Make all secrets available to all commands (#141)

* add all secrets to all commands

* update docs

* fix secrets test

* update snapshot tests

buildkit/build_llb/build_graph.go

@@ -247,14 +247,15 @@ func (g *BuildGraph) convertExecCommandToLLB(node *StepNode, cmd plan.ExecComman
 		opts = append(opts, llb.WithCustomName(cmd.CustomName))
 	}
 
-	if len(node.Step.Secrets) > 0 {
-		// These options mount all secrets as environments variables
-		secretOpts := []llb.RunOption{}
-		for _, secret := range g.Plan.Secrets {
-			secretOpts = append(secretOpts, llb.AddSecret(secret, llb.SecretID(secret), llb.SecretAsEnv(true), llb.SecretAsEnvName(secret)))
-		}
-		opts = append(opts, secretOpts...)
+	// These options mount all secrets as environments variables
+	// We want to add all secrets to all commands, even if they are not specified in the step
+	secretOpts := []llb.RunOption{}
+	for _, secret := range g.Plan.Secrets {
+		secretOpts = append(secretOpts, llb.AddSecret(secret, llb.SecretID(secret), llb.SecretAsEnv(true), llb.SecretAsEnvName(secret)))
+	}
+	opts = append(opts, secretOpts...)
 
+	if len(node.Step.Secrets) > 0 {
 		if g.secretsFile != nil {
 			// These options mount the secrets hash file to the FS so that we can invalidate the cache if the secrets change
 			secretInvalidationMountOpts := g.getSecretInvalidationMountOptions(node, secretOpts)

core/__snapshots__/TestGenerateBuildPlanForExamples_secrets_1.snap.json

@@ -10,12 +10,6 @@
     ],
     "step": "defaultsToUsing"
    },
-   {
-    "include": [
-     "."
-    ],
-    "step": "doesNotUseSecrets"
-   },
    {
     "include": [
      "."
@@ -63,24 +57,6 @@
     "NOT_SECRET": "not secret"
    }
   },
-  {
-   "commands": [
-    {
-     "dest": ".",
-     "src": "."
-    },
-    {
-     "cmd": "sh -c './run.sh true'",
-     "customName": "./run.sh true"
-    }
-   ],
-   "inputs": [
-    {
-     "step": "packages:mise"
-    }
-   ],
-   "name": "doesNotUseSecrets"
-  },
   {
    "commands": [
     {

docs/src/content/docs/architecture/secrets.md

@@ -45,8 +45,11 @@ Environment variables can be set in two ways:
 ## Secrets
 
 The names of all secrets that should be used during the build are added to the
-top of the build plan. Each step that needs access to secrets must include them
-in its `secrets` field.
+top of the build plan, and each step's `secrets` array specifies which secrets
+should invalidate that step's layer cache when their values change. While all
+secrets are available to every command as environment variables, only the ones
+listed in a step's `secrets` array will trigger a cache invalidation if
+modified.
 
 Under the hood, Railpack uses [BuildKit secrets
 mounts](https://docs.docker.com/build/building/secrets/) to supply an exec

examples/secrets/railpack.json

@@ -17,11 +17,6 @@
       "variables": {
         "NOT_SECRET": "not secret"
       }
-    },
-
-    "doesNotUseSecrets": {
-      "commands": [{ "src": ".", "dest": "." }, "./run.sh true"],
-      "secrets": []
     }
   },
 

examples/secrets/run.sh

@@ -1,10 +1,5 @@
 #!/bin/bash
 
-# cache bust 1
-
-# Check if argument is provided and if it equals "true"
-INVERT_BEHAVIOR=${1:-false}
-
 # List of required secrets
 REQUIRED_SECRETS=(
   "MY_SECRET"
@@ -22,39 +17,25 @@ echo "Checking for required secrets..."
 for secret in "${REQUIRED_SECRETS[@]}"; do
   if [ -z "${!secret}" ]; then
     missing_secrets+=("$secret")
-    if [ "$INVERT_BEHAVIOR" = "true" ]; then
-      echo "✅ Secret not defined (as required): $secret"
-    else
-      echo "❌ Missing secret: $secret"
-    fi
+    echo "❌ Missing secret: $secret"
   else
     defined_secrets+=("$secret")
     # Check if the secret value contains "error"
     if [ "${!secret}" = "error" ]; then
       error_value_secrets+=("$secret")
       echo "❌ Secret $secret contains invalid value 'error'"
-    elif [ "$INVERT_BEHAVIOR" = "true" ]; then
-      echo "❌ Found secret when it should be undefined: $secret"
     else
       echo "✅ Found secret: $secret = ${!secret}"
     fi
   fi
 done
 
-if [ "$INVERT_BEHAVIOR" = "true" ]; then
-  if [ ${#defined_secrets[@]} -ne 0 ]; then
-    echo "Error: Found ${#defined_secrets[@]} secrets when none should be defined"
-    exit 1
-  fi
-  echo "Success: No secrets are defined (as required)"
-else
-  if [ ${#missing_secrets[@]} -ne 0 ]; then
-    echo "Error: Missing ${#missing_secrets[@]} required secrets"
-    exit 1
-  fi
-  if [ ${#error_value_secrets[@]} -ne 0 ]; then
-    echo "Error: ${#error_value_secrets[@]} secrets contain the invalid value 'error'"
-    exit 1
-  fi
-  echo "Success: All required secrets are available and valid"
+if [ ${#missing_secrets[@]} -ne 0 ]; then
+  echo "Error: Missing ${#missing_secrets[@]} required secrets"
+  exit 1
 fi
+if [ ${#error_value_secrets[@]} -ne 0 ]; then
+  echo "Error: ${#error_value_secrets[@]} secrets contain the invalid value 'error'"
+  exit 1
+fi
+echo "Success: All required secrets are available and valid"