@@ -57,14 +57,119 @@ jobs:
5757 "github_token=${{ secrets.GITHUB_TOKEN }}"
5858` ` `
5959
60- > [!NOTE]
61- >
62- > You can also expose a secret file to the build with the ` secret-files` input:
63- >
64- > ```yaml
65- > secret-files: |
66- > "MY_SECRET=./secret.txt"
67- > ```
60+ ### Using secret files
61+
62+ The ` secret-files` input lets you mount existing files as secrets in your build.
63+ This is useful when you need to use credential files that are generated during your workflow,
64+ or when you need to mount configuration files like `.npmrc` or `.pypirc` that are already in the expected format.
65+
66+ The key difference between `secrets` and `secret-files` :
67+
68+ - `secrets` : Pass secret values as strings (from environment variables or GitHub secrets)
69+ - `secret-files` : Mount existing files from the runner's filesystem
70+
71+ # ### Example: Using .npmrc for private npm packages
72+
73+ If your build needs to install packages from a private npm registry,
74+ you can create an `.npmrc` file and mount it as a secret :
75+
76+ ` ` ` yaml
77+ name: ci
78+
79+ on:
80+ push:
81+
82+ jobs:
83+ docker:
84+ runs-on: ubuntu-latest
85+ steps:
86+ - name: Checkout
87+ uses: actions/checkout@{{% param "checkout_action_version" %}}
88+
89+ - name: Set up Docker Buildx
90+ uses: docker/setup-buildx-action@{{% param "setup_buildx_action_version" %}}
91+
92+ - name: Create .npmrc file
93+ run: |
94+ echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" > .npmrc
95+
96+ - name: Build
97+ uses: docker/build-push-action@{{% param "build_push_action_version" %}}
98+ with:
99+ context: .
100+ secret-files: |
101+ npmrc=./.npmrc
102+ tags: user/app:latest
103+ ` ` `
104+
105+ In your Dockerfile, mount the secret file to the expected location :
106+
107+ ` ` ` dockerfile
108+ # syntax=docker/dockerfile:1
109+ FROM node:20-alpine
110+
111+ WORKDIR /app
112+
113+ COPY package*.json ./
114+
115+ RUN --mount=type=secret,id=npmrc,target=/root/.npmrc \
116+ npm ci
117+
118+ COPY . .
119+
120+ RUN npm run build
121+ ` ` `
122+
123+ # ### Example: Using dynamically generated credentials
124+
125+ You can generate credential files from multiple secrets and mount them :
126+
127+ ` ` ` yaml
128+ name: ci
129+
130+ on:
131+ push:
132+
133+ jobs:
134+ docker:
135+ runs-on: ubuntu-latest
136+ steps:
137+ - name: Checkout
138+ uses: actions/checkout@{{% param "checkout_action_version" %}}
139+
140+ - name: Set up Docker Buildx
141+ uses: docker/setup-buildx-action@{{% param "setup_buildx_action_version" %}}
142+
143+ - name: Create credentials file
144+ run: |
145+ cat <<EOF > aws-credentials
146+ [default]
147+ aws_access_key_id = ${{ secrets.AWS_ACCESS_KEY_ID }}
148+ aws_secret_access_key = ${{ secrets.AWS_SECRET_ACCESS_KEY }}
149+ EOF
150+
151+ - name: Build
152+ uses: docker/build-push-action@{{% param "build_push_action_version" %}}
153+ with:
154+ context: .
155+ secret-files: |
156+ aws=./aws-credentials
157+ tags: user/app:latest
158+ ` ` `
159+
160+ In your Dockerfile :
161+
162+ ` ` ` dockerfile
163+ # syntax=docker/dockerfile:1
164+ FROM alpine
165+
166+ RUN apk add --no-cache aws-cli
167+
168+ RUN --mount=type=secret,id=aws,target=/root/.aws/credentials \
169+ aws s3 cp s3://my-private-bucket/data.tar.gz /tmp/
170+ ` ` `
171+
172+ # ## Multi-line secrets
68173
69174If you're using [GitHub secrets](https://docs.github.com/en/actions/security-guides/encrypted-secrets)
70175and need to handle multi-line value, you will need to place the key-value pair
0 commit comments