8000 Include a new gh_token secret in builds by graveland · Pull Request #57 · timescale/cloud-actions · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Include a new gh_token secret in builds #57

8000
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Mar 17, 2025
Merged

Include a new gh_token secret in builds #57

merged 1 commit into from
Mar 17, 2025

Conversation

graveland
Copy link
Contributor

This should allow the following for go get in a Dockerfile:

RUN --mount=type=secret,id=gh_token
git config --global "url.https://github-actions:$(cat /run/secrets/gh_token)@github.com/.insteadOf" https://github.com/

** NOTE WELL **

You MUST use multi-stage builds where stages containing this git config aren't included in the image that's pushed to any registries, otherwise the token will be embedded in the image! Build in one stage, copy the build executable from that stage to a release stage, and then push the release stage to the registry.

(The github token that's presented to the builds does expire after 24h, so it's not the end of the world, but it's still important)

This example allows using ssh-agent forwarding when building in a local docker, but uses gh_token in CI:

RUN --mount=type=ssh --mount=type=secret,id=gh_token \
    if [[ -f /run/secrets/gh_token && ( -z "${SSH_AUTH_SOCK:-}" || ! -S "${SSH_AUTH_SOCK:-}" ) ]]; then \
        rm -f ~/.gitconfig; \
        git config --global "url.https://github-actions:$(cat /run/secrets/gh_token 2>/dev/null)@github.com/.insteadOf" https://github.com/; \
        go env -u GOPRIVATE; \
    fi; \
    mkdir -p -m 0700 ~/.ssh && ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null

@graveland
Include a new gh_token secret in builds
109636e 
This should allow the following for `go get` in a Dockerfile:

RUN --mount=type=secret,id=gh_token \
	git config --global "url.https://github-actions:$(cat /run/secrets/gh_token)@github.com/.insteadOf" https://github.com/

** NOTE WELL **

You MUST use multi-stage builds where stages containing this git config
aren't included in the image that's pushed to any registries, otherwise
the token will be embedded in the image! Build in one stage, copy the
build executable from that stage to a release stage, and then push the
release stage to the registry!
@graveland graveland requested a review from a team March 17, 2025 15:01
@graveland graveland merged commit fb051e8 into main Mar 17, 2025
3 checks passed
@graveland graveland deleted the brent/docker-args branch March 17, 2025 15:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sgichohi sgichohi sgichohi approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@graveland @sgichohi
0