Repository navigation
Secrets support #40
Description
User can't currently pass secrets to their build like in build-push-action and bake-action.
This should be supported but dynamic secrets are not supported by reusable workflows atm: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#onworkflow_callsecrets
Maybe we could something similar to registry-auths secret with a YAML object but might not work for multiline secrets 😣
Activity
ci: switch to github-builder reusable workflow for speed up image builds
ci: switch to github-builder reusable workflow for speed up image builds
NoahR-ATC commentedon Jul 3, 2026
I've created a PR to add support for this #239
crazy-max commentedon Jul 7, 2026
@NoahR-ATC Thanks butI don't think #239 is the right shape for this feature as-is.
The requirement here is not only to pass secrets through to
docker/build-push-action; it also needs to work consistently for the bake workflow. The current approach only coversbuild.yml, sobake.ymlwould still be unsupported.I also don't think
secret-filesshould be exposed this way. This reusable workflow builds from Git context and does not checkout the repository, so file paths from the caller's workspace are not available in the workflow job. Supporting file-based secrets would need a separate, explicit design.The hard part is dynamic secrets. Since
workflow_calldoes not support arbitrary dynamic secret names, we need a normalized input/secret format that can be mapped consistently for both build and bake.I'm going to pick this up and work on an implementation that handles both workflows with the same contract.
crazy-max commentedon Jul 7, 2026
Opened #248