feat: add the possibility to pass secrets to the docker build

Author: lukashankeln

.github/workflows/build-multiarch.yml

@@ -51,6 +51,11 @@ on:
         required: false
         default: ''
         type: string
+      build_secrets:
+        description: 'Docker build secrets (multiline id=value). Passed to all arch builds.'
+        required: false
+        default: ''
+        type: string
       push_latest:
         description: 'Push a :latest tag when building from the main branch'
         required: false
@@ -126,6 +131,7 @@ jobs:
             VERSION=${{ inputs.version }}
             ${{ inputs.build_args }}
             ${{ inputs.build_args_amd64 }}
+          secrets: ${{ inputs.build_secrets }}
 
   build-arm64:
     if: contains(inputs.architectures, 'arm64')
@@ -172,6 +178,7 @@ jobs:
             VERSION=${{ inputs.version }}
             ${{ inputs.build_args }}
             ${{ inputs.build_args_arm64 }}
+          secrets: ${{ inputs.build_secrets }}
 
   build-armv7:
     # Cross-compile on amd64 — much faster than QEMU emulation on a native armv7 runner
@@ -222,6 +229,7 @@ jobs:
             VERSION=${{ inputs.version }}
             ${{ inputs.build_args }}
             ${{ inputs.build_args_armv7 }}
+          secrets: ${{ inputs.build_secrets }}
 
   # ============================================================================
   # Create multi-arch manifest combining all successfully built arch images

README.md

@@ -34,6 +34,7 @@ Either `RELEASE_TOKEN` or both App secrets must be set.
 | `default_version` | `'dev'` | Fallback version when no release is created |
 | `dry_run` | `false` | Run semantic-release without creating a tag or release |
 | `ref` | `''` | Git ref to checkout (defaults to the triggering ref) |
+| `runner` | `'self-hosted'` | Runner label for the prepare job |
 
 #### Outputs
 
@@ -80,6 +81,7 @@ Builds a Docker image natively on amd64 and arm64 runners, cross-compiles armv7
 | `build_args_amd64` | no | `''` | Extra build args for the amd64 job only |
 | `build_args_arm64` | no | `''` | Extra build args for the arm64 job only |
 | `build_args_armv7` | no | `''` | Extra build args for the armv7 job only |
+| `build_secrets` | no | `''` | Docker build secrets (multiline `id=value`) passed to all arch builds |
 | `push_latest` | no | `true` | Push a `:latest` tag alongside the version tag |
 | `runner_amd64` | no | `arc-runner-set-amd64` | Runner label for amd64 native builds |
 | `runner_arm64` | no | `arc-runner-set-arm64` | Runner label for arm64 native builds |
@@ -110,4 +112,6 @@ build:
       BASE_IMAGE=ghcr.io/myorg/base:latest-arm64
     build_args_armv7: |
       BASE_IMAGE=ghcr.io/myorg/base:latest-armv7
+    build_secrets: |
+      MY_SECRET=${{ secrets.MY_SECRET }}
 ```