Pull request: AGDNS-4244-use-docker-secrets

Squashed commit of the following:

commit 2d2f3ee81c7027dd20017b272a230f8e51c5fa39
Merge: 3c7d59e64 2961664cb
Author: Dimitry Kolyshev <[email protected]>
Date:   Mon Jul 20 10:11:54 2026 +0700

    Merge branch 'master'

commit 3c7d59e646f268ee91f8008756b037dfdc40730a
Author: Dimitry Kolyshev <[email protected]>
Date:   Mon Jul 20 09:57:34 2026 +0700

    ci: imp code

commit a30b98321d7db36df5845e070c2294195bdd59b2
Author: Dimitry Kolyshev <[email protected]>
Date:   Fri Jul 17 11:54:20 2026 +0700

    ci: set xtrace

commit 4488c134aa892f9fa082dddb08efce6640d4d8db
Author: Dimitry Kolyshev <[email protected]>
Date:   Fri Jul 17 11:28:51 2026 +0700

    ci: imp code

commit d20d853eb9cd2826a145a2894c6b303c64be1c4a
Author: Dimitry Kolyshev <[email protected]>
Date:   Thu Jul 16 08:56:15 2026 +0700

    ci: use docker secrets

bamboo-specs/release.yaml

@@ -113,21 +113,29 @@
 
                 docker info
 
+                # Disable xtrace so the expanded secret values aren't printed to
+                # the build log.
+                set +x
+                export GPG_KEY_PASSPHRASE="${bamboo_gpgPassword}"
+                export GPG_SECRET_KEY="${bamboo_gpgSecretKeyPart1}${bamboo_gpgSecretKeyPart2}"
+                export SIGNER_API_KEY="${bamboo_adguardHomeWinSignerSecretApiKey}"
+                set -x
+
                 docker build \
                     --build-arg "BASE_IMAGE=${bamboo_dockerGo}" \
                     --build-arg "BRANCH=${bamboo_planRepository_branchName}" \
                     --build-arg "CACHE_BUSTER=${bamboo_cacheBuster}" \
                     --build-arg "CHANNEL=${bamboo_channel}" \
                     --build-arg "DEPLOY_SCRIPT_PATH=./bamboo-deploy-publisher/deploy.sh" \
-                    --build-arg "GPG_SECRET_KEY=${bamboo_gpgSecretKeyPart1}${bamboo_gpgSecretKeyPart2}" \
-                    --build-arg "GPG_KEY_PASSPHRASE=${bamboo_gpgPassword}" \
                     --build-arg "REVISION=${bamboo_repository_revision_number}" \
                     --build-arg "SIGN=1" \
-                    --build-arg "SIGNER_API_KEY=${bamboo_adguardHomeWinSignerSecretApiKey}" \
                     --build-arg "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" \
                     --build-arg "VERSION=$version" \
                     --output '.' \
                     --progress 'plain' \
+                    --secret id=GPG_KEY_PASSPHRASE \
+                    --secret id=GPG_SECRET_KEY \
+                    --secret id=SIGNER_API_KEY \
                     --target 'builder-exporter' \
                     -f ./docker/ci.Dockerfile \
                     .

bamboo-specs/snapcraft.yaml

@@ -98,14 +98,20 @@
 
                 docker info
 
+                # Disable xtrace so the expanded secret values aren't printed to
+                # the build log.
+                set +x
+                export SNAPCRAFT_STORE_CREDENTIALS="${bamboo_snapcraftMacaroonPassword}"
+                set -x
+
                 docker build \
                     --build-arg "BASE_IMAGE=${bamboo_dockerSnap}" \
                     --build-arg "CACHE_BUSTER=${bamboo_cacheBuster}" \
                     --build-arg "SNAPCRAFT_CHANNEL=${bamboo_snapcraftChannel}" \
-                    --build-arg "SNAPCRAFT_STORE_CREDENTIALS=${bamboo_snapcraftMacaroonPassword}" \
                     --build-arg "VERSION=${bamboo_buildNumber}" \
                     --output '.' \
                     --progress 'plain' \
+                    --secret id=SNAPCRAFT_STORE_CREDENTIALS \
                     --target 'publisher' \
                     -f ./docker/snapcraft.Dockerfile \
                     .

docker/ci.Dockerfile

@@ -153,12 +153,9 @@ ARG BRANCH=master
 ARG CACHE_BUSTER=0
 ARG CHANNEL=development
 ARG DEPLOY_SCRIPT_PATH=not/a/real/path
-ARG GPG_KEY_PASSPHRASE=not-a-real-passphrase
-ARG GPG_SECRET_KEY=""
 ARG OS=""
 ARG REVISION=0000000000000000000000000000000000000000
 ARG SIGN=0
-ARG SIGNER_API_KEY=not-a-real-key
 ARG SOURCE_DATE_EPOCH=0
 ARG VERSION=""
 ADD . /app
@@ -166,6 +163,9 @@ WORKDIR /app
 RUN \
 	--mount=type=cache,id=gocache,target=/root/.cache/go-build \
 	--mount=type=cache,id=gopath,target=/go \
+	--mount=type=secret,id=GPG_KEY_PASSPHRASE,env=GPG_KEY_PASSPHRASE \
+	--mount=type=secret,id=GPG_SECRET_KEY,env=GPG_SECRET_KEY \
+	--mount=type=secret,id=SIGNER_API_KEY,env=SIGNER_API_KEY \
 <<-'EOF'
 set -e -f -u -x
 

docker/snapcraft.Dockerfile

@@ -67,7 +67,6 @@ COPY --from=builder /app/AdGuardHome_i386.snap /AdGuardHome_i386.snap
 FROM "$BASE_IMAGE" AS publisher
 ARG CACHE_BUSTER=0
 ARG SNAPCRAFT_CHANNEL=0
-ARG SNAPCRAFT_STORE_CREDENTIALS=0
 ARG VERSION=""
 ADD snap /app/snap
 ADD scripts /app/scripts
@@ -77,12 +76,12 @@ ADD AdGuardHome_armhf.snap /app/AdGuardHome_armhf.snap
 ADD AdGuardHome_i386.snap /app/AdGuardHome_i386.snap
 WORKDIR /app
 RUN \
+    --mount=type=secret,id=SNAPCRAFT_STORE_CREDENTIALS,env=SNAPCRAFT_STORE_CREDENTIALS \
 <<-'EOF'
 set -e -f -u -x
 
 env \
 	SNAPCRAFT_CHANNEL="${SNAPCRAFT_CHANNEL}" \
-	SNAPCRAFT_STORE_CREDENTIALS="${SNAPCRAFT_STORE_CREDENTIALS}" \
 	VERBOSE='1' \
 	sh ./scripts/snap/upload.sh
 EOF