mathias/template-go-web
Template
1
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

ci: re-sync build-image.sh — adds TARGET and BUILD_SECRETS (infra#309)
CD / Detect unsubstituted template (push) Successful in 1s
Details
CD / Lint / Test / Vet (push) Skipped
Details
CD / Build & Import (push) Skipped
Details
CD / Deploy via GitOps (push) Skipped
Details

Browse Source 
Canonical gained two inputs so the repos still to migrate can adopt
without forking the script again: TARGET for multi-stage builds (cad,
agentsquad) and BUILD_SECRETS for buildkit secret mounts (agentsquad).

BUILD_SECRETS takes the SPEC only (`id=NAME,src=PATH`) -- the caller
writes the secret to PATH itself, so no secret value ever reaches this
script's argv or the CI log.

Unused here; this repo's copy just stays byte-identical, which is the
whole point. Written by `task ci:sync`, not by hand.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011PL5XcG68SvQqz3vGVbWbf
This commit is contained in:
mathias
2026-08-25 11:27:06 +02:00
co-authored by Claude Opus 5
parent 650644ebe3
commit ba4adebd8d
1 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/build-image.sh
+13
View File
@@ -32,7 +32,13 @@
# CONTEXT default . -- build context directory # CONTEXT default . -- build context directory
# DOCKERFILE_DIR default $CONTEXT -- directory holding the Dockerfile # DOCKERFILE_DIR default $CONTEXT -- directory holding the Dockerfile
# DOCKERFILE_NAME optional, when the file is not named `Dockerfile` # DOCKERFILE_NAME optional, when the file is not named `Dockerfile`
# TARGET optional, multi-stage build target (--opt target=)
# BUILD_ARGS optional, space-separated K=V pairs # BUILD_ARGS optional, space-separated K=V pairs
# BUILD_SECRETS optional, space-separated buildkit secret specs, each
# `id=NAME,src=PATH`. Pass the SPEC only -- the caller
# writes the secret to PATH itself. A secret VALUE must
# never be passed here: it would land in this script's
# argv and therefore in the CI log.
# EXTRA_LABELS optional, space-separated K=V pairs # EXTRA_LABELS optional, space-separated K=V pairs
# GIT_SHA optional, stamped as org.opencontainers.image.revision # GIT_SHA optional, stamped as org.opencontainers.image.revision
# IMAGE_SOURCE optional, stamped as org.opencontainers.image.source # IMAGE_SOURCE optional, stamped as org.opencontainers.image.source
@@ -73,6 +79,13 @@ args=(
if [ -n "${DOCKERFILE_NAME:-}" ]; then if [ -n "${DOCKERFILE_NAME:-}" ]; then
args+=(--opt "filename=${DOCKERFILE_NAME}") args+=(--opt "filename=${DOCKERFILE_NAME}")
fi fi
if [ -n "${TARGET:-}" ]; then
args+=(--opt "target=${TARGET}")
fi
for spec in ${BUILD_SECRETS:-}; do
# Opaque id=NAME,src=PATH -- buildkit reads the file, nothing is echoed.
args+=(--secret "${spec}")
done
if [ -n "${GIT_SHA:-}" ]; then if [ -n "${GIT_SHA:-}" ]; then
args+=(--opt "label:org.opencontainers.image.revision=${GIT_SHA}") args+=(--opt "label:org.opencontainers.image.revision=${GIT_SHA}")
fi fi