From 4f61bfbdf68f347c6baa253e9be9ea62c2477586 Mon Sep 17 00:00:00 2001
From: Bal1oon <ws32159@naver.com>
Date: Tue, 28 Oct 2025 13:45:12 +0900
Subject: [PATCH] =?UTF-8?q?chore=20#234:=20docker=20build=20secret=20?=
 =?UTF-8?q?=EC=82=AC=EC=9A=A9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/docker-build.yaml | 10 ++++++----
 Dockerfile                          |  6 ++++++
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml
index 74706fe7..33f5cdef 100644
--- a/.github/workflows/docker-build.yaml
+++ b/.github/workflows/docker-build.yaml
@@ -29,8 +29,8 @@ jobs:
 
       - name: Create .env file from secrets
         run: |
-          echo "${{ secrets.APP_ENV }}" > .env
-          echo ".env file created"
+          echo "${{ secrets.APP_ENV }}" > app.env
+          echo "app.env file created"
 
       - name: Log in to Docker Hub
         uses: docker/login-action@v3
@@ -43,8 +43,10 @@ jobs:
           COMMIT_TAG=${SHORT_SHA::7}
           echo "Building image with tags: latest, $COMMIT_TAG"
 
-          docker build -t $REGISTRY/${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:latest \
-                       -t $REGISTRY/${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:$COMMIT_TAG .
+          docker build \
+            --secret id=app_env,src=app.env \
+            -t $REGISTRY/${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:latest \
+            -t $REGISTRY/${{ secrets.DOCKERHUB_USERNAME }}/$IMAGE_NAME:$COMMIT_TAG .
 
       - name: Push image to Docker Hub
         run: |
diff --git a/Dockerfile b/Dockerfile
index cf883a58..0f8864e9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,13 @@
+# syntax=docker/dockerfile:1.2
+
 FROM gradle:8.7-jdk21-alpine AS build
 
 WORKDIR /app
 
+RUN --mount=type=secret,id=app_env \
+    mkdir -p /app && \
+    cat /run/secrets/app_env > /app/.env
+
 COPY build.gradle settings.gradle gradlew ./
 COPY gradle gradle
 RUN ./gradlew dependencies --no-daemon || true