The frozen matrix docker-release.yml@pre-stevedore has a private-modules: true input that mints a short-lived pinpredict-argocd App token and mounts it as BuildKit secret id=gh_token, for Dockerfiles that fetch a private pinpredict module (e.g. unvendored github.com/pinpredict/ppkit) — see the action's original design.
The stevedore docker-release.yml on @main (#40) dropped that input. covenant is the one migration-pending repo that uses private-modules: true (ppkit consumer), so it can't cut over until the stevedore workflow restores an equivalent.
Options
- Add a
private-modules boolean input to the stevedore docker-release.yml: when true, run actions/create-github-app-token and export the token to an env var; stevedore's .stevedore.yaml already supports a secrets: block ({id: gh_token, env: GH_TOKEN}) that mounts it as a BuildKit --secret. So the workflow mints + exports, and covenant's config opts in per image. This is the clean path — the secrets plumbing already exists in stevedore (verified in the schema).
- covenant's
.stevedore.yaml (already merged, covenant#48) would add the secrets: entry to its image in the cutover PR.
Until then covenant stays on @pre-stevedore. All other repos cut over without this.
The frozen matrix
docker-release.yml@pre-stevedorehas aprivate-modules: trueinput that mints a short-livedpinpredict-argocdApp token and mounts it as BuildKit secretid=gh_token, for Dockerfiles that fetch a private pinpredict module (e.g. unvendoredgithub.com/pinpredict/ppkit) — see the action's original design.The stevedore
docker-release.ymlon@main(#40) dropped that input. covenant is the one migration-pending repo that usesprivate-modules: true(ppkit consumer), so it can't cut over until the stevedore workflow restores an equivalent.Options
private-modulesboolean input to the stevedoredocker-release.yml: when true, runactions/create-github-app-tokenand export the token to an env var; stevedore's.stevedore.yamlalready supports asecrets:block ({id: gh_token, env: GH_TOKEN}) that mounts it as a BuildKit--secret. So the workflow mints + exports, and covenant's config opts in per image. This is the clean path — the secrets plumbing already exists in stevedore (verified in the schema)..stevedore.yaml(already merged, covenant#48) would add thesecrets:entry to its image in the cutover PR.Until then covenant stays on
@pre-stevedore. All other repos cut over without this.