astronomer / astro-cli / 29999532441

44%

push

github

Multiple build secrets (#2212)

Allow specifying multiple build secrets, using the CLI (`--build-secret`), dev config, or the `BUILD_SECRET_INPUT` env var.

The existing `--build-secrets` flag, despite its name, didn't actually allow passing multiple build secrets to Docker. It was parsed with `StringSliceVar`, meaning that literal build secret strings such as `id=aws,env=AWS_SECRET_ACCESS_KEY` would be split into two strings (`id=aws`, `env=AWS_SECRET_ACCESS_KEY`) and then rejoined into a single string that was ultimately passed as one `docker build --secret` argument.

Docker parses that as a single secret spec in which later fields override earlier ones, so providing more than one secret silently mounted only the last one.

As it was presumably originally intended that you could provide multiple secrets, this commit makes the following changes:

- Mark `--build-secrets` as deprecated. It can still be provided but will warn on use.
- Add `--build-secret`, which allows specifying a single secret, e.g. `id=aws,env=AWS_SECRET_ACCESS_KEY`, but can be provided multiple times.
- Pass all provided `--build-secret` values through to Docker.
- Dev config overrides as well as the `BUILD_SECRET_INPUT` env var can now contain newline-delimited strings to carry multiple build secrets. This is backwards compatible: a newline can't occur inside a valid secret specification, and a multiline value previously produced a single `--secret` argument that docker rejected, so no working configuration changes meaning.

Note: Comma-delimiting multiple secrets inside a single flag value (e.g. `id=a,src=x,id=b,env=Y`) is intentionally not supported: the comma already separates fields within one docker secret spec, so it cannot unambiguously separate specs too.

126 of 155 new or added lines in 12 files covered. (81.29%)

25897 of 59014 relevant lines covered (43.88%)

8.64 hits per line