Merge pull request #136 from crazy-max/auto-git-token

Expose Git secret token if default context used
5 years ago · a2578e544b
parent 3a24abd18b e952699f4d
commit a2578e544b
5 changed files with 206 additions and 152 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@ -11,11 +11,53 @@ on:
 jobs:
  git-context:
    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        buildx-version:
-          - latest
+    services:
+      registry:
+        image: registry:2
+        ports:
+          - 5000:5000
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2.3.2
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+        with:
+          platforms: all
+      -
+        name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v1
+        with:
+          version: latest
+          driver-opts: network=host
+      -
+        name: Build and push
+        id: docker_build
+        uses: ./
+        with:
+          file: ./test/Dockerfile
+          builder: ${{ steps.buildx.outputs.name }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            localhost:5000/name/app:latest
+            localhost:5000/name/app:1.0.0
+      -
+        name: Inspect
+        run: |
+          docker buildx imagetools inspect localhost:5000/name/app:1.0.0
+      -
+        name: Image digest
+        run: echo ${{ steps.docker_build.outputs.digest }}
+      -
+        name: Dump context
+        if: always()
+        uses: crazy-max/ghaction-dump-context@v1
+
+  git-context-secret:
+    runs-on: ubuntu-latest
    services:
      registry:
        image: registry:2
--- a/README.md
+++ b/README.md
@ -45,10 +45,7 @@ build-secrets, remote cache, etc. and different builder deployment/namespacing o

 The default behavior of this action is to use the [Git context invoked by your workflow](https://github.com/docker/build-push-action/blob/master/src/context.ts#L35).

-<details>
-  <summary><b>Show workflow</b></summary>
-  
-  ```yaml
+```yaml
 name: ci

 on:
@ -81,11 +78,11 @@ jobs:
      -
        name: Image digest
        run: echo ${{ steps.docker_build.outputs.digest }}
-  ```
-</details>
+```

-If you use this action in a private repository, you have to pass the [GitHub Token](https://help.github.com/en/actions/configuring-and-managing-workflows/authenticating-with-the-github_token)
-as a secret named `GIT_AUTH_TOKEN` to be able to authenticate against it with buildx:
+Building from current repository automatically uses the [GitHub Token](https://help.github.com/en/actions/configuring-and-managing-workflows/authenticating-with-the-github_token)
+as provided by `secrets` so it does not need to be passed. But if you want to authenticate against another private
+repository, you have to use a secret named `GIT_AUTH_TOKEN` to be able to authenticate against it with buildx:

 ```yaml
      -
@ -96,7 +93,7 @@ as a secret named `GIT_AUTH_TOKEN` to be able to authenticate against it with bu
          push: true
          tags: user/app:latest
          secrets: |
-            GIT_AUTH_TOKEN=${{ github.token }}
+            GIT_AUTH_TOKEN=${{ secrets.MYTOKEN }}
 ```

 > :warning: Subdir for Git context is [not yet supported](https://github.com/docker/build-push-action/issues/120).
@ -106,17 +103,14 @@ as a secret named `GIT_AUTH_TOKEN` to be able to authenticate against it with bu

 You can also use the `PATH` context alongside the [`actions/checkout`](https://github.com/actions/checkout/) action.

-<details>
-  <summary><b>Show workflow</b></summary>
-  
-  ```yaml
-  name: ci
+```yaml
+name: ci

-  on:
+on:
  push:
    branches: master

-  jobs:
+jobs:
  path-context:
    runs-on: ubuntu-latest
    steps:
@ -144,22 +138,18 @@ You can also use the `PATH` context alongside the [`actions/checkout`](https://g
          platforms: linux/amd64,linux/arm64,linux/386
          push: true
          tags: user/app:latest
-  ```
-</details>
+```

 ### Isolated builders

-<details>
-  <summary><b>Show workflow</b></summary>
-  
-  ```yaml
-  name: ci
+```yaml
+name: ci

-  on:
+on:
  push:
    branches: master

-  jobs:
+jobs:
  multi-builders:
    runs-on: ubuntu-latest
    steps:
@ -187,22 +177,18 @@ You can also use the `PATH` context alongside the [`actions/checkout`](https://g
        with:
          builder: ${{ steps.builder2.outputs.name }}
          target: mytarget2
-  ```
-</details>
+```

 ### Multi-platform image

-<details>
-  <summary><b>Show workflow</b></summary>
-  
-  ```yaml
-  name: ci
+```yaml
+name: ci

-  on:
+on:
  push:
    branches: master

-  jobs:
+jobs:
  multi:
    runs-on: ubuntu-latest
    steps:
@ -232,14 +218,13 @@ You can also use the `PATH` context alongside the [`actions/checkout`](https://g
          tags: |
            user/app:latest
            user/app:1.0.0
-  ```
-</details>
+```

 ## Advanced usage

 ### Local registry

-For testing purposes you may need to create a [local registry](https://hub.docker.com/_/registry) to push images into.
+For testing purposes you may need to create a [local registry](https://hub.docker.com/_/registry) to push images into:

 <details>
  <summary><b>Show workflow</b></summary>
@ -284,7 +269,7 @@ For testing purposes you may need to create a [local registry](https://hub.docke
 ### Leverage GitHub cache

 You can leverage [GitHub cache](https://docs.github.com/en/actions/configuring-and-managing-workflows/caching-dependencies-to-speed-up-workflows)
-using [actions/cache](https://github.com/actions/cache) with this action.
+using [actions/cache](https://github.com/actions/cache) with this action:

 <details>
  <summary><b>Show workflow</b></summary>
@ -338,15 +323,6 @@ The following workflow with the `Prepare` step will generate some [outputs](http
 to handle tags and labels based on GitHub actions events. This is just an example to show many cases that you
 might want to use:

-| Event           | Ref                           | Commit SHA | Docker Tag                         | Pushed |
-|-----------------|-------------------------------|------------|------------------------------------|--------|
-| `schedule`      |                               |            | `nightly`                          | Yes    |
-| `pull_request`  | `refs/pull/2/merge`           | `a123b57`  | `pr-2`                             | No     |
-| `push`          | `refs/heads/<default_branch>` | `676cae2`  | `sha-676cae2`, `edge`              | Yes    |
-| `push`          | `refs/heads/dev`              | `cf20257`  | `sha-cf20257`, `dev`               | Yes    |
-| `push`          | `refs/heads/my/branch`        | `a5df687`  | `sha-a5df687`, `my-branch`         | Yes    |
-| `push tag`      | `refs/tags/v1.2.3`            |            | `v1.2.3`, `v1.2`, `v1`, `latest`   | Yes    |
-
 <details>
  <summary><b>Show workflow</b></summary>
  
@ -434,11 +410,20 @@ might want to use:
  ```
 </details>

+| Event           | Ref                           | Commit SHA | Docker Tag                         | Pushed |
+|-----------------|-------------------------------|------------|------------------------------------|--------|
+| `schedule`      |                               |            | `nightly`                          | Yes    |
+| `pull_request`  | `refs/pull/2/merge`           | `a123b57`  | `pr-2`                             | No     |
+| `push`          | `refs/heads/<default_branch>` | `676cae2`  | `sha-676cae2`, `edge`              | Yes    |
+| `push`          | `refs/heads/dev`              | `cf20257`  | `sha-cf20257`, `dev`               | Yes    |
+| `push`          | `refs/heads/my/branch`        | `a5df687`  | `sha-a5df687`, `my-branch`         | Yes    |
+| `push tag`      | `refs/tags/v1.2.3`            |            | `v1.2.3`, `v1.2`, `v1`, `latest`   | Yes    |
+
 ### Update DockerHub repo description

 You can update the [Docker Hub repository description](https://docs.docker.com/docker-hub/repos/) using
 a third-party action called [Docker Hub Description](https://github.com/peter-evans/dockerhub-description)
-with this action.
+with this action:

 <details>
  <summary><b>Show workflow</b></summary>
--- a/action.yml
+++ b/action.yml
@ -64,6 +64,10 @@ inputs:
  secrets:
    description: "List of secrets to expose to the build (eg. key=value, GIT_AUTH_TOKEN=mytoken)"
    required: false
+  github-token:
+    description: "GitHub Token used to authenticate against a repository for Git context"
+    default: ${{ github.token }}
+    required: false

 outputs:
  digest:
--- a/dist/index.js
+++ b/dist/index.js
@ -7955,6 +7955,12 @@ function convertBody(buffer, headers) {
 	// html4
 	if (!res && str) {
 		res = /<meta[\s]+?http-equiv=(['"])content-type\1[\s]+?content=(['"])(.+?)\2/i.exec(str);
+		if (!res) {
+			res = /<meta[\s]+?content=(['"])(.+?)\1[\s]+?http-equiv=(['"])content-type\3/i.exec(str);
+			if (res) {
+				res.pop(); // drop last quote
+			}
+		}

 		if (res) {
 			res = /charset=(.*)/i.exec(res.pop());
@ -8962,7 +8968,7 @@ function fetch(url, opts) {
 				// HTTP fetch step 5.5
 				switch (request.redirect) {
 					case 'error':
-						reject(new FetchError(`redirect mode is set to error: ${request.url}`, 'no-redirect'));
+						reject(new FetchError(`uri requested responds with a redirect, redirect mode is set to error: ${request.url}`, 'no-redirect'));
 						finalize();
 						return;
 					case 'manual':
@ -9001,7 +9007,8 @@ function fetch(url, opts) {
 							method: request.method,
 							body: request.body,
 							signal: request.signal,
-							timeout: request.timeout
+							timeout: request.timeout,
+							size: request.size
 						};

 						// HTTP-redirect fetch step 9
@ -13640,11 +13647,11 @@ const buildx = __importStar(__webpack_require__(295));
 const core = __importStar(__webpack_require__(186));
 const github = __importStar(__webpack_require__(438));
 exports.tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'docker-build-push-'));
+const defaultContext = `https://github.com/${github.context.repo.owner}/${github.context.repo.repo}#${github.context.ref}`;
 function getInputs() {
    return __awaiter(this, void 0, void 0, function* () {
        return {
-            context: core.getInput('context') ||
-                `https://github.com/${github.context.repo.owner}/${github.context.repo.repo}#${github.context.ref}`,
+            context: core.getInput('context') || defaultContext,
            file: core.getInput('file') || 'Dockerfile',
            buildArgs: yield getInputList('build-args'),
            labels: yield getInputList('labels'),
@ -13660,7 +13667,8 @@ function getInputs() {
            outputs: yield getInputList('outputs', true),
            cacheFrom: yield getInputList('cache-from', true),
            cacheTo: yield getInputList('cache-to', true),
-            secrets: yield getInputList('secrets', true)
+            secrets: yield getInputList('secrets', true),
+            githubToken: core.getInput('github-token')
        };
    });
 }
@ -13708,9 +13716,16 @@ function getBuildArgs(inputs, buildxVersion) {
        yield exports.asyncForEach(inputs.cacheTo, (cacheTo) => __awaiter(this, void 0, void 0, function* () {
            args.push('--cache-to', cacheTo);
        }));
+        let hasGitAuthToken = false;
        yield exports.asyncForEach(inputs.secrets, (secret) => __awaiter(this, void 0, void 0, function* () {
+            if (secret.startsWith('GIT_AUTH_TOKEN=')) {
+                hasGitAuthToken = true;
+            }
            args.push('--secret', yield buildx.getSecret(secret));
        }));
+        if (inputs.githubToken && !hasGitAuthToken && inputs.context == defaultContext) {
+            args.push('--secret', yield buildx.getSecret(`GIT_AUTH_TOKEN=${inputs.githubToken}`));
+        }
        if (inputs.file) {
            args.push('--file', inputs.file);
        }
--- a/src/context.ts
+++ b/src/context.ts
@ -6,7 +6,8 @@ import * as buildx from './buildx';
 import * as core from '@actions/core';
 import * as github from '@actions/github';

-export const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'docker-build-push-'));
+export const tmpDir: string = fs.mkdtempSync(path.join(os.tmpdir(), 'docker-build-push-'));
+const defaultContext: string = `https://github.com/${github.context.repo.owner}/${github.context.repo.repo}#${github.context.ref}`;

 export interface Inputs {
  context: string;
@ -26,13 +27,12 @@ export interface Inputs {
  cacheFrom: string[];
  cacheTo: string[];
  secrets: string[];
+  githubToken: string;
 }

 export async function getInputs(): Promise<Inputs> {
  return {
-    context:
-      core.getInput('context') ||
-      `https://github.com/${github.context.repo.owner}/${github.context.repo.repo}#${github.context.ref}`,
+    context: core.getInput('context') || defaultContext,
    file: core.getInput('file') || 'Dockerfile',
    buildArgs: await getInputList('build-args'),
    labels: await getInputList('labels'),
@ -48,7 +48,8 @@ export async function getInputs(): Promise<Inputs> {
    outputs: await getInputList('outputs', true),
    cacheFrom: await getInputList('cache-from', true),
    cacheTo: await getInputList('cache-to', true),
-    secrets: await getInputList('secrets', true)
+    secrets: await getInputList('secrets', true),
+    githubToken: core.getInput('github-token')
  };
 }

@ -92,9 +93,16 @@ async function getBuildArgs(inputs: Inputs, buildxVersion: string): Promise<Arra
  await asyncForEach(inputs.cacheTo, async cacheTo => {
    args.push('--cache-to', cacheTo);
  });
+  let hasGitAuthToken: boolean = false;
  await asyncForEach(inputs.secrets, async secret => {
+    if (secret.startsWith('GIT_AUTH_TOKEN=')) {
+      hasGitAuthToken = true;
+    }
    args.push('--secret', await buildx.getSecret(secret));
  });
+  if (inputs.githubToken && !hasGitAuthToken && inputs.context == defaultContext) {
+    args.push('--secret', await buildx.getSecret(`GIT_AUTH_TOKEN=${inputs.githubToken}`));
+  }
  if (inputs.file) {
    args.push('--file', inputs.file);
  }