mirror of https://github.com/docker/docs.git
90 lines
2.4 KiB
Markdown
90 lines
2.4 KiB
Markdown
---
|
|
title: Using secrets with GitHub Actions
|
|
description: Example using secret mounts with GitHub Actions
|
|
keywords: ci, github actions, gha, buildkit, buildx, secret
|
|
---
|
|
|
|
In the following example uses and exposes the [`GITHUB_TOKEN` secret](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#about-the-github_token-secret)
|
|
as provided by GitHub in your workflow.
|
|
|
|
First, create a `Dockerfile` that uses the secret:
|
|
|
|
```dockerfile
|
|
# syntax=docker/dockerfile:1
|
|
FROM alpine
|
|
RUN --mount=type=secret,id=github_token \
|
|
cat /run/secrets/github_token
|
|
```
|
|
|
|
In this example, the secret name is `github_token`. The following workflow
|
|
exposes this secret using the `secrets` input:
|
|
|
|
```yaml
|
|
name: ci
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- "main"
|
|
|
|
jobs:
|
|
docker:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
- name: Build
|
|
uses: docker/build-push-action@v5
|
|
with:
|
|
context: .
|
|
platforms: linux/amd64,linux/arm64
|
|
tags: user/app:latest
|
|
secrets: |
|
|
"github_token=${{ secrets.GITHUB_TOKEN }}"
|
|
```
|
|
|
|
> **Note**
|
|
>
|
|
> You can also expose a secret file to the build with the `secret-files` input:
|
|
>
|
|
> ```yaml
|
|
> secret-files: |
|
|
> "MY_SECRET=./secret.txt"
|
|
> ```
|
|
|
|
If you're using [GitHub secrets](https://docs.github.com/en/actions/security-guides/encrypted-secrets)
|
|
and need to handle multi-line value, you will need to place the key-value pair
|
|
between quotes:
|
|
|
|
```yaml
|
|
secrets: |
|
|
"MYSECRET=${{ secrets.GPG_KEY }}"
|
|
GIT_AUTH_TOKEN=abcdefghi,jklmno=0123456789
|
|
"MYSECRET=aaaaaaaa
|
|
bbbbbbb
|
|
ccccccccc"
|
|
FOO=bar
|
|
"EMPTYLINE=aaaa
|
|
|
|
bbbb
|
|
ccc"
|
|
"JSON_SECRET={""key1"":""value1"",""key2"":""value2""}"
|
|
```
|
|
|
|
| Key | Value |
|
|
| ---------------- | ----------------------------------- |
|
|
| `MYSECRET` | `***********************` |
|
|
| `GIT_AUTH_TOKEN` | `abcdefghi,jklmno=0123456789` |
|
|
| `MYSECRET` | `aaaaaaaa\nbbbbbbb\nccccccccc` |
|
|
| `FOO` | `bar` |
|
|
| `EMPTYLINE` | `aaaa\n\nbbbb\nccc` |
|
|
| `JSON_SECRET` | `{"key1":"value1","key2":"value2"}` |
|
|
|
|
> **Note**
|
|
>
|
|
> Double escapes are needed for quote signs.
|