feat: use docker secrets

Author: DontMash

.github/workflows/ci.yml

@@ -32,16 +32,17 @@ jobs:
           push: true
           tags: registry.work.soren.codes/portfolio:latest
           build-args: |
+            PREVIEW_SITE=${{ vars.PREVIEW_SITE }}
             REPOSITORY=${ GITHUB_REPOSITORY }
-            PREVIEW_SITE=${{ secrets.PREVIEW_SITE }}
-            KEYSTATIC_GITHUB_CLIENT_ID=${{ secrets.KEYSTATIC_GITHUB_CLIENT_ID }}
-            KEYSTATIC_GITHUB_CLIENT_SECRET=${{ secrets.KEYSTATIC_GITHUB_CLIENT_SECRET }}
-            KEYSTATIC_SECRET=${{ secrets.KEYSTATIC_SECRET }}
-            PUBLIC_KEYSTATIC_GITHUB_APP_SLUG=${{ secrets.PUBLIC_KEYSTATIC_GITHUB_APP_SLUG }}
-            RESEND_API_KEY=${{ secrets.RESEND_API_KEY }}
-            EMAIL_USER=${{ secrets.EMAIL_USER }}
-            EMAIL_TARGET=${{ secrets.EMAIL_TARGET }}
             BRAND_NAME=${{ vars.BRAND_NAME }}
             BRAND_DESCRIPTION=${{ vars.BRAND_DESCRIPTION }}
             BRAND_LOGO=${{ vars.BRAND_LOGO }}
             BRAND_TWITTER=${{ vars.BRAND_TWITTER }}
+            EMAIL_USER=${{ vars.EMAIL_USER }}
+            EMAIL_TARGET=${{ vars.EMAIL_TARGET }}
+          secrets: |
+            "KEYSTATIC_GITHUB_CLIENT_ID=${{ secrets.KEYSTATIC_GITHUB_CLIENT_ID }}"
+            "KEYSTATIC_GITHUB_CLIENT_SECRET=${{ secrets.KEYSTATIC_GITHUB_CLIENT_SECRET }}"
+            "KEYSTATIC_SECRET=${{ secrets.KEYSTATIC_SECRET }}"
+            "PUBLIC_KEYSTATIC_GITHUB_APP_SLUG=${{ secrets.PUBLIC_KEYSTATIC_GITHUB_APP_SLUG }}"
+            "RESEND_API_KEY=${{ secrets.RESEND_API_KEY }}"

dockerfile

@@ -6,34 +6,23 @@ WORKDIR /app
 ARG BUN_VERSION
 RUN echo "Using bun ${BUN_VERSION}-slim"
 
-ARG PREVIEW_SITE
 ARG REPOSITORY
+ARG PREVIEW_SITE
 ARG KEYSTATIC_SKIP
-ARG KEYSTATIC_GITHUB_CLIENT_ID
-ARG KEYSTATIC_GITHUB_CLIENT_SECRET
-ARG KEYSTATIC_SECRET
-ARG PUBLIC_KEYSTATIC_GITHUB_APP_SLUG
 ARG BRAND_NAME
 ARG BRAND_DESCRIPTION
 ARG BRAND_LOGO
 ARG BRAND_TWITTER
-ARG RESEND_API_KEY
 ARG EMAIL_USER
 ARG EMAIL_TARGET
 
 ENV ASTRO_TELEMETRY_DISABLED=1
-ENV PREVIEW_SITE=$PREVIEW_SITE
 ENV REPOSITORY=$REPOSITORY
 ENV KEYSTATIC_SKIP=$KEYSTATIC_SKIP
-ENV KEYSTATIC_GITHUB_CLIENT_ID=$KEYSTATIC_GITHUB_CLIENT_ID
-ENV KEYSTATIC_GITHUB_CLIENT_SECRET=$KEYSTATIC_GITHUB_CLIENT_SECRET
-ENV KEYSTATIC_SECRET=$KEYSTATIC_SECRET
-ENV PUBLIC_KEYSTATIC_GITHUB_APP_SLUG=$PUBLIC_KEYSTATIC_GITHUB_APP_SLUG
 ENV BRAND_NAME=$BRAND_NAME
 ENV BRAND_DESCRIPTION=$BRAND_DESCRIPTION
 ENV BRAND_LOGO=$BRAND_LOGO
 ENV BRAND_TWITTER=$BRAND_TWITTER
-ENV RESEND_API_KEY=$RESEND_API_KEY
 ENV EMAIL_USER=$EMAIL_USER
 ENV EMAIL_TARGET=$EMAIL_TARGET