add passing secrets to docker build

.gitea/workflows/docker-publish.yml

@@ -18,6 +18,13 @@ on:
       scan_severity:
         type: string
         default: "HIGH,CRITICAL"
+      use_private_index:
+        # pass the private Gitea PyPI index into the build as a BuildKit secret, for images
+        # whose Dockerfile installs the in-house BB* packages. The Dockerfile must consume it
+        # via `RUN --mount=type=secret,id=pip_extra_index`, never as an ARG or ENV, so the
+        # token is not baked into an image layer.
+        type: boolean
+        default: false
     secrets:
       REGISTRY_USERNAME: { required: true }
       REGISTRY_PASSWORD: { required: true }
@@ -25,6 +32,7 @@ on:
       NTFY_TOPIC: { required: true }
       NTFY_TOKEN: { required: true }
       NTFY_SERVER: { required: true }
+      PIP_EXTRA_INDEX_URL: { required: false }
 
 jobs:
   publish:
@@ -63,11 +71,27 @@ jobs:
           echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${{ secrets.DOCKER_REGISTRY }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
 
       - name: Build image
+        shell: bash
+        env:
+          PIP_EXTRA_INDEX_URL: ${{ secrets.PIP_EXTRA_INDEX_URL }}
         run: |
+          set -euo pipefail
           SHA_SHORT="$(git rev-parse --short HEAD)"
           FULL_IMAGE="${{ secrets.DOCKER_REGISTRY }}/${{ inputs.image_name }}"
 
-          docker build \
+          # optionally hand the private package index to the build as a BuildKit secret so the
+          # Dockerfile can install the in-house BB* packages without the token entering a layer
+          SECRET_ARGS=""
+          if [ "${{ inputs.use_private_index }}" = "true" ]; then
+            if [ -z "${PIP_EXTRA_INDEX_URL:-}" ]; then
+              echo "use_private_index=true but the PIP_EXTRA_INDEX_URL secret is empty or not set"
+              exit 1
+            fi
+            SECRET_ARGS="--secret id=pip_extra_index,env=PIP_EXTRA_INDEX_URL"
+          fi
+
+          DOCKER_BUILDKIT=1 docker build \
+            ${SECRET_ARGS} \
             -t "${FULL_IMAGE}:${SHA_SHORT}" \
             ${{ inputs.dockerfile_path }}
 

.gitea/workflows/python-package-publish.yml

@@ -0,0 +1,93 @@
+name: Reusable Python Package Publish
+
+# Builds a Python package with `python -m build` and uploads it to the Gitea PyPI registry with
+# twine. Intended to run only on version tags (v*), alongside python-checks, so a package is
+# never published without its tests passing.
+#
+# The caller gates this job on python-checks and on the tag ref, the same way docker-publish is
+# gated. The job itself additionally refuses to publish when the git tag does not match the
+# version declared in pyproject.toml, so a mistyped tag cannot ship the wrong version.
+
+on:
+  workflow_call:
+    inputs:
+      package_name:
+        # informational, used only in log output
+        required: true
+        type: string
+      use_private_index:
+        # build backends that need the in-house BB* packages to resolve build dependencies
+        type: boolean
+        default: false
+    secrets:
+      REGISTRY_USERNAME: { required: true }
+      REGISTRY_PASSWORD: { required: true }
+      PYPI_UPLOAD_URL: { required: true }
+      PYPI_UPLOAD_USER: { required: true }
+      PYPI_UPLOAD_PASSWORD: { required: true }
+
+jobs:
+  publish:
+    runs-on: docker
+    container:
+      image: gitea.tech-buddy.at/bitbuddydev/gitea_runner_python314:dev-bda315b82bb23d83065b77d91fedf0e20d9accf1
+      credentials:
+        username: ${{ secrets.REGISTRY_USERNAME }}
+        password: ${{ secrets.REGISTRY_PASSWORD }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure private package index
+        if: ${{ inputs.use_private_index }}
+        env:
+          PRIVATE_INDEX_URL: ${{ secrets.PIP_EXTRA_INDEX_URL }}
+        run: |
+          if [ -z "$PRIVATE_INDEX_URL" ]; then
+            echo "use_private_index=true but the PIP_EXTRA_INDEX_URL secret is empty or not set"
+            exit 1
+          fi
+          pip config --site set global.extra-index-url "$PRIVATE_INDEX_URL"
+
+      - name: Verify the tag matches the package version
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if ! echo "${{ gitea.ref }}" | grep -q '^refs/tags/v'; then
+            echo "This workflow only publishes on version tags (refs/tags/v*), got '${{ gitea.ref }}'"
+            exit 1
+          fi
+
+          TAG_VERSION="${{ gitea.ref_name }}"
+          TAG_VERSION="${TAG_VERSION#v}"
+          PROJECT_VERSION="$(python -c "import tomllib;print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")"
+
+          echo "tag version     : ${TAG_VERSION}"
+          echo "pyproject version: ${PROJECT_VERSION}"
+
+          if [ "${TAG_VERSION}" != "${PROJECT_VERSION}" ]; then
+            echo "Tag v${TAG_VERSION} does not match the version ${PROJECT_VERSION} in pyproject.toml"
+            echo "Bump the version in pyproject.toml and retag, so the published artifact matches the tag."
+            exit 1
+          fi
+
+      - name: Build the package
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m pip install --upgrade pip build twine
+          python -m build
+          echo "=== built artifacts for ${{ inputs.package_name }} ==="
+          ls -1 dist
+
+      - name: Check the artifacts
+        run: python -m twine check dist/*
+
+      - name: Upload to the package registry
+        env:
+          TWINE_USERNAME: ${{ secrets.PYPI_UPLOAD_USER }}
+          TWINE_PASSWORD: ${{ secrets.PYPI_UPLOAD_PASSWORD }}
+        run: |
+          python -m twine upload --repository-url "${{ secrets.PYPI_UPLOAD_URL }}" dist/*