48 lines
1.3 KiB
Bash
48 lines
1.3 KiB
Bash
|
#!/bin/bash
|
||
|
|
# Secure Docker build script using BuildKit secrets
|
||
|
|
# Usage: ./scripts/build-cicd-secure.sh [image-tag]
|
||
|
|
|
||
|
|
set -e
|
||
|
|
|
||
|
|
# Default image tag
|
||
|
|
IMAGE_TAG="${1:-plex-playlist-cicd:latest}"
|
||
|
|
|
||
|
|
# Check if SSH key exists
|
||
|
|
SSH_KEY_PATH="${SSH_KEY_PATH:-$HOME/.ssh/id_rsa}"
|
||
|
|
if [ ! -f "$SSH_KEY_PATH" ]; then
|
||
|
|
echo "Error: SSH private key not found at $SSH_KEY_PATH"
|
||
|
|
echo "Set SSH_KEY_PATH environment variable or ensure key exists at default location"
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo "Building Docker image with secure secrets handling..."
|
||
|
|
echo "Image tag: $IMAGE_TAG"
|
||
|
|
echo "SSH key: $SSH_KEY_PATH"
|
||
|
|
|
||
|
|
# Enable Docker BuildKit (required for --secret)
|
||
|
|
export DOCKER_BUILDKIT=1
|
||
|
|
|
||
|
|
# Build with secrets mount - SSH key never enters image layers
|
||
|
|
docker build \
|
||
|
|
--secret id=ssh_private_key,src="$SSH_KEY_PATH" \
|
||
|
|
--build-arg GITHUB_SHA="${GITHUB_SHA:-}" \
|
||
|
|
--file Dockerfile.cicd \
|
||
|
|
--tag "$IMAGE_TAG" \
|
||
|
|
.
|
||
|
|
|
||
|
|
echo "✅ Build completed successfully!"
|
||
|
|
echo "Run with: docker run -it $IMAGE_TAG"
|
||
|
|
|
||
|
|
# Optional: Test the image
|
||
|
|
if [ "${TEST_IMAGE:-}" = "true" ]; then
|
||
|
|
echo "🧪 Testing image..."
|
||
|
|
docker run --rm "$IMAGE_TAG" bash -c "
|
||
|
|
echo 'Testing tools...' &&
|
||
|
|
python3 --version &&
|
||
|
|
node --version &&
|
||
|
|
yarn --version &&
|
||
|
|
git --version &&
|
||
|
|
echo '✅ All tools working!'
|
||
|
|
"
|
||
|
|
fi
|