Murzaby/Adguardhome
1
0
Fork 0
mirror of https://github.com/AdguardTeam/AdGuardHome.git synced 2026-08-04 15:28:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 12

Pull request: AGDNS-4244-use-docker-secrets

Browse source 
Squashed commit of the following:

commit 2d2f3ee81c
Merge: 3c7d59e64 2961664cb
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Mon Jul 20 10:11:54 2026 +0700

    Merge branch 'master'

commit 3c7d59e646
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Mon Jul 20 09:57:34 2026 +0700

    ci: imp code

commit a30b98321d
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Fri Jul 17 11:54:20 2026 +0700

    ci: set xtrace

commit 4488c134aa
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Fri Jul 17 11:28:51 2026 +0700

    ci: imp code

commit d20d853eb9
Author: Dimitry Kolyshev <dkolyshev@adguard.com>
Date:   Thu Jul 16 08:56:15 2026 +0700

    ci: use docker secrets
This commit is contained in:
Dimitry Kolyshev 2026-07-20 09:39:14 +00:00
parent 2961664cbe
commit 48b98bb5a0
4 changed files with 22 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

14
bamboo-specs/release.yaml
View file

@ -113,21 +113,29 @@
docker info
# Disable xtrace so the expanded secret values aren't printed to
# the build log.
set +x
export GPG_KEY_PASSPHRASE="${bamboo_gpgPassword}"
export GPG_SECRET_KEY="${bamboo_gpgSecretKeyPart1}${bamboo_gpgSecretKeyPart2}"
export SIGNER_API_KEY="${bamboo_adguardHomeWinSignerSecretApiKey}"
set -x
docker build \
--build-arg "BASE_IMAGE=${bamboo_dockerGo}" \
--build-arg "BRANCH=${bamboo_planRepository_branchName}" \
--build-arg "CACHE_BUSTER=${bamboo_cacheBuster}" \
--build-arg "CHANNEL=${bamboo_channel}" \
--build-arg "DEPLOY_SCRIPT_PATH=./bamboo-deploy-publisher/deploy.sh" \
--build-arg "GPG_SECRET_KEY=${bamboo_gpgSecretKeyPart1}${bamboo_gpgSecretKeyPart2}" \
--build-arg "GPG_KEY_PASSPHRASE=${bamboo_gpgPassword}" \
--build-arg "REVISION=${bamboo_repository_revision_number}" \
--build-arg "SIGN=1" \
--build-arg "SIGNER_API_KEY=${bamboo_adguardHomeWinSignerSecretApiKey}" \
--build-arg "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" \
--build-arg "VERSION=$version" \
--output '.' \
--progress 'plain' \
--secret id=GPG_KEY_PASSPHRASE \
--secret id=GPG_SECRET_KEY \
--secret id=SIGNER_API_KEY \
--target 'builder-exporter' \
-f ./docker/ci.Dockerfile \
.

8
bamboo-specs/snapcraft.yaml
View file

@ -98,14 +98,20 @@
docker info
# Disable xtrace so the expanded secret values aren't printed to
# the build log.
set +x
export SNAPCRAFT_STORE_CREDENTIALS="${bamboo_snapcraftMacaroonPassword}"
set -x
docker build \
--build-arg "BASE_IMAGE=${bamboo_dockerSnap}" \
--build-arg "CACHE_BUSTER=${bamboo_cacheBuster}" \
--build-arg "SNAPCRAFT_CHANNEL=${bamboo_snapcraftChannel}" \
--build-arg "SNAPCRAFT_STORE_CREDENTIALS=${bamboo_snapcraftMacaroonPassword}" \
--build-arg "VERSION=${bamboo_buildNumber}" \
--output '.' \
--progress 'plain' \
--secret id=SNAPCRAFT_STORE_CREDENTIALS \
--target 'publisher' \
-f ./docker/snapcraft.Dockerfile \
.

6
docker/ci.Dockerfile
View file

@ -153,12 +153,9 @@ ARG BRANCH=master
ARG CACHE_BUSTER=0
ARG CHANNEL=development
ARG DEPLOY_SCRIPT_PATH=not/a/real/path
ARG GPG_KEY_PASSPHRASE=not-a-real-passphrase
ARG GPG_SECRET_KEY=""
ARG OS=""
ARG REVISION=0000000000000000000000000000000000000000
ARG SIGN=0
ARG SIGNER_API_KEY=not-a-real-key
ARG SOURCE_DATE_EPOCH=0
ARG VERSION=""
ADD . /app
@ -166,6 +163,9 @@ WORKDIR /app
RUN \
--mount=type=cache,id=gocache,target=/root/.cache/go-build \
--mount=type=cache,id=gopath,target=/go \
--mount=type=secret,id=GPG_KEY_PASSPHRASE,env=GPG_KEY_PASSPHRASE \
--mount=type=secret,id=GPG_SECRET_KEY,env=GPG_SECRET_KEY \
--mount=type=secret,id=SIGNER_API_KEY,env=SIGNER_API_KEY \
<<-'EOF'
set -e -f -u -x

3
docker/snapcraft.Dockerfile
View file

@ -67,7 +67,6 @@ COPY --from=builder /app/AdGuardHome_i386.snap /AdGuardHome_i386.snap
FROM "$BASE_IMAGE" AS publisher
ARG CACHE_BUSTER=0
ARG SNAPCRAFT_CHANNEL=0
ARG SNAPCRAFT_STORE_CREDENTIALS=0
ARG VERSION=""
ADD snap /app/snap
ADD scripts /app/scripts
@ -77,12 +76,12 @@ ADD AdGuardHome_armhf.snap /app/AdGuardHome_armhf.snap
ADD AdGuardHome_i386.snap /app/AdGuardHome_i386.snap
WORKDIR /app
RUN \
--mount=type=secret,id=SNAPCRAFT_STORE_CREDENTIALS,env=SNAPCRAFT_STORE_CREDENTIALS \
<<-'EOF'
set -e -f -u -x
env \
SNAPCRAFT_CHANNEL="${SNAPCRAFT_CHANNEL}" \
SNAPCRAFT_STORE_CREDENTIALS="${SNAPCRAFT_STORE_CREDENTIALS}" \
VERBOSE='1' \
sh ./scripts/snap/upload.sh
EOF