Making network connectivity more resiliant and getting the secrets more secure.

Signed-off-by: Cliff Hill <xlorep@darkhelm.org>

.gitea/workflows/cicd.yml

@@ -18,7 +18,7 @@ jobs:
         run: |
           echo "=== Minimal Repository Checkout for Dockerfile ==="
 
-          # Set up SSH key
+          # Set up SSH key securely (temporary file approach)
           if [ -n "${SSH_PRIVATE_KEY}" ]; then
             mkdir -p ~/.ssh
             echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa
@@ -31,10 +31,13 @@ jobs:
             git clone --depth 1 --no-checkout \
             ssh://git@dogar.darkhelm.org:2222/DarkHelm.org/plex-playlist.git .
 
-          # Checkout only the Dockerfile
-          git checkout HEAD -- Dockerfile.cicd
+          # Checkout only the Dockerfile and dockerignore
+          git checkout HEAD -- Dockerfile.cicd .dockerignore
 
-          echo "✓ Dockerfile.cicd ready for build"
+          # Clean up SSH key for security
+          rm -f ~/.ssh/id_rsa
+
+          echo "✓ Dockerfile.cicd ready for secure build"
 
       - name: Build and push CICD image
         env:
@@ -42,15 +45,25 @@ jobs:
           SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
           GITHUB_SHA: ${{ github.sha }}
         run: |
-          echo "=== Building CICD Image ==="
+          echo "=== Building CICD Image with Secure Secrets ==="
 
-          # Build CICD image with all tools, code, and dependencies
-          # Pass SSH key as build arg so Dockerfile can checkout repo
+          # Create temporary SSH key file for BuildKit secrets
+          echo "${SSH_PRIVATE_KEY}" > /tmp/ssh_key
+          chmod 600 /tmp/ssh_key
+
+          # Enable Docker BuildKit for secrets support
+          export DOCKER_BUILDKIT=1
+
+          # Build CICD image using secure BuildKit secrets
+          # SSH key is mounted securely and never stored in image layers
           docker build -f Dockerfile.cicd \
-            --build-arg SSH_PRIVATE_KEY="$SSH_PRIVATE_KEY" \
+            --secret id=ssh_private_key,src=/tmp/ssh_key \
             --build-arg GITHUB_SHA="$GITHUB_SHA" \
             -t cicd:latest .
 
+          # Clean up temporary SSH key file
+          rm -f /tmp/ssh_key
+
           # Tag for Gitea container registry
           docker tag cicd:latest dogar.darkhelm.org/darkhelm.org/plex-playlist/cicd:latest
           docker tag cicd:latest dogar.darkhelm.org/darkhelm.org/plex-playlist/cicd:${GITHUB_SHA:-latest}