From 089db4f719b2ff39347a757e58708114a362b705 Mon Sep 17 00:00:00 2001 From: Tasha Snow Date: Tue, 18 Aug 2026 16:22:10 -0600 Subject: [PATCH 1/3] Appendix mothership setup Add mothership setup in Dockerfile --- appendix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/appendix b/appendix index 2ad4f7d..f652506 100644 --- a/appendix +++ b/appendix @@ -16,3 +16,12 @@ USER ${NB_USER} RUN ${MAMBA_EXE} env create --prefix ${NB_PYTHON_PREFIX} --yes --file "conda-linux-64.lock" \ && ${MAMBA_EXE} list --prefix ${NB_PYTHON_PREFIX} \ && ${MAMBA_EXE} clean --all --force-pkgs-dirs --yes + +# Mothership GCP service account key — workshop-scoped, revoked after. +# See build.yaml: injected via buildx --secret, never lands in a layer as raw input. +RUN --mount=type=secret=gcp_key,required=true \ + mkdir -p ${NB_PYTHON_PREFIX}/etc/gcp && \ + cp /run/secrets/gcp_key ${NB_PYTHON_PREFIX}/etc/gcp/mothership-key.json && \ + chmod 600 ${NB_PYTHON_PREFIX}/etc/gcp/mothership-key.json + +ENV GOOGLE_APPLICATION_CREDENTIALS=${NB_PYTHON_PREFIX}/etc/gcp/mothership-key.json From 734f5a6ae30d056ca0b4e0ed91def95011dd7f4f Mon Sep 17 00:00:00 2001 From: Tasha Snow Date: Tue, 18 Aug 2026 16:26:34 -0600 Subject: [PATCH 2/3] Fix syntax for mothership --- appendix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/appendix b/appendix index f652506..7653edc 100644 --- a/appendix +++ b/appendix @@ -19,7 +19,7 @@ RUN ${MAMBA_EXE} env create --prefix ${NB_PYTHON_PREFIX} --yes --file "conda-lin # Mothership GCP service account key — workshop-scoped, revoked after. # See build.yaml: injected via buildx --secret, never lands in a layer as raw input. -RUN --mount=type=secret=gcp_key,required=true \ +RUN --mount=type=secret,id=gcp_key,required=true \ mkdir -p ${NB_PYTHON_PREFIX}/etc/gcp && \ cp /run/secrets/gcp_key ${NB_PYTHON_PREFIX}/etc/gcp/mothership-key.json && \ chmod 600 ${NB_PYTHON_PREFIX}/etc/gcp/mothership-key.json From 9dd14e2218c0f3137468240ca87068ecb2ea5516 Mon Sep 17 00:00:00 2001 From: Tasha Snow Date: Tue, 18 Aug 2026 16:37:20 -0600 Subject: [PATCH 3/3] Modify GCP key secret handling for builds Avoid failure on PR/test builds by making the secret mount required=false. --- appendix | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/appendix b/appendix index 7653edc..b75b3f1 100644 --- a/appendix +++ b/appendix @@ -18,10 +18,14 @@ RUN ${MAMBA_EXE} env create --prefix ${NB_PYTHON_PREFIX} --yes --file "conda-lin && ${MAMBA_EXE} clean --all --force-pkgs-dirs --yes # Mothership GCP service account key — workshop-scoped, revoked after. -# See build.yaml: injected via buildx --secret, never lands in a layer as raw input. -RUN --mount=type=secret,id=gcp_key,required=true \ - mkdir -p ${NB_PYTHON_PREFIX}/etc/gcp && \ - cp /run/secrets/gcp_key ${NB_PYTHON_PREFIX}/etc/gcp/mothership-key.json && \ - chmod 600 ${NB_PYTHON_PREFIX}/etc/gcp/mothership-key.json +# required=false so PR/test builds (which never receive this secret) don't fail. +RUN --mount=type=secret,id=gcp_key,required=false \ + if [ -s /run/secrets/gcp_key ]; then \ + mkdir -p ${NB_PYTHON_PREFIX}/etc/gcp && \ + cp /run/secrets/gcp_key ${NB_PYTHON_PREFIX}/etc/gcp/mothership-key.json && \ + chmod 600 ${NB_PYTHON_PREFIX}/etc/gcp/mothership-key.json; \ + else \ + echo "No gcp_key secret provided — skipping (expected on PR/test builds)."; \ + fi ENV GOOGLE_APPLICATION_CREDENTIALS=${NB_PYTHON_PREFIX}/etc/gcp/mothership-key.json