feat(docker-release): add opt-in private-modules token for stevedore builds#44
Merged
Merged
Conversation
…builds
Port the `private-modules` opt-in from the frozen matrix implementation
onto the stevedore docker-release. When `private-modules: true`, mint a
short-lived read-only pinpredict-argocd App token and expose it as the
GH_PRIVATE_TOKEN env var to the stevedore step. The caller's
.stevedore.yaml wires it to a BuildKit secret
(`secrets: [{id: gh_token, env: GH_PRIVATE_TOKEN}]`), so a Dockerfile can
`go mod download` a private pinpredict module (e.g. ppkit) without
vendoring — passed as a --secret, never a --build-arg, so it never lands
in an image layer.
Default false — inert for every existing caller: no token is minted, the
env is empty, and stevedore (>= the env-gated release) skips an env-backed
secret whose variable is unset. Bump stevedore-version to that release
before any repo turns private-modules on.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
v0.0.7 (blairham/stevedore#10) skips an env-backed build secret whose variable is unset, so the private-modules gh_token secret stays inert on callers that leave it off and local private-module builds work. Bump the pinned action ref in lockstep. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Ports the
private-modulesopt-in from the frozen matrixdocker-release.yml@pre-stevedoreonto the stevedore implementation onmain.private-modulesboolean input (default false).pinpredict-argocdApp token (contents: read) and exposes it asGH_PRIVATE_TOKENto the stevedore step..stevedore.yamldeclaressecrets: [{id: gh_token, env: GH_PRIVATE_TOKEN}]; stevedore hands it to buildx as a--secret(never a--build-arg), so a Dockerfile canRUN --mount=type=secret,id=gh_token ... go mod downloada privategithub.com/pinpredict/ppkitwithout vendoring. The token never lands in an image layer ordocker history.Why
Unblocks migrating Go repos that fetch private pinpredict modules (covenant, and any future un-vendored Go service) off the frozen matrix pin — that was the one
docker-releasecapability the stevedore rewrite didn't yet carry.Inert until turned on
Default false → no token minted,
GH_PRIVATE_TOKENempty → stevedore skips an env-backed secret whose variable is unset (blairham/stevedore#10). Zero effect on every current caller.Sequencing (before any repo flips it on)
stevedore-versiondefault to that release — required for local private-module builds (in CI the token is always present when opted in, so it works on any version, but localstevedore buildneeds the skip behavior). TheGH_PRIVATE_TOKENcomment notes this.gh_tokensecret to.stevedore.yaml+private-modules: trueat itsci.ymlflip.Test
actionlintclean ondocker-release.yml.🤖 Generated with Claude Code