test: TEMPORARY BUILD_SECRETS test (not to be merged)

Author: sleidig

.github/workflows/docker-image.yml

@@ -121,6 +121,12 @@ on:
       DOCKERHUB_TOKEN:
         required: false
         description: Docker Hub access token (or password) for DOCKERHUB_USERNAME
+      BUILD_SECRETS:
+        required: false
+        description: >-
+          Secrets for the build as BuildKit secrets (`id=value`, one per line; the format of build-push-action's
+          `secrets` input), e.g. `sentry_auth_token=<token>`. Read in the Dockerfile with
+          `RUN --mount=type=secret,id=sentry_auth_token ...`. Masked in the logs; unset or empty passes no secret.
     outputs:
       digest:
         description: Digest of the built image (the multi-platform index if more than one platform was built)
@@ -141,6 +147,18 @@ jobs:
       digest: ${{ steps.build.outputs.digest }}
       tags: ${{ steps.meta.outputs.tags }}
     steps:
+      - &mask-build-secrets
+        name: Mask build secrets
+        env:
+          BUILD_SECRETS: ${{ secrets.BUILD_SECRETS }}
+        run: |
+          # Every value is masked in the logs, also if the caller composed BUILD_SECRETS (`format(...)`) from
+          # a secret and GitHub does not know the composed value as a secret. Nothing is printed.
+          while IFS= read -r line; do
+            value="${line#*=}"
+            [ -z "$value" ] || echo "::add-mask::$value"
+          done <<< "$BUILD_SECRETS"
+
       - &checkout
         name: Checkout repository
         uses: actions/checkout@v7
@@ -346,6 +364,7 @@ jobs:
           push: ${{ inputs.push }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          secrets: ${{ secrets.BUILD_SECRETS }}
           cache-from: type=gha,scope=${{ steps.config.outputs.cache-scope }}
           cache-to: type=gha,mode=min,scope=${{ steps.config.outputs.cache-scope }},ignore-error=true
 
@@ -549,6 +568,7 @@ jobs:
       contents: read
       packages: write # push to ghcr.io
     steps:
+      - *mask-build-secrets
       - *checkout
       - *download-artifact
       - *prepare
@@ -567,6 +587,7 @@ jobs:
           platforms: ${{ matrix.platform }}
           build-args: ${{ inputs.build-args }}
           labels: ${{ steps.meta.outputs.labels }}
+          secrets: ${{ secrets.BUILD_SECRETS }}
           outputs: ${{ inputs.push && format('type=image,"name={0}",push-by-digest=true,name-canonical=true,push=true', steps.config.outputs.image-names) || 'type=cacheonly' }}
           cache-from: type=gha,scope=${{ steps.config.outputs.cache-scope }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }}
           cache-to: type=gha,mode=min,scope=${{ steps.config.outputs.cache-scope }}-${{ matrix.platform == 'linux/arm64' && 'arm64' || 'amd64' }},ignore-error=true

.github/workflows/test-secrets.yml

@@ -0,0 +1,63 @@
+# TEMPORARY: BUILD_SECRETS test of docker-image.yml. Not to be merged.
+name: TEMP test secrets
+on:
+  push:
+    branches: [test/ci-secrets]
+permissions: {}
+jobs:
+  default-with:
+    uses: ./.github/workflows/docker-image.yml
+    permissions:
+      contents: read
+      packages: write
+    secrets:
+      BUILD_SECRETS: |
+        probe=s3cr3tvalue123
+        probe2=other-value-456
+    with:
+      images: ghcr.io/aam-digital/ci-test
+      context: test/ci-image
+      file: test/ci-image/Dockerfile.secrets
+      platforms: linux/amd64
+      tags: pr-sec-default
+      cache-scope: sec-a
+  default-without:
+    uses: ./.github/workflows/docker-image.yml
+    permissions:
+      contents: read
+      packages: write
+    with:
+      images: ghcr.io/aam-digital/ci-test
+      context: test/ci-image
+      file: test/ci-image/Dockerfile.nosecrets
+      platforms: linux/amd64
+      tags: pr-sec-default-none
+      cache-scope: sec-b
+  native-with:
+    uses: ./.github/workflows/docker-image.yml
+    permissions:
+      contents: read
+      packages: write
+    secrets:
+      BUILD_SECRETS: |
+        probe=s3cr3tvalue123
+        probe2=other-value-456
+    with:
+      images: ghcr.io/aam-digital/ci-test
+      context: test/ci-image
+      file: test/ci-image/Dockerfile.secrets
+      native-runners: true
+      tags: pr-sec-native
+      cache-scope: sec-c
+  native-without:
+    uses: ./.github/workflows/docker-image.yml
+    permissions:
+      contents: read
+      packages: write
+    with:
+      images: ghcr.io/aam-digital/ci-test
+      context: test/ci-image
+      file: test/ci-image/Dockerfile.nosecrets
+      native-runners: true
+      tags: pr-sec-native-none
+      cache-scope: sec-d

test/ci-image/Dockerfile.nosecrets

@@ -0,0 +1,2 @@
+FROM busybox:1.37
+RUN --mount=type=secret,id=probe test ! -e /run/secrets/probe

test/ci-image/Dockerfile.secrets

@@ -0,0 +1,3 @@
+FROM busybox:1.37
+RUN --mount=type=secret,id=probe test "$(sha256sum < /run/secrets/probe | cut -d' ' -f1)" = a8bd414a160af4094e22a273bb6b4e7df2ad1231243d6f0c341dabb2d071b1b1
+RUN --mount=type=secret,id=probe2 test "$(sha256sum < /run/secrets/probe2 | cut -d' ' -f1)" = 6919d417b9b961b0a7d65626fd8f1394e9307ba795830b6bf40de4d2967baad8