From ba4adebd8df61123ff290ea64b4d2853cf83d714 Mon Sep 17 00:00:00 2001 From: Mathias Date: Tue, 25 Aug 2026 11:27:06 +0200 Subject: [PATCH] =?UTF-8?q?ci:=20re-sync=20build-image.sh=20=E2=80=94=20ad?= =?UTF-8?q?ds=20TARGET=20and=20BUILD=5FSECRETS=20(infra#309)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Canonical gained two inputs so the repos still to migrate can adopt without forking the script again: TARGET for multi-stage builds (cad, agentsquad) and BUILD_SECRETS for buildkit secret mounts (agentsquad). BUILD_SECRETS takes the SPEC only (`id=NAME,src=PATH`) -- the caller writes the secret to PATH itself, so no secret value ever reaches this script's argv or the CI log. Unused here; this repo's copy just stays byte-identical, which is the whole point. Written by `task ci:sync`, not by hand. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_011PL5XcG68SvQqz3vGVbWbf --- .gitea/build-image.sh | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.gitea/build-image.sh b/.gitea/build-image.sh index 61a5d7a..d912c00 100644 --- a/.gitea/build-image.sh +++ b/.gitea/build-image.sh @@ -32,7 +32,13 @@ # CONTEXT default . -- build context directory # DOCKERFILE_DIR default $CONTEXT -- directory holding the Dockerfile # DOCKERFILE_NAME optional, when the file is not named `Dockerfile` +# TARGET optional, multi-stage build target (--opt target=) # BUILD_ARGS optional, space-separated K=V pairs +# BUILD_SECRETS optional, space-separated buildkit secret specs, each +# `id=NAME,src=PATH`. Pass the SPEC only -- the caller +# writes the secret to PATH itself. A secret VALUE must +# never be passed here: it would land in this script's +# argv and therefore in the CI log. # EXTRA_LABELS optional, space-separated K=V pairs # GIT_SHA optional, stamped as org.opencontainers.image.revision # IMAGE_SOURCE optional, stamped as org.opencontainers.image.source @@ -73,6 +79,13 @@ args=( if [ -n "${DOCKERFILE_NAME:-}" ]; then args+=(--opt "filename=${DOCKERFILE_NAME}") fi +if [ -n "${TARGET:-}" ]; then + args+=(--opt "target=${TARGET}") +fi +for spec in ${BUILD_SECRETS:-}; do + # Opaque id=NAME,src=PATH -- buildkit reads the file, nothing is echoed. + args+=(--secret "${spec}") +done if [ -n "${GIT_SHA:-}" ]; then args+=(--opt "label:org.opencontainers.image.revision=${GIT_SHA}") fi