
| **<code>target</code>** | Sets the target stage to build. See [Docker build-image action](../../actions/docker/build-image/README.md) | | **true** |
127+
| **<code>build-args</code>** | List of build-time variables. See [Docker build-image action](../../actions/docker/build-image/README.md) | | **false** |
128+
| **<code>secret-envs</code>** | List of secret environment variables to expose to the build. See [Docker build-image action](../../actions/docker/build-image/README.md) | | **false** |
129+
| **<code>platforms</code>** | List of platforms to build for. It is used as `platform` in [Docker build-image action](../../actions/docker/build-image/README.md). Can be a string (Example: `linux/amd64`) or an object (Example: `{"name": "darwin/amd64","runs-on": "macos-latest"}`) | | **true** |
126130

127131
#### Platforms entry parameters
128132

‎.github/workflows/docker-build-images.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,9 @@ on: # yamllint disable-line rule:truthy
6565
"APP_PATH": "./application/",
6666
"PROD_MODE": "true"
6767
},
68+
"secret-envs": {
69+
"GH_TOKEN": "GITHUB_TOKEN"
70+
},
6871
"platforms": [
6972
"linux/amd64",
7073
{
@@ -174,6 +177,14 @@ jobs:
174177
image['build-args'] = buildArgs;
175178
}
176179
180+
// Format secret-envs object to string
181+
if (image['secret-envs']) {
182+
const secretEnvs = Object.keys(image['secret-envs'])
183+
.map(key => `${key}=${image['secret-envs'][key]}`)
184+
.join('\n');
185+
image['secret-envs'] = secretEnvs;
186+
}
187+
177188
// Set default repository
178189
if (!image['repository']) {
179190
image['repository'] = `${{ github.repository }}`;
@@ -325,6 +336,7 @@ jobs:
325336
build-args: ${{ matrix.image.build-args }}
326337
target: ${{ matrix.image.target }}
327338
platform: ${{ matrix.image.platform }}
339+
secret-envs: ${{ matrix.image.secret-envs }}
328340
secrets: ${{ secrets.build-secrets }}
329341

330342
# FIXME: Set built images infos in file to be uploaded as artifacts, because github action does not handle job outputs for matrix

‎actions/docker/build-image/action.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,11 @@ inputs:
9898
List of secrets to expose to the build.
9999
See <https://docs.docker.com/build/ci/github-actions/secrets/>.
100100
required: false
101+
secret-envs:
102+
description: |
103+
List of secret environment variables to expose to the build (e.g., key=envname, MY_SECRET=MY_ENV_VAR).
104+
See <https://docs.docker.com/build/ci/github-actions/secrets/>.
105+
required: false
101106

102107
runs:
103108
using: "composite"
@@ -218,6 +223,7 @@ runs:
218223
target: ${{ inputs.target }}
219224
file: ${{ github.workspace }}/${{ inputs.context }}/${{ inputs.dockerfile }}
220225
secrets: ${{ inputs.secrets }}
226+
secret-envs: ${{ inputs.secret-envs }}
221227
platforms: ${{ inputs.platform }}
222228
cache-from: ${{ steps.cache.outputs.cache-from }}
223229
cache-to: ${{ steps.cache.outputs.cache-to }}

‎tests/application/Dockerfile‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,4 +33,11 @@ RUN --mount=type=secret,id=SECRET_REPOSITORY_OWNER test "$(cat /run/secrets/SECR
3333
RUN --mount=type=secret,id=SECRET_REPOSITORY test -f /run/secrets/SECRET_REPOSITORY || (echo "Error: SECRET_REPOSITORY is not set" && exit 1);
3434
RUN --mount=type=secret,id=SECRET_REPOSITORY test "$(cat /run/secrets/SECRET_REPOSITORY)" = "$EXPECTED_REPOSITORY" || (echo "Error: SECRET_REPOSITORY is not \"$EXPECTED_REPOSITORY\"" && exit 1);
3535

36+
# Test that secret envs are passed
37+
RUN --mount=type=secret,id=SECRET_ENV_REPOSITORY_OWNER test -f /run/secrets/SECRET_ENV_REPOSITORY_OWNER || (echo "Error: SECRET_ENV_REPOSITORY_OWNER is not set" && exit 1);
38+
RUN --mount=type=secret,id=SECRET_ENV_REPOSITORY_OWNER test "$(cat /run/secrets/SECRET_ENV_REPOSITORY_OWNER)" = "$EXPECTED_REPOSITORY_OWNER" || (echo "Error: SECRET_ENV_REPOSITORY_OWNER is not \"$EXPECTED_REPOSITORY_OWNER\"" && exit 1);
39+
40+
RUN --mount=type=secret,id=SECRET_ENV_REPOSITORY test -f /run/secrets/SECRET_ENV_REPOSITORY || (echo "Error: SECRET_ENV_REPOSITORY is not set" && exit 1);
41+
RUN --mount=type=secret,id=SECRET_ENV_REPOSITORY test "$(cat /run/secrets/SECRET_ENV_REPOSITORY)" = "$EXPECTED_REPOSITORY" || (echo "Error: SECRET_ENV_REPOSITORY is not \"$EXPECTED_REPOSITORY\"" && exit 1);
42+
3643
USER test

0 commit comments

Comments
 (0)