This is an automated email from the ASF dual-hosted git repository.
RishiRajAnand pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie-tools.git
The following commit(s) were added to refs/heads/main by this push:
new 7594736deda [incubator-kie-issue#6904] : Enable image builder to
accept secret values (#3719)
7594736deda is described below
commit 7594736deda86896b4acbdf2101dcb196268f8b4
Author: Rishiraj Anand <[email protected]>
AuthorDate: Thu Aug 20 13:35:12 2026 +0530
[incubator-kie-issue#6904] : Enable image builder to accept secret values
(#3719)
---
packages/image-builder/README.md | 1 +
packages/image-builder/src/bin.ts | 47 ++++++++++++++++++++++++++++++++++++++-
2 files changed, 47 insertions(+), 1 deletion(-)
diff --git a/packages/image-builder/README.md b/packages/image-builder/README.md
index 435d1f8768a..73095a81039 100644
--- a/packages/image-builder/README.md
+++ b/packages/image-builder/README.md
@@ -19,6 +19,7 @@ Options:
-f, --containerfile Path to the Containerfile/Dockerfile [string]
[default: "Containerfile"]
-c, --context Path to the build context [string] [default:
"./"]
--build-arg Build args for the builder in the format
'<arg>=<value>', where <value> is a string (Can be used multiple times)
[array] [default: []]
+ --secret Secrets to expose to the build in the format
'id=<id>,src=<path>' or 'id=<id>,env=<var>' (Can be used multiple times)
[array] [default: []]
--arch The target build architectures, For example:
[linux/amd64, linux/arm64]. If not provided will default to the native
architecture [array] [default: ["native"]]
-h, --help Show help [boolean]
diff --git a/packages/image-builder/src/bin.ts
b/packages/image-builder/src/bin.ts
index 38783fb20d1..89e67190fea 100644
--- a/packages/image-builder/src/bin.ts
+++ b/packages/image-builder/src/bin.ts
@@ -34,6 +34,7 @@ type ArgsType = {
tags: string[];
push: boolean;
buildArg: string[];
+ secret: string[];
arch?: string[];
useDefaultBuilder: boolean;
allowHostNetworkAccess: boolean;
@@ -63,7 +64,6 @@ function getImageFullNames(args: ArgsType) {
return args.tags.map((tag) => `${imageFullNameWithoutTags}:${tag}`);
}
-// If building with Podman, see "Specifics # Container Images" in
repo/MANUAL.md.
function createAndUseDockerBuilder(args: { allowHostNetworkAccess: boolean;
useDefaultBuilder: boolean }) {
if (args.useDefaultBuilder) {
execSync("docker buildx use default", { stdio: "inherit" });
@@ -118,6 +118,7 @@ function buildArchImage(args: ArgsType & { arch: string[] |
undefined }, imageFu
${args.push ? "--push" : ""}
${imageFullNames.map((fullName) => `-t ${fullName}`).join(" ")}
${args.buildArg.map((arg) => `--build-arg ${arg}`).join(" ")}
+ ${args.secret.map((s) => `--secret ${s}`).join(" ")}
${args.context}
-f ${args.containerfile}`
.split("\n")
@@ -337,6 +338,50 @@ Also useful to aid on developing images and pushing them
to Kubernetes/OpenShift
return evaluedBuildArgs;
},
},
+ secret: {
+ demandOption: false,
+ describe:
+ "Secrets to expose to the build in the format 'id=<id>,src=<path>'
or 'id=<id>,env=<var>' (Can be used multiple times)",
+ type: "array",
+ default: [],
+ coerce: (secrets: string[]) => {
+ const ALLOWED_KEYS = new Set(["id", "src", "env"]);
+ for (const s of secrets) {
+ const spec = s.toString().trim();
+ const pairs: Record<string, string> = {};
+ for (const part of spec.split(",")) {
+ const eqIdx = part.indexOf("=");
+ if (eqIdx === -1) {
+ throw new Error(
+ `ERROR! --secret: Each part must be in 'key=value' format.
Use 'id=<id>,src=<path>' or 'id=<id>,env=<var>'`
+ );
+ }
+ const key = part.slice(0, eqIdx).trim();
+ const value = part.slice(eqIdx + 1).trim();
+ if (!ALLOWED_KEYS.has(key)) {
+ throw new Error(`ERROR! --secret: Unknown key "${key}".
Allowed keys are: id, src, env`);
+ }
+ if (value === "") {
+ throw new Error(
+ `ERROR! --secret: Key "${key}" has an empty value. Use
'id=<id>,src=<path>' or 'id=<id>,env=<var>'`
+ );
+ }
+ pairs[key] = value;
+ }
+ if (!pairs["id"]) {
+ throw new Error(
+ `ERROR! --secret: Missing required key "id". Use
'id=<id>,src=<path>' or 'id=<id>,env=<var>'`
+ );
+ }
+ if (!pairs["src"] && !pairs["env"]) {
+ throw new Error(
+ `ERROR! --secret: Missing required source — must include
either "src=<path>" or "env=<var>". Use 'id=<id>,src=<path>' or
'id=<id>,env=<var>'`
+ );
+ }
+ }
+ return secrets.map((s: string) => s.toString().trim());
+ },
+ },
arch: {
demandOption: false,
describe:
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
