Merge pull request #136 from crazy-max/auto-git-token

Expose Git secret token if default context used

.github/workflows/ci.yml

@@ -11,11 +11,53 @@ on:
 jobs:
   git-context:
     runs-on: ubuntu-latest
-    strategy:
+    services:
-      fail-fast: false
+      registry:
-      matrix:
+        image: registry:2
-        buildx-version:
+        ports:
-          - latest
+          - 5000:5000
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2.3.2
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+        with:
+          platforms: all
+      -
+        name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v1
+        with:
+          version: latest
+          driver-opts: network=host
+      -
+        name: Build and push
+        id: docker_build
+        uses: ./
+        with:
+          file: ./test/Dockerfile
+          builder: ${{ steps.buildx.outputs.name }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            localhost:5000/name/app:latest
+            localhost:5000/name/app:1.0.0
+      -
+        name: Inspect
+        run: |
+          docker buildx imagetools inspect localhost:5000/name/app:1.0.0
+      -
+        name: Image digest
+        run: echo ${{ steps.docker_build.outputs.digest }}
+      -
+        name: Dump context
+        if: always()
+        uses: crazy-max/ghaction-dump-context@v1
+
+  git-context-secret:
+    runs-on: ubuntu-latest
     services:
       registry:
         image: registry:2

README.md

@@ -45,9 +45,6 @@ build-secrets, remote cache, etc. and different builder deployment/namespacing o
 
 The default behavior of this action is to use the [Git context invoked by your workflow](https://github.com/docker/build-push-action/blob/master/src/context.ts#L35).
 
-<details>
-  <summary><b>Show workflow</b></summary>
-  
 ```yaml
 name: ci
 
@@ -82,10 +79,10 @@ jobs:
         name: Image digest
         run: echo ${{ steps.docker_build.outputs.digest }}
 ```
-</details>
 
-If you use this action in a private repository, you have to pass the [GitHub Token](https://help.github.com/en/actions/configuring-and-managing-workflows/authenticating-with-the-github_token)
+Building from current repository automatically uses the [GitHub Token](https://help.github.com/en/actions/configuring-and-managing-workflows/authenticating-with-the-github_token)
-as a secret named `GIT_AUTH_TOKEN` to be able to authenticate against it with buildx:
+as provided by `secrets` so it does not need to be passed. But if you want to authenticate against another private
+repository, you have to use a secret named `GIT_AUTH_TOKEN` to be able to authenticate against it with buildx:
 
 ```yaml
       -
@@ -96,7 +93,7 @@ as a secret named `GIT_AUTH_TOKEN` to be able to authenticate against it with bu
           push: true
           tags: user/app:latest
           secrets: |
-            GIT_AUTH_TOKEN=${{ github.token }}
+            GIT_AUTH_TOKEN=${{ secrets.MYTOKEN }}
 ```
 
 > :warning: Subdir for Git context is [not yet supported](https://github.com/docker/build-push-action/issues/120).
@@ -106,9 +103,6 @@ as a secret named `GIT_AUTH_TOKEN` to be able to authenticate against it with bu
 
 You can also use the `PATH` context alongside the [`actions/checkout`](https://github.com/actions/checkout/) action.
 
-<details>
-  <summary><b>Show workflow</b></summary>
-  
 ```yaml
 name: ci
 
@@ -145,13 +139,9 @@ You can also use the `PATH` context alongside the [`actions/checkout`](https://g
           push: true
           tags: user/app:latest
 ```
-</details>
 
 ### Isolated builders
 
-<details>
-  <summary><b>Show workflow</b></summary>
-  
 ```yaml
 name: ci
 
@@ -188,13 +178,9 @@ You can also use the `PATH` context alongside the [`actions/checkout`](https://g
           builder: ${{ steps.builder2.outputs.name }}
           target: mytarget2
 ```
-</details>
 
 ### Multi-platform image
 
-<details>
-  <summary><b>Show workflow</b></summary>
-  
 ```yaml
 name: ci
 
@@ -233,13 +219,12 @@ You can also use the `PATH` context alongside the [`actions/checkout`](https://g
             user/app:latest
             user/app:1.0.0
 ```
-</details>
 
 ## Advanced usage
 
 ### Local registry
 
-For testing purposes you may need to create a [local registry](https://hub.docker.com/_/registry) to push images into.
+For testing purposes you may need to create a [local registry](https://hub.docker.com/_/registry) to push images into:
 
 <details>
   <summary><b>Show workflow</b></summary>
@@ -284,7 +269,7 @@ For testing purposes you may need to create a [local registry](https://hub.docke
 ### Leverage GitHub cache
 
 You can leverage [GitHub cache](https://docs.github.com/en/actions/configuring-and-managing-workflows/caching-dependencies-to-speed-up-workflows)
-using [actions/cache](https://github.com/actions/cache) with this action.
+using [actions/cache](https://github.com/actions/cache) with this action:
 
 <details>
   <summary><b>Show workflow</b></summary>
@@ -338,15 +323,6 @@ The following workflow with the `Prepare` step will generate some [outputs](http
 to handle tags and labels based on GitHub actions events. This is just an example to show many cases that you
 might want to use:
 
-| Event           | Ref                           | Commit SHA | Docker Tag                         | Pushed |
-|-----------------|-------------------------------|------------|------------------------------------|--------|
-| `schedule`      |                               |            | `nightly`                          | Yes    |
-| `pull_request`  | `refs/pull/2/merge`           | `a123b57`  | `pr-2`                             | No     |
-| `push`          | `refs/heads/<default_branch>` | `676cae2`  | `sha-676cae2`, `edge`              | Yes    |
-| `push`          | `refs/heads/dev`              | `cf20257`  | `sha-cf20257`, `dev`               | Yes    |
-| `push`          | `refs/heads/my/branch`        | `a5df687`  | `sha-a5df687`, `my-branch`         | Yes    |
-| `push tag`      | `refs/tags/v1.2.3`            |            | `v1.2.3`, `v1.2`, `v1`, `latest`   | Yes    |
-
 <details>
   <summary><b>Show workflow</b></summary>
   
@@ -434,11 +410,20 @@ might want to use:
   ```
 </details>
 
+| Event           | Ref                           | Commit SHA | Docker Tag                         | Pushed |
+|-----------------|-------------------------------|------------|------------------------------------|--------|
+| `schedule`      |                               |            | `nightly`                          | Yes    |
+| `pull_request`  | `refs/pull/2/merge`           | `a123b57`  | `pr-2`                             | No     |
+| `push`          | `refs/heads/<default_branch>` | `676cae2`  | `sha-676cae2`, `edge`              | Yes    |
+| `push`          | `refs/heads/dev`              | `cf20257`  | `sha-cf20257`, `dev`               | Yes    |
+| `push`          | `refs/heads/my/branch`        | `a5df687`  | `sha-a5df687`, `my-branch`         | Yes    |
+| `push tag`      | `refs/tags/v1.2.3`            |            | `v1.2.3`, `v1.2`, `v1`, `latest`   | Yes    |
+
 ### Update DockerHub repo description
 
 You can update the [Docker Hub repository description](https://docs.docker.com/docker-hub/repos/) using
 a third-party action called [Docker Hub Description](https://github.com/peter-evans/dockerhub-description)
-with this action.
+with this action:
 
 <details>
   <summary><b>Show workflow</b></summary>

action.yml

@@ -64,6 +64,10 @@ inputs:
   secrets:
     description: "List of secrets to expose to the build (eg. key=value, GIT_AUTH_TOKEN=mytoken)"
     required: false
+  github-token:
+    description: "GitHub Token used to authenticate against a repository for Git context"
+    default: ${{ github.token }}
+    required: false
 
 outputs:
   digest:

dist/index.js

@@ -7955,6 +7955,12 @@ function convertBody(buffer, headers) {
 	// html4
 	if (!res && str) {
 		res = /<meta[\s]+?http-equiv=(['"])content-type\1[\s]+?content=(['"])(.+?)\2/i.exec(str);
+		if (!res) {
+			res = /<meta[\s]+?content=(['"])(.+?)\1[\s]+?http-equiv=(['"])content-type\3/i.exec(str);
+			if (res) {
+				res.pop(); // drop last quote
+			}
+		}
 
 		if (res) {
 			res = /charset=(.*)/i.exec(res.pop());
@@ -8962,7 +8968,7 @@ function fetch(url, opts) {
 				// HTTP fetch step 5.5
 				switch (request.redirect) {
 					case 'error':
-						reject(new FetchError(`redirect mode is set to error: ${request.url}`, 'no-redirect'));
+						reject(new FetchError(`uri requested responds with a redirect, redirect mode is set to error: ${request.url}`, 'no-redirect'));
 						finalize();
 						return;
 					case 'manual':
@@ -9001,7 +9007,8 @@ function fetch(url, opts) {
 							method: request.method,
 							body: request.body,
 							signal: request.signal,
-							timeout: request.timeout
+							timeout: request.timeout,
+							size: request.size
 						};
 
 						// HTTP-redirect fetch step 9
@@ -13640,11 +13647,11 @@ const buildx = __importStar(__webpack_require__(295));
 const core = __importStar(__webpack_require__(186));
 const github = __importStar(__webpack_require__(438));
 exports.tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'docker-build-push-'));
+const defaultContext = `https://github.com/${github.context.repo.owner}/${github.context.repo.repo}#${github.context.ref}`;
 function getInputs() {
     return __awaiter(this, void 0, void 0, function* () {
         return {
-            context: core.getInput('context') ||
+            context: core.getInput('context') || defaultContext,
-                `https://github.com/${github.context.repo.owner}/${github.context.repo.repo}#${github.context.ref}`,
             file: core.getInput('file') || 'Dockerfile',
             buildArgs: yield getInputList('build-args'),
             labels: yield getInputList('labels'),
@@ -13660,7 +13667,8 @@ function getInputs() {
             outputs: yield getInputList('outputs', true),
             cacheFrom: yield getInputList('cache-from', true),
             cacheTo: yield getInputList('cache-to', true),
-            secrets: yield getInputList('secrets', true)
+            secrets: yield getInputList('secrets', true),
+            githubToken: core.getInput('github-token')
         };
     });
 }
@@ -13708,9 +13716,16 @@ function getBuildArgs(inputs, buildxVersion) {
         yield exports.asyncForEach(inputs.cacheTo, (cacheTo) => __awaiter(this, void 0, void 0, function* () {
             args.push('--cache-to', cacheTo);
         }));
+        let hasGitAuthToken = false;
         yield exports.asyncForEach(inputs.secrets, (secret) => __awaiter(this, void 0, void 0, function* () {
+            if (secret.startsWith('GIT_AUTH_TOKEN=')) {
+                hasGitAuthToken = true;
+            }
             args.push('--secret', yield buildx.getSecret(secret));
         }));
+        if (inputs.githubToken && !hasGitAuthToken && inputs.context == defaultContext) {
+            args.push('--secret', yield buildx.getSecret(`GIT_AUTH_TOKEN=${inputs.githubToken}`));
+        }
         if (inputs.file) {
             args.push('--file', inputs.file);
         }

src/context.ts

@@ -6,7 +6,8 @@ import * as buildx from './buildx';
 import * as core from '@actions/core';
 import * as github from '@actions/github';
 
-export const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'docker-build-push-'));
+export const tmpDir: string = fs.mkdtempSync(path.join(os.tmpdir(), 'docker-build-push-'));
+const defaultContext: string = `https://github.com/${github.context.repo.owner}/${github.context.repo.repo}#${github.context.ref}`;
 
 export interface Inputs {
   context: string;
@@ -26,13 +27,12 @@ export interface Inputs {
   cacheFrom: string[];
   cacheTo: string[];
   secrets: string[];
+  githubToken: string;
 }
 
 export async function getInputs(): Promise<Inputs> {
   return {
-    context:
+    context: core.getInput('context') || defaultContext,
-      core.getInput('context') ||
-      `https://github.com/${github.context.repo.owner}/${github.context.repo.repo}#${github.context.ref}`,
     file: core.getInput('file') || 'Dockerfile',
     buildArgs: await getInputList('build-args'),
     labels: await getInputList('labels'),
@@ -48,7 +48,8 @@ export async function getInputs(): Promise<Inputs> {
     outputs: await getInputList('outputs', true),
     cacheFrom: await getInputList('cache-from', true),
     cacheTo: await getInputList('cache-to', true),
-    secrets: await getInputList('secrets', true)
+    secrets: await getInputList('secrets', true),
+    githubToken: core.getInput('github-token')
   };
 }
 
@@ -92,9 +93,16 @@ async function getBuildArgs(inputs: Inputs, buildxVersion: string): Promise<Arra
   await asyncForEach(inputs.cacheTo, async cacheTo => {
     args.push('--cache-to', cacheTo);
   });
+  let hasGitAuthToken: boolean = false;
   await asyncForEach(inputs.secrets, async secret => {
+    if (secret.startsWith('GIT_AUTH_TOKEN=')) {
+      hasGitAuthToken = true;
+    }
     args.push('--secret', await buildx.getSecret(secret));
   });
+  if (inputs.githubToken && !hasGitAuthToken && inputs.context == defaultContext) {
+    args.push('--secret', await buildx.getSecret(`GIT_AUTH_TOKEN=${inputs.githubToken}`));
+  }
   if (inputs.file) {
     args.push('--file', inputs.file);
   }