mirror of
https://github.com/docker/build-push-action.git
synced 2024-11-15 06:35:39 +01:00
102 lines
2.7 KiB
Markdown
102 lines
2.7 KiB
Markdown
# Secrets
|
|
|
|
In the following example we will expose and use the [GITHUB_TOKEN secret](https://docs.github.com/en/actions/reference/authentication-in-a-workflow#about-the-github_token-secret)
|
|
as provided by GitHub in your workflow.
|
|
|
|
First let's create our `Dockerfile` to use our secret:
|
|
|
|
```Dockerfile
|
|
#syntax=docker/dockerfile:1.2
|
|
|
|
FROM alpine
|
|
RUN --mount=type=secret,id=github_token \
|
|
cat /run/secrets/github_token
|
|
```
|
|
|
|
If you need access to the `secrets` file from a non-root user, you'll need to set the `uid` in the `--mount` argument:
|
|
|
|
```Dockerfile
|
|
#syntax=docker/dockerfile:1.2
|
|
|
|
FROM alpine
|
|
|
|
# Create non-root user
|
|
RUN addgroup -S newuser && adduser -u 1001 -S -g newuser newuser
|
|
|
|
# Run everything after as non-privileged user.
|
|
USER newuser
|
|
|
|
RUN --mount=type=secret,uid=1001,id=github_token \
|
|
cat /run/secrets/github_token
|
|
```
|
|
|
|
As you can see we have named our secret `github_token`. Here is the workflow you can use to expose this secret using
|
|
the [`secrets` input](../../README.md#inputs):
|
|
|
|
```yaml
|
|
name: ci
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- 'main'
|
|
|
|
jobs:
|
|
docker:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@v2
|
|
-
|
|
name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v1
|
|
-
|
|
name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v1
|
|
-
|
|
name: Build
|
|
uses: docker/build-push-action@v2
|
|
with:
|
|
context: .
|
|
platforms: linux/amd64,linux/arm64
|
|
tags: user/app:latest
|
|
secrets: |
|
|
"github_token=${{ secrets.GITHUB_TOKEN }}"
|
|
```
|
|
|
|
> :bulb: You can also expose a secret file to the build with [`secret-files`](../../README.md#inputs) input:
|
|
> ```yaml
|
|
> secret-files: |
|
|
> "MY_SECRET=./secret.txt"
|
|
> ```
|
|
|
|
If you're using [GitHub secrets](https://docs.github.com/en/actions/reference/encrypted-secrets) and need to handle
|
|
multi-line value, you will need to place the key-value pair between quotes:
|
|
|
|
```yaml
|
|
secrets: |
|
|
"MYSECRET=${{ secrets.GPG_KEY }}"
|
|
GIT_AUTH_TOKEN=abcdefghi,jklmno=0123456789
|
|
"MYSECRET=aaaaaaaa
|
|
bbbbbbb
|
|
ccccccccc"
|
|
FOO=bar
|
|
"EMPTYLINE=aaaa
|
|
|
|
bbbb
|
|
ccc"
|
|
"JSON_SECRET={""key1"":""value1"",""key2"":""value2""}"
|
|
```
|
|
|
|
| Key | Value |
|
|
|--------------------|--------------------------------------------------|
|
|
| `MYSECRET` | `***********************` |
|
|
| `GIT_AUTH_TOKEN` | `abcdefghi,jklmno=0123456789` |
|
|
| `MYSECRET` | `aaaaaaaa\nbbbbbbb\nccccccccc` |
|
|
| `FOO` | `bar` |
|
|
| `EMPTYLINE` | `aaaa\n\nbbbb\nccc` |
|
|
| `JSON_SECRET` | `{"key1":"value1","key2":"value2"}` |
|
|
|
|
> :bulb: All quote signs need to be doubled for escaping.
|