Merge pull request #36 from seek-oss/secrets

Author: 72636c

README.md

@@ -184,6 +184,39 @@ steps:
       - docker#v3.3.0
 ```
 
+### Specifying secrets
+
+[Build-time variables] can be extracted from a pulled image, so when passing
+sensitive data, [secrets] should be used instead.
+
+[secrets]: https://docs.docker.com/develop/develop-images/build_enhancements/#new-docker-build-secret-information
+
+To use environment variables (perhaps fetched by another plugin) as secrets:
+
+```dockerfile
+# syntax=docker/dockerfile:1.2
+
+FROM bash
+
+RUN --mount=type=secret,id=SECRET cat /run/secrets/SECRET
+```
+
+```yaml
+steps:
+  - command: echo amaze
+    env:
+      SECRET: wow
+    plugins:
+      - seek-oss/docker-ecr-cache#v1.9.0:
+          secrets:
+            - SECRET
+      - docker#v3.3.0
+```
+
+You must have a recent version of Docker with BuildKit enabled to use secrets.
+BuildKit will be enabled automatically if any secrets are present in the
+configuration.
+
 ### Changing the max cache time
 
 By default images are kept in ECR for up to 30 days. This can be changed by specifying a `max-age-days` parameter:

hooks/lib/stdlib.bash

@@ -20,6 +20,14 @@ read_build_args() {
   done
 }
 
+read_secrets() {
+  read_list_property 'SECRETS'
+  for arg in ${result[@]+"${result[@]}"}; do
+    secrets_args+=("--secret")
+    secrets_args+=("id=${arg},env=${arg}")
+  done
+}
+
 # read a plugin property of type [array, string] into a Bash array. Buildkite
 # exposes a string value at BUILDKITE_PLUGIN_{NAME}_{KEY}, and array values at
 # BUILDKITE_PLUGIN_{NAME}_{KEY}_{IDX}.

hooks/pre-command

@@ -33,6 +33,9 @@ context="${BUILDKITE_PLUGIN_DOCKER_ECR_CACHE_CONTEXT:-"${context_dir}"}"
 build_args=()
 read_build_args
 
+secrets_args=()
+read_secrets
+
 echo "--- Pulling image"
 if ! docker pull "${image}:${tag}"; then
   echo '--- Building image'
@@ -53,6 +56,14 @@ if ! docker pull "${image}:${tag}"; then
       )
     done
   fi
+  if [[ "${#secrets_args[@]}" -gt 0 ]]; then
+    export DOCKER_BUILDKIT=1
+    for sa in "${secrets_args[@]}"; do
+      image_build_args+=(
+        "${sa}"
+      )
+    done
+  fi
 
   echo "Inside $(pwd), running \`docker ${image_build_args[*]} ${context}\`"
   # We can't quote BUILDKITE_PLUGIN_DOCKER_ECR_CACHE_ADDITIONAL_BUILD_ARGS, because it's passed here as a string instead of a bash array.