alextab93/buildx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Merge pull request #3962 from crazy-max/bake-secret-source-override

Browse Source 
bake: allow overriding declared secret sources
This commit is contained in:
CrazyMax
2026-07-22 14:36:50 +02:00
committed by GitHub
parent 26f3b06d8d febb45afe2
commit 5c10fb7184
5 changed files with 152 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bake/bake_test.go
+43
View File
@@ -237,6 +237,49 @@ target "webapp" {
require.Equal(t, "BAR", m["webapp"].Secrets[1].ID)
})
t.Run("SecretSourceOverrideEnv", func(t *testing.T) {
m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.secret.FOO=env=BAR"}, nil, nil, &EntitlementConf{})
require.NoError(t, err)
require.Len(t, m["webapp"].Secrets, 1)
require.Equal(t, "FOO", m["webapp"].Secrets[0].ID)
require.Equal(t, "BAR", m["webapp"].Secrets[0].Env)
require.Empty(t, m["webapp"].Secrets[0].FilePath)
})
t.Run("SecretSourceOverrideFile", func(t *testing.T) {
ent := &EntitlementConf{}
m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.secret.FOO=src=/tmp/foo"}, nil, nil, ent)
require.NoError(t, err)
require.Len(t, m["webapp"].Secrets, 1)
require.Equal(t, "FOO", m["webapp"].Secrets[0].ID)
require.Equal(t, "/tmp/foo", m["webapp"].Secrets[0].FilePath)
require.Empty(t, m["webapp"].Secrets[0].Env)
require.Equal(t, []string{"/tmp/foo"}, ent.FSRead)
})
t.Run("SecretSourceOverrideUsesFinalSourceForEntitlements", func(t *testing.T) {
ent := &EntitlementConf{}
m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.secrets=id=FOO,src=/tmp/foo", "webapp.secret.FOO=env=BAR"}, nil, nil, ent)
require.NoError(t, err)
require.Len(t, m["webapp"].Secrets, 1)
require.Equal(t, "FOO", m["webapp"].Secrets[0].ID)
require.Equal(t, "BAR", m["webapp"].Secrets[0].Env)
require.Empty(t, m["webapp"].Secrets[0].FilePath)
require.Empty(t, ent.FSRead)
})
t.Run("SecretSourceOverrideUndeclared", func(t *testing.T) {
_, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.secret.BAR=env=BAR"}, nil, nil, &EntitlementConf{})
require.Error(t, err)
require.Equal(t, `secret "BAR" must be declared before it can be overridden`, err.Error())
})
t.Run("SecretSourceOverrideMismatchedID", func(t *testing.T) {
_, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.secret.FOO=id=BAR,env=BAR"}, nil, nil, &EntitlementConf{})
require.Error(t, err)
require.Equal(t, `secret override id "BAR" does not match declared secret "FOO"`, err.Error())
})
t.Run("ShmSizeOverride", func(t *testing.T) {
m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.shm-size=256m"}, nil, nil, &EntitlementConf{})
require.NoError(t, err)