add deprecation notice

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.drone.yml

@@ -1,291 +0,0 @@
----
-kind: pipeline
-name: test
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-  - name: deps
-    image: golang:1.20
-    commands:
-      - make deps
-    volumes:
-      - name: godeps
-        path: /go
-
-  - name: lint
-    image: golang:1.20
-    commands:
-      - make lint
-    volumes:
-      - name: godeps
-        path: /go
-
-  - name: test
-    image: golang:1.20
-    commands:
-      - make test
-    volumes:
-      - name: godeps
-        path: /go
-
-volumes:
-  - name: godeps
-    temp: {}
-
-trigger:
-  ref:
-    - refs/heads/main
-    - refs/tags/**
-    - refs/pull/**
-
----
-kind: pipeline
-name: build-binaries
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-  - name: build
-    image: techknowlogick/xgo:go-1.20.x
-    commands:
-      - ln -s /drone/src /source
-      - make release
-
-  - name: executable
-    image: alpine
-    commands:
-      - $(find dist/ -executable -type f -iname ${DRONE_REPO_NAME}-linux-amd64) --help
-
-  - name: changelog-generate
-    image: thegeeklab/git-chglog
-    commands:
-      - git fetch -tq
-      - git-chglog --no-color --no-emoji -o CHANGELOG.md ${DRONE_TAG:---next-tag unreleased unreleased}
-
-  - name: changelog-format
-    image: thegeeklab/alpine-tools
-    commands:
-      - prettier CHANGELOG.md
-      - prettier -w CHANGELOG.md
-
-  - name: publish
-    image: plugins/github-release
-    settings:
-      api_key:
-        from_secret: github_token
-      files:
-        - dist/*
-      note: CHANGELOG.md
-      overwrite: true
-      title: ${DRONE_TAG}
-    when:
-      ref:
-        - refs/tags/**
-
-trigger:
-  ref:
-    - refs/heads/main
-    - refs/tags/**
-    - refs/pull/**
-
-depends_on:
-  - test
-
----
-kind: pipeline
-name: build-container
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-  - name: dryrun
-    image: thegeeklab/drone-docker-buildx:23
-    settings:
-      dockerfile: Dockerfile.multiarch
-      dry_run: true
-      platforms:
-        - linux/amd64
-        - linux/arm64
-      provenance: false
-      repo: thegeeklab/${DRONE_REPO_NAME}
-    when:
-      ref:
-        - refs/pull/**
-
-  - name: publish-dockerhub
-    image: thegeeklab/drone-docker-buildx:23
-    settings:
-      auto_tag: true
-      dockerfile: Dockerfile.multiarch
-      password:
-        from_secret: docker_password
-      platforms:
-        - linux/amd64
-        - linux/arm64
-      provenance: false
-      repo: thegeeklab/${DRONE_REPO_NAME}
-      username:
-        from_secret: docker_username
-    when:
-      ref:
-        - refs/heads/main
-        - refs/tags/**
-    depends_on:
-      - dryrun
-
-  - name: publish-quay
-    image: thegeeklab/drone-docker-buildx:23
-    settings:
-      auto_tag: true
-      dockerfile: Dockerfile.multiarch
-      password:
-        from_secret: quay_password
-      platforms:
-        - linux/amd64
-        - linux/arm64
-      provenance: false
-      registry: quay.io
-      repo: quay.io/thegeeklab/${DRONE_REPO_NAME}
-      username:
-        from_secret: quay_username
-    when:
-      ref:
-        - refs/heads/main
-        - refs/tags/**
-    depends_on:
-      - dryrun
-
-trigger:
-  ref:
-    - refs/heads/main
-    - refs/tags/**
-    - refs/pull/**
-
-depends_on:
-  - test
-
----
-kind: pipeline
-name: docs
-
-platform:
-  os: linux
-  arch: amd64
-
-concurrency:
-  limit: 1
-
-steps:
-  - name: markdownlint
-    image: thegeeklab/markdownlint-cli
-    commands:
-      - markdownlint 'docs/content/**/*.md' 'README.md' 'CONTRIBUTING.md'
-
-  - name: spellcheck
-    image: thegeeklab/alpine-tools
-    commands:
-      - spellchecker --files '_docs/**/*.md' 'README.md' 'CONTRIBUTING.md' -d .dictionary -p spell indefinite-article syntax-urls --no-suggestions
-    environment:
-      FORCE_COLOR: true
-      NPM_CONFIG_LOGLEVEL: error
-
-  - name: publish
-    image: thegeeklab/drone-git-action
-    settings:
-      action:
-        - pages
-      author_email: bot@thegeeklab.de
-      author_name: thegeeklab-bot
-      branch: docs
-      message: auto-update documentation
-      netrc_password:
-        from_secret: github_token
-      pages_directory: _docs/
-    when:
-      ref:
-        - refs/heads/main
-
-trigger:
-  ref:
-    - refs/heads/main
-    - refs/tags/**
-    - refs/pull/**
-
-depends_on:
-  - build-binaries
-  - build-container
-
----
-kind: pipeline
-name: notifications
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-  - name: pushrm-dockerhub
-    image: chko/docker-pushrm:1
-    environment:
-      DOCKER_PASS:
-        from_secret: docker_password
-      DOCKER_USER:
-        from_secret: docker_username
-      PUSHRM_FILE: README.md
-      PUSHRM_SHORT: Drone plugin to build multiarch Docker images with buildx
-      PUSHRM_TARGET: thegeeklab/${DRONE_REPO_NAME}
-    when:
-      status:
-        - success
-
-  - name: pushrm-quay
-    image: chko/docker-pushrm:1
-    environment:
-      APIKEY__QUAY_IO:
-        from_secret: quay_token
-      PUSHRM_FILE: README.md
-      PUSHRM_TARGET: quay.io/thegeeklab/${DRONE_REPO_NAME}
-    when:
-      status:
-        - success
-
-  - name: matrix
-    image: thegeeklab/drone-matrix
-    settings:
-      homeserver:
-        from_secret: matrix_homeserver
-      password:
-        from_secret: matrix_password
-      roomid:
-        from_secret: matrix_roomid
-      template: "Status: **{{ .Build.Status }}**<br/> Build: [{{ .Repo.Owner }}/{{ .Repo.Name }}]({{ .Build.Link }}){{ if .Build.Branch }} ({{ .Build.Branch }}){{ end }} by {{ .Commit.Author }}<br/> Message: {{ .Commit.Message.Title }}"
-      username:
-        from_secret: matrix_username
-    when:
-      status:
-        - success
-        - failure
-
-trigger:
-  ref:
-    - refs/heads/main
-    - refs/tags/**
-  status:
-    - success
-    - failure
-
-depends_on:
-  - docs
-
----
-kind: signature
-hmac: a62b604d49c98c24360bfaea313f8dba31166133620d5e7656f884e1f20b9ff6
-
-...

.golangci.yml

@@ -16,7 +16,6 @@ linters:
     - containedctx
     - contextcheck
     - decorder
-    - depguard
     - dogsled
     - dupl
     - dupword

CONTRIBUTING.md

@@ -3,7 +3,7 @@
 ## Security
 
 If you think you have found a **security issue**, please do not mention it in this repository.
-Instead, send an email to security@thegeeklab.de with as many details as possible so it can be handled confidential.
+Instead, send an email to `security@thegeeklab.de` with as many details as possible so it can be handled confidential.
 
 ## Bug Reports and Feature Requests
 

Dockerfile.multiarch

@@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM golang:1.20@sha256:80950aa1a7333d8f364880a1e77bbe725d0e8814e47d9c5ceff9428e61995cce as build
+FROM --platform=$BUILDPLATFORM golang:1.20@sha256:741d6f9bcab778441efe05c8e4369d4f8ff56c9a635a97d77f55d8b0ec62f907 as build
 
 ARG TARGETOS
 ARG TARGETARCH
@@ -8,7 +8,7 @@ WORKDIR /src
 
 RUN make build
 
-FROM docker:23.0-dind@sha256:313f03f8946a38f72c45f224efead3b8c6b3a222f83ac323bf7a83e6351044be
+FROM docker:24.0-dind@sha256:020562d22f11c27997e00da910ed6b580d93094bc25841cb87aacab4ced4a882
 
 LABEL maintainer="Robert Kaussow <mail@thegeeklab.de>"
 LABEL org.opencontainers.image.authors="Robert Kaussow <mail@thegeeklab.de>"
@@ -22,7 +22,7 @@ ARG TARGETARCH
 ARG BUILDX_VERSION
 
 # renovate: datasource=github-releases depName=docker/buildx
-ENV BUILDX_VERSION="${BUILDX_VERSION:-v0.10.4}"
+ENV BUILDX_VERSION="${BUILDX_VERSION:-v0.11.2}"
 
 ENV DOCKER_HOST=unix:///var/run/docker.sock
 

Makefile

@@ -1,7 +1,7 @@
 # renovate: datasource=github-releases depName=mvdan/gofumpt
-GOFUMPT_PACKAGE_VERSION := v0.4.0
+GOFUMPT_PACKAGE_VERSION := v0.5.0
 # renovate: datasource=github-releases depName=golangci/golangci-lint
-GOLANGCI_LINT_PACKAGE_VERSION := v1.52.0
+GOLANGCI_LINT_PACKAGE_VERSION := v1.54.2
 
 EXECUTABLE := drone-docker-buildx
 

README.md

@@ -1,6 +1,6 @@
 # drone-docker-buildx
 
-Drone plugin to build multiarch Docker images with buildx
+DISCONTINUED: Drone plugin to build multiarch Docker images with buildx
 
 [![Build Status](https://img.shields.io/drone/build/thegeeklab/drone-docker-buildx?logo=drone&server=https%3A%2F%2Fdrone.thegeeklab.de)](https://drone.thegeeklab.de/thegeeklab/drone-docker-buildx)
 [![Docker Hub](https://img.shields.io/badge/dockerhub-latest-blue.svg?logo=docker&logoColor=white)](https://hub.docker.com/r/thegeeklab/drone-docker-buildx)
@@ -10,6 +10,8 @@ Drone plugin to build multiarch Docker images with buildx
 [![Source: GitHub](https://img.shields.io/badge/source-github-blue.svg?logo=github&logoColor=white)](https://github.com/thegeeklab/drone-docker-buildx)
 [![License: Apache-2.0](https://img.shields.io/github/license/thegeeklab/drone-docker-buildx)](https://github.com/thegeeklab/drone-docker-buildx/blob/main/LICENSE)
 
+> **DISCONTINUED:** As I don't use Drone CI anymore, this project is unmaintained. If you are interested in a free and open source CI system check out [Woodpecker CI](https://woodpecker-ci.org/).
+
 Drone plugin to build multiarch Docker images with buildx. This plugin is a fork of [drone-plugins/drone-docker](https://github.com/drone-plugins/drone-docker). You can find the full documentation at [https://drone-plugin-index.geekdocs.de](https://drone-plugin-index.geekdocs.de/plugins/drone-docker-buildx).
 
 ## Versioning

_docs/content/_index.md

@@ -27,7 +27,7 @@ The tags follow the major version of Docker, e.g. `20`, and the minor and patch
 Be aware that the this plugin requires [privileged](https://docs.drone.io/pipeline/docker/syntax/steps/#privileged-mode) capabilities, otherwise the integrated Docker daemon is not able to start.
 {{< /hint >}}
 
-```YAML
+```yaml
 kind: pipeline
 name: default
 
@@ -58,7 +58,7 @@ If the created image is to be pushed to registries other than the default Docker
 
 **GHCR:**
 
-```YAML
+```yaml
 kind: pipeline
 name: default
 
@@ -76,7 +76,7 @@ steps:
 
 **AWS ECR:**
 
-```YAML
+```yaml
 kind: pipeline
 name: default
 
@@ -99,7 +99,7 @@ steps:
 
 Build the binary with the following command:
 
-```Shell
+```shell
 export GOOS=linux
 export GOARCH=amd64
 export CGO_ENABLED=0
@@ -110,13 +110,13 @@ make build
 
 Build the Docker image with the following command:
 
-```Shell
+```shell
 docker build --file docker/Dockerfile.amd64 --tag thegeeklab/drone-docker-buildx .
 ```
 
 ## Test
 
-```Shell
+```shell
 docker run --rm \
   -e PLUGIN_TAG=latest \
   -e PLUGIN_REPO=octocat/hello-world \

_docs/data/data.yaml

@@ -75,15 +75,16 @@ properties:
     description: |
       Content of the docker buildkit toml [config](https://github.com/moby/buildkit/blob/master/docs/buildkitd.toml.md). Example:
 
-      ```TOML
-      - name: Build
-        image: thegeeklab/drone-docker-buildx:23
-        settings:
-          repo: example/repo
-          buildkit_config: |
-          [registry."registry.local:30081"]
-            http = true
-            insecure = true
+      ```yaml
+      steps:
+        - name: Build
+          image: thegeeklab/drone-docker-buildx:23
+          settings:
+            repo: example/repo
+            buildkit_config: |
+            [registry."registry.local:30081"]
+              http = true
+              insecure = true
       ```
     type: string
     defaultValue: false
@@ -138,7 +139,7 @@ properties:
     required: false
 
   - name: build_args
-    description: Ccustom build arguments to pass to the build.
+    description: Custom build arguments to pass to the build.
     type: list
     required: false
 
@@ -163,15 +164,16 @@ properties:
       Images to consider as [cache sources](https://docs.docker.com/engine/reference/commandline/buildx_build/#cache-from). To properly work,
       commas used in the cache source entries need to be escaped:
 
-      ```Yaml
-      - name: Build
-        image: thegeeklab/drone-docker-buildx:23
-        settings:
-          repo: example/repo
-          cache_from:
-            # using quotes double-escaping is required
-            - "type=registry\\\\,ref=example"
-            - 'type=foo\\,ref=bar'
+      ```yaml
+      steps:
+        - name: Build
+          image: thegeeklab/drone-docker-buildx:23
+          settings:
+            repo: example/repo
+            cache_from:
+              # while using quotes, double-escaping is required
+              - "type=registry\\\\,ref=example"
+              - 'type=foo\\,ref=bar'
       ```
     type: list
     required: false
@@ -265,3 +267,29 @@ properties:
     description: Generate [sbom](https://docs.docker.com/build/attestations/sbom/) attestation for the build (shorthand for `--attest type=sbom`).
     type: string
     required: false
+
+  - name: secrets
+    description: |
+      Exposes [secrets](https://docs.docker.com/engine/reference/commandline/buildx_build/#secret) to the build.
+      The secrets can be used by the build using `RUN --mount=type=secret` mount.
+
+      ```yaml
+      steps:
+        - name: Build
+          image: thegeeklab/drone-docker-buildx:23
+          privileged: true
+          environment:
+            SECURE_TOKEN:
+              from_secret: secure_token
+          settings:
+            secrets:
+              # while using quotes, double-escaping is required
+              - "id=raw_file_secret\\\\,src=file.txt"
+              - 'id=other_raw_file_secret\\,src=other_file.txt'
+              - "id=SECRET_TOKEN"
+      ```
+
+      To use secrets from files a [host volume](https://docs.drone.io/pipeline/docker/syntax/volumes/host/) is required.
+      This should be used with caution and avoided whenever possible.
+    type: list
+    required: false

cmd/drone-docker-buildx/config.go

@@ -321,5 +321,12 @@ func settingsFlags(settings *plugin.Settings, category string) []cli.Flag {
 			Destination: &settings.Build.SBOM,
 			Category:    category,
 		},
+		&cli.GenericFlag{
+			Name:     "secrets",
+			EnvVars:  []string{"PLUGIN_SECRETS"},
+			Usage:    "exposes secrets to the build",
+			Value:    &drone.StringSliceFlag{},
+			Category: category,
+		},
 	}
 }

cmd/drone-docker-buildx/main.go

@@ -57,6 +57,13 @@ func run(settings *plugin.Settings) cli.ActionFunc {
 
 		settings.Build.CacheFrom = cacheFrom.Get()
 
+		secrets, ok := ctx.Generic("secrets").(*drone.StringSliceFlag)
+		if !ok {
+			return fmt.Errorf("%w: failed to read secrets input", ErrTypeAssertionFailed)
+		}
+
+		settings.Build.Secrets = secrets.Get()
+
 		plugin := plugin.New(
 			*settings,
 			urfave.PipelineFromContext(ctx),

go.mod

@@ -5,10 +5,10 @@ go 1.20
 require (
 	github.com/coreos/go-semver v0.3.1
 	github.com/joho/godotenv v1.5.1
-	github.com/sirupsen/logrus v1.9.0
-	github.com/thegeeklab/drone-plugin-lib/v2 v2.3.1
-	github.com/urfave/cli/v2 v2.25.0
-	golang.org/x/sys v0.6.0
+	github.com/sirupsen/logrus v1.9.3
+	github.com/thegeeklab/drone-plugin-lib/v2 v2.3.4
+	github.com/urfave/cli/v2 v2.25.5
+	golang.org/x/sys v0.11.0
 )
 
 require (

go.sum

@@ -11,20 +11,20 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
-github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/thegeeklab/drone-plugin-lib/v2 v2.3.1 h1:+tbq9I0XwfK38SOWV3rATPdVt4W/KBXDg1ebmFOjCjw=
-github.com/thegeeklab/drone-plugin-lib/v2 v2.3.1/go.mod h1:NDOZW0eQz7cXeaWeqVS5lzxrUgxrN/TD2KBjS4fMJLk=
-github.com/urfave/cli/v2 v2.25.0 h1:ykdZKuQey2zq0yin/l7JOm9Mh+pg72ngYMeB0ABn6q8=
-github.com/urfave/cli/v2 v2.25.0/go.mod h1:GHupkWPMM0M/sj1a2b4wUrWBPzazNrIjouW6fmdJLxc=
+github.com/thegeeklab/drone-plugin-lib/v2 v2.3.4 h1:Quzrike/xRAR0izxQ0d+ocJyIUm4h1497Oyo9grcRzg=
+github.com/thegeeklab/drone-plugin-lib/v2 v2.3.4/go.mod h1:qWVUZCmwL0Ntwa/hvyqM03EeIr1ReBR2XJsmIc7MGus=
+github.com/urfave/cli/v2 v2.25.5 h1:d0NIAyhh5shGscroL7ek/Ya9QYQE0KNabJgiUinIQkc=
+github.com/urfave/cli/v2 v2.25.5/go.mod h1:GHupkWPMM0M/sj1a2b4wUrWBPzazNrIjouW6fmdJLxc=
 github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 h1:bAn7/zixMGCfxrRTfdpNzjtPYqr8smhKouy9mxVdGPU=
 github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673/go.mod h1:N3UwUGtsrSj3ccvlPHLoLsHnpR27oXr4ZE984MbSER8=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.11.0 h1:eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM=
+golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

plugin/docker.go

@@ -160,6 +160,10 @@ func commandBuild(build Build, dryrun bool) *execabs.Cmd {
 		args = append(args, "--sbom", build.SBOM)
 	}
 
+	for _, secret := range build.Secrets {
+		args = append(args, "--secret", secret)
+	}
+
 	return execabs.Command(dockerBin, args...)
 }
 

plugin/impl.go

@@ -65,6 +65,7 @@ type Build struct {
 	Labels       cli.StringSlice // Docker build labels
 	Provenance   string          // Docker build provenance attestation
 	SBOM         string          // Docker build sbom attestation
+	Secrets      []string        // Docker build secrets
 }
 
 // Settings for the Plugin.

renovate.json

@@ -1,4 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["github>thegeeklab/renovate-presets:golang"]
-}