add passing secrets to docker build

.gitea/workflows/docker-publish.yml

@@ -18,6 +18,13 @@ on:
       scan_severity:
         type: string
         default: "HIGH,CRITICAL"
+      use_private_index:
+        # pass the private Gitea PyPI index into the build as a BuildKit secret, for images
+        # whose Dockerfile installs the in-house BB* packages. The Dockerfile must consume it
+        # via `RUN --mount=type=secret,id=pip_extra_index`, never as an ARG or ENV, so the
+        # token is not baked into an image layer.
+        type: boolean
+        default: false
     secrets:
       REGISTRY_USERNAME: { required: true }
       REGISTRY_PASSWORD: { required: true }
@@ -25,6 +32,7 @@ on:
       NTFY_TOPIC: { required: true }
       NTFY_TOKEN: { required: true }
       NTFY_SERVER: { required: true }
+      PIP_EXTRA_INDEX_URL: { required: false }
 
 jobs:
   publish:
@@ -63,11 +71,27 @@ jobs:
           echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${{ secrets.DOCKER_REGISTRY }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
 
       - name: Build image
+        shell: bash
+        env:
+          PIP_EXTRA_INDEX_URL: ${{ secrets.PIP_EXTRA_INDEX_URL }}
         run: |
+          set -euo pipefail
           SHA_SHORT="$(git rev-parse --short HEAD)"
           FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}"
 
-          docker build \
+          # optionally hand the private package index to the build as a BuildKit secret so the
+          # Dockerfile can install the in-house BB* packages without the token entering a layer
+          SECRET_ARGS=""
+          if [ "${{ inputs.use_private_index }}" = "true" ]; then
+            if [ -z "${PIP_EXTRA_INDEX_URL:-}" ]; then
+              echo "use_private_index=true but the PIP_EXTRA_INDEX_URL secret is empty or not set"
+              exit 1
+            fi
+            SECRET_ARGS="--secret id=pip_extra_index,env=PIP_EXTRA_INDEX_URL"
+          fi
+
+          DOCKER_BUILDKIT=1 docker build \
+            ${SECRET_ARGS} \
             -t "${FULL_IMAGE}:${SHA_SHORT}" \
             ${{ inputs.dockerfile_path }}