bake: hasGitAuthTokenSecret func

Signed-off-by: CrazyMax <[email protected]>
docker · Jan 10, 2025 · 73473a8 · 73473a8
1 parent e36200f
commit 73473a8
Show file tree

Hide file tree

Showing 4 changed files with 74 additions and 0 deletions.
diff --git a/__tests__/.fixtures/bake-03-default.json b/__tests__/.fixtures/bake-03-default.json
@@ -42,6 +42,19 @@
           "ref": "user/app",
           "type": "registry"
         }
+      ],
+      "secret": [
+        {
+          "env": "GITHUB_TOKEN",
+          "id": "GITHUB_TOKEN"
+        },
+        {
+          "id": "aws",
+          "src": "__tests__/.fixtures/secret.txt"
+        },
+        {
+          "id": "GITHUB_REPOSITORY"
+        }
       ]
     }
   }

diff --git a/__tests__/.fixtures/bake-03.hcl b/__tests__/.fixtures/bake-03.hcl
@@ -29,4 +29,9 @@ target "default" {
     "./release-out",
     "type=registry,ref=user/app"
   ]
+  secret = [
+    "id=GITHUB_TOKEN,env=GITHUB_TOKEN",
+    "id=aws,src=__tests__/.fixtures/secret.txt",
+    "id=GITHUB_REPOSITORY"
+  ]
 }
diff --git a/__tests__/buildx/bake.test.ts b/__tests__/buildx/bake.test.ts
@@ -444,3 +444,44 @@ describe('hasDockerExporter', () => {
     expect(Bake.hasDockerExporter(def, load)).toEqual(expected);
   });
 });
+
+describe('hasGitAuthTokenSecret', () => {
+  // prettier-ignore
+  test.each([
+    [
+      {
+        "target": {
+          "reg": {
+            "secret": [
+              {
+                "id": "A_SECRET",
+                "env": "A_SECRET"
+              }
+            ]
+          },
+        }
+      } as unknown as BakeDefinition,
+      false
+    ],
+    [
+      {
+        "target": {
+          "reg": {
+            "secret": [
+              {
+                "id": "A_SECRET",
+                "env": "A_SECRET"
+              },
+              {
+                "id": "GIT_AUTH_TOKEN"
+              }
+            ]
+          },
+        }
+      } as unknown as BakeDefinition,
+      true
+    ],
+  ])('given %o returns %p', async (def: BakeDefinition, expected: boolean) => {
+    expect(Bake.hasGitAuthTokenSecret(def)).toEqual(expected);
+  });
+});
diff --git a/src/buildx/bake.ts b/src/buildx/bake.ts
@@ -348,6 +348,7 @@ export class Bake {
           secretEntry.src = value;
           break;
         case 'env':
+          secretEntry.env = value;
           break;
       }
     }
@@ -406,4 +407,18 @@ export class Bake {
     }
     return exporters;
   }
+
+  public static hasGitAuthTokenSecret(def: BakeDefinition): boolean {
+    for (const key in def.target) {
+      const target = def.target[key];
+      if (target.secret) {
+        for (const secret of target.secret) {
+          if (Bake.parseSecretEntry(secret).id === 'GIT_AUTH_TOKEN') {
+            return true;
+          }
+        }
+      }
+    }
+    return false;
+  }
 }