Skip to content

Commit 73b0efa

Browse files
crazy-maxcrazy-max
authored
Merge pull request #200 from crazy-max/git-auth-token
git auth token support for private repos
2 parents b6cc37d + 29394f2 commit 73b0efa

File tree

6 files changed

+55
-19
lines changed

6 files changed

+55
-19
lines changed

Diff for: ‎README.md

+35-14
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,26 @@ to the default Git context:
117117
push: true
118118
```
119119

120+
Building from the current repository automatically uses the `GITHUB_TOKEN`
121+
secret that GitHub [automatically creates for workflows](https://docs.github.com/en/actions/security-guides/automatic-token-authentication),
122+
so you don't need to pass that manually. If you want to authenticate against
123+
another private repository for remote definitions, you can set the
124+
[`BUILDX_BAKE_GIT_AUTH_TOKEN` environment variable](https://docs.docker.com/build/building/variables/#buildx_bake_git_auth_token).
125+
126+
> [!NOTE]
127+
> Supported since Buildx 0.14.0
128+
129+
```yaml
130+
-
131+
name: Build and push
132+
uses: docker/bake-action@v4
133+
with:
134+
source: "${{ github.server_url }}/${{ github.repository }}.git#${{ github.ref }}"
135+
push: true
136+
env:
137+
BUILDX_BAKE_GIT_AUTH_TOKEN: ${{ secrets.MYTOKEN }}
138+
```
139+
120140
## Customizing
121141

122142
### inputs
@@ -138,20 +158,21 @@ The following inputs can be used as `step.with` keys
138158
> targets: default,release
139159
> ```
140160

141-
| Name | Type | Description |
142-
|--------------|-------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|
143-
| `builder` | String | Builder instance (see [setup-buildx](https://github.com/docker/setup-buildx-action) action) |
144-
| `source` | String | Context to build from. Can be either local (`.`) or a [remote bake definition](https://docs.docker.com/build/customize/bake/file-definition/#remote-definition) |
145-
| `files` | List/CSV | List of [bake definition files](https://docs.docker.com/build/customize/bake/file-definition/) |
146-
| `workdir` | String | Working directory of execution |
147-
| `targets` | List/CSV | List of bake targets (`default` target used if empty) |
148-
| `no-cache` | Bool | Do not use cache when building the image (default `false`) |
149-
| `pull` | Bool | Always attempt to pull a newer version of the image (default `false`) |
150-
| `load` | Bool | Load is a shorthand for `--set=*.output=type=docker` (default `false`) |
151-
| `provenance` | Bool/String | [Provenance](https://docs.docker.com/build/attestations/slsa-provenance/) is a shorthand for `--set=*.attest=type=provenance` |
152-
| `push` | Bool | Push is a shorthand for `--set=*.output=type=registry` (default `false`) |
153-
| `sbom` | Bool/String | [SBOM](https://docs.docker.com/build/attestations/sbom/) is a shorthand for `--set=*.attest=type=sbom` |
154-
| `set` | List | List of [targets values to override](https://docs.docker.com/engine/reference/commandline/buildx_bake/#set) (eg: `targetpattern.key=value`) |
161+
| Name | Type | Description |
162+
|----------------|-------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------|
163+
| `builder` | String | Builder instance (see [setup-buildx](https://github.com/docker/setup-buildx-action) action) |
164+
| `source` | String | Context to build from. Can be either local (`.`) or a [remote bake definition](https://docs.docker.com/build/customize/bake/file-definition/#remote-definition) |
165+
| `files` | List/CSV | List of [bake definition files](https://docs.docker.com/build/customize/bake/file-definition/) |
166+
| `workdir` | String | Working directory of execution |
167+
| `targets` | List/CSV | List of bake targets (`default` target used if empty) |
168+
| `no-cache` | Bool | Do not use cache when building the image (default `false`) |
169+
| `pull` | Bool | Always attempt to pull a newer version of the image (default `false`) |
170+
| `load` | Bool | Load is a shorthand for `--set=*.output=type=docker` (default `false`) |
171+
| `provenance` | Bool/String | [Provenance](https://docs.docker.com/build/attestations/slsa-provenance/) is a shorthand for `--set=*.attest=type=provenance` |
172+
| `push` | Bool | Push is a shorthand for `--set=*.output=type=registry` (default `false`) |
173+
| `sbom` | Bool/String | [SBOM](https://docs.docker.com/build/attestations/sbom/) is a shorthand for `--set=*.attest=type=sbom` |
174+
| `set` | List | List of [targets values to override](https://docs.docker.com/engine/reference/commandline/buildx_bake/#set) (eg: `targetpattern.key=value`) |
175+
| `github-token` | String | API token used to authenticate to a Git repository for [remote definitions](https://docs.docker.com/build/bake/remote-definition/) (default `${{ github.token }}`) |
155176

156177
### outputs
157178

Diff for: ‎action.yml

+4
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,10 @@ inputs:
4848
set:
4949
description: "List of targets values to override (eg. targetpattern.key=value)"
5050
required: false
51+
github-token:
52+
description: "API token used to authenticate to a Git repository for remote definitions"
53+
default: ${{ github.token }}
54+
required: false
5155

5256
outputs:
5357
metadata:

Diff for: ‎dist/index.js

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: ‎dist/index.js.map

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: ‎src/context.ts

+3-1
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ export interface Inputs {
2121
sbom: string;
2222
set: string[];
2323
source: string;
24+
githubToken: string;
2425
}
2526

2627
export async function getInputs(): Promise<Inputs> {
@@ -36,7 +37,8 @@ export async function getInputs(): Promise<Inputs> {
3637
push: core.getBooleanInput('push'),
3738
sbom: core.getInput('sbom'),
3839
set: Util.getInputList('set', {ignoreComma: true, quote: false}),
39-
source: getSourceInput('source')
40+
source: getSourceInput('source'),
41+
githubToken: core.getInput('github-token')
4042
};
4143
}
4244

Diff for: ‎src/main.ts

+11-2
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ actionsToolkit.run(
1919
async () => {
2020
const inputs: context.Inputs = await context.getInputs();
2121
const toolkit = new Toolkit();
22+
const gitAuthToken = process.env.BUILDX_BAKE_GIT_AUTH_TOKEN ?? inputs.githubToken;
2223

2324
await core.group(`GitHub Actions runtime token ACs`, async () => {
2425
try {
@@ -85,7 +86,8 @@ actionsToolkit.run(
8586
push: inputs.push,
8687
sbom: inputs.sbom,
8788
source: inputs.source,
88-
targets: inputs.targets
89+
targets: inputs.targets,
90+
githubToken: gitAuthToken
8991
},
9092
{
9193
cwd: inputs.workdir
@@ -98,15 +100,22 @@ actionsToolkit.run(
98100

99101
const args: string[] = await context.getArgs(inputs, definition, toolkit);
100102
const buildCmd = await toolkit.buildx.getCommand(args);
103+
const buildEnv = Object.assign({}, process.env, {
104+
BUILDX_BAKE_GIT_AUTH_TOKEN: gitAuthToken
105+
}) as {
106+
[key: string]: string;
107+
};
101108

102109
await core.group(`Bake definition`, async () => {
103110
await Exec.exec(buildCmd.command, [...buildCmd.args, '--print'], {
104-
cwd: inputs.workdir
111+
cwd: inputs.workdir,
112+
env: buildEnv
105113
});
106114
});
107115

108116
await Exec.getExecOutput(buildCmd.command, buildCmd.args, {
109117
cwd: inputs.workdir,
118+
env: buildEnv,
110119
ignoreReturnCode: true
111120
}).then(res => {
112121
if (res.stderr.length > 0 && res.exitCode != 0) {

0 commit comments

Comments
 (0)