Using secrets with GitHub Actions
In the following example uses and exposes the
GITHUB_TOKEN
secretopen_in_new
as provided by GitHub in your workflow.
First, create a Dockerfile
that uses the secret:
# syntax=docker/dockerfile:1
FROM alpine
RUN --mount=type=secret,id=github_token \
cat /run/secrets/github_token
In this example, the secret name is github_token
. The following workflow
exposes this secret using the secrets
input:
name: ci
on:
push:
branches:
- "main"
jobs:
docker:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Build
uses: docker/build-push-action@v5
with:
context: .
platforms: linux/amd64,linux/arm64
tags: user/app:latest
secrets: |
"github_token=${{ secrets.GITHUB_TOKEN }}"
Note
You can also expose a secret file to the build with the
secret-files
input:secret-files: | "MY_SECRET=./secret.txt"
If you're using GitHub secretsopen_in_new and need to handle multi-line value, you will need to place the key-value pair between quotes:
secrets: |
"MYSECRET=${{ secrets.GPG_KEY }}"
GIT_AUTH_TOKEN=abcdefghi,jklmno=0123456789
"MYSECRET=aaaaaaaa
bbbbbbb
ccccccccc"
FOO=bar
"EMPTYLINE=aaaa
bbbb
ccc"
"JSON_SECRET={""key1"":""value1"",""key2"":""value2""}"
Key | Value |
---|---|
MYSECRET | *********************** |
GIT_AUTH_TOKEN | abcdefghi,jklmno=0123456789 |
MYSECRET | aaaaaaaa\nbbbbbbb\nccccccccc |
FOO | bar |
EMPTYLINE | aaaa\n\nbbbb\nccc |
JSON_SECRET | {"key1":"value1","key2":"value2"} |
Note
Double escapes are needed for quote signs.