Secrets support

[crazy-max]

User can't currently pass secrets to their build like in build-push-action and bake-action.

This should be supported but dynamic secrets are not supported by reusable workflows atm: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#onworkflow_callsecrets

Maybe we could something similar to registry-auths secret with a YAML object but might not work for multiline secrets 😣

[NoahR-ATC]

User can't currently pass secrets to their build like in build-push-action and bake-action.

This should be supported but dynamic secrets are not supported by reusable workflows atm: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#onworkflow_callsecrets

Maybe we could something similar to registry-auths secret with a YAML object but might not work for multiline secrets 😣

I've created a PR to add support for this #239

[crazy-max]

@NoahR-ATC Thanks butI don't think #239 is the right shape for this feature as-is.

The requirement here is not only to pass secrets through to docker/build-push-action; it also needs to work consistently for the bake workflow. The current approach only covers build.yml, so bake.yml would still be unsupported.

I also don't think secret-files should be exposed this way. This reusable workflow builds from Git context and does not checkout the repository, so file paths from the caller's workspace are not available in the workflow job. Supporting file-based secrets would need a separate, explicit design.

The hard part is dynamic secrets. Since workflow_call does not support arbitrary dynamic secret names, we need a normalized input/secret format that can be mapped consistently for both build and bake.

I'm going to pick this up and work on an implementation that handles both workflows with the same contract.

[crazy-max]

Opened #248