feat(builder): skip env-backed secrets whose variable is unset#10
Merged
Conversation
An env-backed `secrets:` entry previously always emitted `--secret id=…,env=…`, so a local build with the variable unset failed inside buildx. Skip an env-backed secret when its backing variable is unset or empty — the same opt-in-by-environment contract the empty cache_from/cache_to entries already use. This lets a config declare a secret sourced from a variable the environment provides only in some contexts (e.g. a CI-minted token): it is emitted in CI but stays inert on local builds that never export it. File-backed secrets are unaffected; a missing file is still a config error buildx surfaces. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
blairham
force-pushed
the
feat/env-gate-build-secrets
branch
from
July 6, 2026 15:17
63b7941 to
2c00af1
Compare
blairham
added a commit
to pinpredict/.github
that referenced
this pull request
Jul 6, 2026
v0.0.7 (blairham/stevedore#10) skips an env-backed build secret whose variable is unset, so the private-modules gh_token secret stays inert on callers that leave it off and local private-module builds work. Bump the pinned action ref in lockstep. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
blairham
added a commit
to pinpredict/.github
that referenced
this pull request
Jul 6, 2026
…builds (#44) * feat(docker-release): add opt-in private-modules token for stevedore builds Port the `private-modules` opt-in from the frozen matrix implementation onto the stevedore docker-release. When `private-modules: true`, mint a short-lived read-only pinpredict-argocd App token and expose it as the GH_PRIVATE_TOKEN env var to the stevedore step. The caller's .stevedore.yaml wires it to a BuildKit secret (`secrets: [{id: gh_token, env: GH_PRIVATE_TOKEN}]`), so a Dockerfile can `go mod download` a private pinpredict module (e.g. ppkit) without vendoring — passed as a --secret, never a --build-arg, so it never lands in an image layer. Default false — inert for every existing caller: no token is minted, the env is empty, and stevedore (>= the env-gated release) skips an env-backed secret whose variable is unset. Bump stevedore-version to that release before any repo turns private-modules on. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(docker-release): default stevedore-version to v0.0.7 v0.0.7 (blairham/stevedore#10) skips an env-backed build secret whose variable is unset, so the private-modules gh_token secret stays inert on callers that leave it off and local private-module builds work. Bump the pinned action ref in lockstep. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
An env-backed
secrets:entry previously always emitted--secret id=…,env=…, so a localstevedore buildwith the variable unset failed inside buildx. This skips an env-backed secret when its backing variable is unset or empty — the same opt-in-by-environment contract the emptycache_from/cache_toentries already use.A config can now declare a secret sourced from a variable the environment provides only in some contexts (e.g. a CI-minted token) — it is emitted where the value is present and stays inert on local builds that never export it.
Test
secretArgnow returns(string, bool); updatedTestSecretArg+ added unset/empty skip cases.make checkgreen (gofmt + vet + race tests).