Merge pull request #979 from crazy-max/git-auth-token-domain

buildx(build): handle domain when checking git auth token secret

Author: crazy-max

__tests__/buildx/build.test.ts

@@ -348,10 +348,11 @@ describe('resolveAttestationAttrs', () => {
 describe('hasGitAuthTokenSecret', () => {
   // prettier-ignore
   test.each([
-    [['A_SECRET=abcdef0123456789'], false],
-    [['GIT_AUTH_TOKEN=abcdefghijklmno=0123456789'], true],
-  ])('given %p secret', async (kvp: Array<string>, expected: boolean) => {
-    expect(Build.hasGitAuthTokenSecret(kvp)).toBe(expected);
+    [['A_SECRET=abcdef0123456789'], undefined, false],
+    [['GIT_AUTH_TOKEN=abcdefghijklmno=0123456789'], undefined, true],
+    [['GIT_AUTH_TOKEN.github.com=abcdefghijklmno=0123456789'], 'github.com', true],
+  ])('given %p secret', async (kvp: Array<string>, domain: string | undefined, expected: boolean) => {
+    expect(Build.hasGitAuthTokenSecret(kvp, domain)).toBe(expected);
   });
 });
 

src/buildx/build.ts

@@ -310,9 +310,11 @@ export class Build {
     return res.join(',');
   }
 
-  public static hasGitAuthTokenSecret(secrets: string[]): boolean {
+  public static hasGitAuthTokenSecret(secrets: string[], domain?: string): boolean {
     for (const secret of secrets) {
-      if (secret.startsWith('GIT_AUTH_TOKEN=')) {
+      if (domain && secret.startsWith(`GIT_AUTH_TOKEN.${domain}=`)) {
+        return true;
+      } else if (secret.startsWith('GIT_AUTH_TOKEN=')) {
         return true;
       }
     }