bake: allow overriding declared secret sources

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

docs/bake-reference.md

@@ -1001,6 +1001,14 @@ RUN --mount=type=secret,id=KUBECONFIG,env=KUBECONFIG \
     helm upgrade --install
 ```
 
+You can override the source for an existing secret without changing the target's
+secret IDs. The secret must already be declared by the target.
+
+```console
+$ docker buildx bake --set default.secret.aws=env=AWS_CREDENTIALS
+$ docker buildx bake --set default.secret.KUBECONFIG=src=/path/to/kubeconfig
+```
+
 ### `target.shm-size`
 
 Sets the size of the shared memory allocated for build containers when using

docs/reference/buildx_bake.md

@@ -433,6 +433,7 @@ $ docker buildx bake --set foo*.no-cache                # bypass caching only fo
 $ docker buildx bake --set target.platform+=linux/arm64 # appends 'linux/arm64' to the platform list
 $ docker buildx bake --set target.contexts.bar=../bar   # overrides 'bar' named context
 $ docker buildx bake --set target.resources.memory=2g   # overrides memory resource limit
+$ docker buildx bake --set target.secret.aws=env=AWS    # overrides source for an existing secret
 ```
 
 > [!NOTE]
@@ -464,6 +465,7 @@ You can override the following fields:
 * `pull`
 * `push`
 * `resources`
+* `secret.<id>`
 * `secrets`
 * `ssh`
 * `tags`