From 48b98bb5a0cc27a3499211ef3e25343825243daa Mon Sep 17 00:00:00 2001 From: Dimitry Kolyshev Date: Mon, 20 Jul 2026 09:39:14 +0000 Subject: [PATCH] Pull request: AGDNS-4244-use-docker-secrets Squashed commit of the following: commit 2d2f3ee81c7027dd20017b272a230f8e51c5fa39 Merge: 3c7d59e64 2961664cb Author: Dimitry Kolyshev Date: Mon Jul 20 10:11:54 2026 +0700 Merge branch 'master' commit 3c7d59e646f268ee91f8008756b037dfdc40730a Author: Dimitry Kolyshev Date: Mon Jul 20 09:57:34 2026 +0700 ci: imp code commit a30b98321d7db36df5845e070c2294195bdd59b2 Author: Dimitry Kolyshev Date: Fri Jul 17 11:54:20 2026 +0700 ci: set xtrace commit 4488c134aa892f9fa082dddb08efce6640d4d8db Author: Dimitry Kolyshev Date: Fri Jul 17 11:28:51 2026 +0700 ci: imp code commit d20d853eb9cd2826a145a2894c6b303c64be1c4a Author: Dimitry Kolyshev Date: Thu Jul 16 08:56:15 2026 +0700 ci: use docker secrets --- bamboo-specs/release.yaml | 14 +++++++++++--- bamboo-specs/snapcraft.yaml | 8 +++++++- docker/ci.Dockerfile | 6 +++--- docker/snapcraft.Dockerfile | 3 +-- 4 files changed, 22 insertions(+), 9 deletions(-) diff --git a/bamboo-specs/release.yaml b/bamboo-specs/release.yaml index 0cc36389d..fe9b4de04 100644 --- a/bamboo-specs/release.yaml +++ b/bamboo-specs/release.yaml @@ -113,21 +113,29 @@ docker info + # Disable xtrace so the expanded secret values aren't printed to + # the build log. + set +x + export GPG_KEY_PASSPHRASE="${bamboo_gpgPassword}" + export GPG_SECRET_KEY="${bamboo_gpgSecretKeyPart1}${bamboo_gpgSecretKeyPart2}" + export SIGNER_API_KEY="${bamboo_adguardHomeWinSignerSecretApiKey}" + set -x + docker build \ --build-arg "BASE_IMAGE=${bamboo_dockerGo}" \ --build-arg "BRANCH=${bamboo_planRepository_branchName}" \ --build-arg "CACHE_BUSTER=${bamboo_cacheBuster}" \ --build-arg "CHANNEL=${bamboo_channel}" \ --build-arg "DEPLOY_SCRIPT_PATH=./bamboo-deploy-publisher/deploy.sh" \ - --build-arg "GPG_SECRET_KEY=${bamboo_gpgSecretKeyPart1}${bamboo_gpgSecretKeyPart2}" \ - --build-arg "GPG_KEY_PASSPHRASE=${bamboo_gpgPassword}" \ --build-arg "REVISION=${bamboo_repository_revision_number}" \ --build-arg "SIGN=1" \ - --build-arg "SIGNER_API_KEY=${bamboo_adguardHomeWinSignerSecretApiKey}" \ --build-arg "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" \ --build-arg "VERSION=$version" \ --output '.' \ --progress 'plain' \ + --secret id=GPG_KEY_PASSPHRASE \ + --secret id=GPG_SECRET_KEY \ + --secret id=SIGNER_API_KEY \ --target 'builder-exporter' \ -f ./docker/ci.Dockerfile \ . diff --git a/bamboo-specs/snapcraft.yaml b/bamboo-specs/snapcraft.yaml index 8757a03c3..67b4a3b62 100644 --- a/bamboo-specs/snapcraft.yaml +++ b/bamboo-specs/snapcraft.yaml @@ -98,14 +98,20 @@ docker info + # Disable xtrace so the expanded secret values aren't printed to + # the build log. + set +x + export SNAPCRAFT_STORE_CREDENTIALS="${bamboo_snapcraftMacaroonPassword}" + set -x + docker build \ --build-arg "BASE_IMAGE=${bamboo_dockerSnap}" \ --build-arg "CACHE_BUSTER=${bamboo_cacheBuster}" \ --build-arg "SNAPCRAFT_CHANNEL=${bamboo_snapcraftChannel}" \ - --build-arg "SNAPCRAFT_STORE_CREDENTIALS=${bamboo_snapcraftMacaroonPassword}" \ --build-arg "VERSION=${bamboo_buildNumber}" \ --output '.' \ --progress 'plain' \ + --secret id=SNAPCRAFT_STORE_CREDENTIALS \ --target 'publisher' \ -f ./docker/snapcraft.Dockerfile \ . diff --git a/docker/ci.Dockerfile b/docker/ci.Dockerfile index b290e3d5e..5cabdee64 100644 --- a/docker/ci.Dockerfile +++ b/docker/ci.Dockerfile @@ -153,12 +153,9 @@ ARG BRANCH=master ARG CACHE_BUSTER=0 ARG CHANNEL=development ARG DEPLOY_SCRIPT_PATH=not/a/real/path -ARG GPG_KEY_PASSPHRASE=not-a-real-passphrase -ARG GPG_SECRET_KEY="" ARG OS="" ARG REVISION=0000000000000000000000000000000000000000 ARG SIGN=0 -ARG SIGNER_API_KEY=not-a-real-key ARG SOURCE_DATE_EPOCH=0 ARG VERSION="" ADD . /app @@ -166,6 +163,9 @@ WORKDIR /app RUN \ --mount=type=cache,id=gocache,target=/root/.cache/go-build \ --mount=type=cache,id=gopath,target=/go \ + --mount=type=secret,id=GPG_KEY_PASSPHRASE,env=GPG_KEY_PASSPHRASE \ + --mount=type=secret,id=GPG_SECRET_KEY,env=GPG_SECRET_KEY \ + --mount=type=secret,id=SIGNER_API_KEY,env=SIGNER_API_KEY \ <<-'EOF' set -e -f -u -x diff --git a/docker/snapcraft.Dockerfile b/docker/snapcraft.Dockerfile index a0e7709f1..c3c4aa345 100644 --- a/docker/snapcraft.Dockerfile +++ b/docker/snapcraft.Dockerfile @@ -67,7 +67,6 @@ COPY --from=builder /app/AdGuardHome_i386.snap /AdGuardHome_i386.snap FROM "$BASE_IMAGE" AS publisher ARG CACHE_BUSTER=0 ARG SNAPCRAFT_CHANNEL=0 -ARG SNAPCRAFT_STORE_CREDENTIALS=0 ARG VERSION="" ADD snap /app/snap ADD scripts /app/scripts @@ -77,12 +76,12 @@ ADD AdGuardHome_armhf.snap /app/AdGuardHome_armhf.snap ADD AdGuardHome_i386.snap /app/AdGuardHome_i386.snap WORKDIR /app RUN \ + --mount=type=secret,id=SNAPCRAFT_STORE_CREDENTIALS,env=SNAPCRAFT_STORE_CREDENTIALS \ <<-'EOF' set -e -f -u -x env \ SNAPCRAFT_CHANNEL="${SNAPCRAFT_CHANNEL}" \ - SNAPCRAFT_STORE_CREDENTIALS="${SNAPCRAFT_STORE_CREDENTIALS}" \ VERBOSE='1' \ sh ./scripts/snap/upload.sh EOF