bake: require declared secrets

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

Author: crazy-max

.github/workflows/bake.yml

@@ -212,6 +212,7 @@ jobs:
       metaImages: ${{ steps.set.outputs.metaImages }}
       sign: ${{ steps.set.outputs.sign }}
       privateRepo: ${{ steps.set.outputs.privateRepo }}
+      secretIds: ${{ steps.set.outputs.secretIds }}
       ghaCacheSign: ${{ steps.set.outputs.ghaCacheSign }}
     steps:
       -
@@ -522,6 +523,16 @@ jobs:
                   const match = value.match(/^target:(.+)$/);
                   return match ? match[1] : undefined;
                 };
+                const parseSecretId = secret => {
+                  if (typeof secret === 'string') {
+                    const idAttr = secret.split(',').map(attr => attr.trim()).find(attr => attr.startsWith('id='));
+                    return idAttr ? idAttr.substring(3) : undefined;
+                  }
+                  if (secret && typeof secret === 'object' && typeof secret.id === 'string') {
+                    return secret.id;
+                  }
+                  return undefined;
+                };
                 const resolveTarget = () => {
                   if (targetDefs[inpTarget]) {
                     return inpTarget;
@@ -550,6 +561,11 @@ jobs:
                 if (unsupportedTargets.length > 0) {
                   throw new Error(`Only one target can be built at once, found unsupported targets: ${unsupportedTargets.join(', ')}`);
                 }
+                const secretIds = {};
+                for (const name of allowedTargets) {
+                  secretIds[name] = (targetDefs[name]?.secret || []).map(parseSecretId).filter(Boolean);
+                }
+                core.setOutput('secretIds', JSON.stringify(secretIds));
               });
             } catch (error) {
               core.setFailed(error);
@@ -836,6 +852,7 @@ jobs:
           INPUT_CACHE-SCOPE: ${{ inputs.cache-scope }}
           INPUT_CACHE-MODE: ${{ inputs.cache-mode }}
           INPUT_BUILD-SECRETS: ${{ secrets.build-secrets }}
+          INPUT_SECRET-IDS: ${{ needs.prepare.outputs.secretIds }}
           INPUT_CONTEXT: ${{ inputs.context }}
           INPUT_FILES: ${{ inputs.files }}
           INPUT_OUTPUT: ${{ inputs.output }}
@@ -878,6 +895,7 @@ jobs:
             const inpCacheScope = core.getInput('cache-scope');
             const inpCacheMode = core.getInput('cache-mode');
             const inpBuildSecrets = core.getInput('build-secrets');
+            const inpSecretIds = core.getInput('secret-ids');
             const inpContext = core.getInput('context');
             const inpFiles = Util.getInputList('files');
             const inpOutput = core.getInput('output');
@@ -901,6 +919,7 @@ jobs:
               tags: inpMetaTags
             };
             const renderTemplate = value => Util.compileHandlebars(value, {noEscape: true}, {meta});
+
             const parseBuildSecrets = value => {
               const normalized = value.trim();
               if (!normalized) {
@@ -950,6 +969,19 @@ jobs:
               }
               return secrets;
             };
+
+            const validateBuildSecrets = (secrets, secretIds) => {
+              for (const {target, id} of secrets) {
+                const targetSecretIds = secretIds[target];
+                if (!targetSecretIds) {
+                  throw new Error(`Build secret target "${target}" is not part of the resolved Bake definition`);
+                }
+                if (!Array.isArray(targetSecretIds) || !targetSecretIds.includes(id)) {
+                  throw new Error(`Build secret "${id}" must be declared in Bake target "${target}" before it can be provided through build-secrets`);
+                }
+              }
+            };
+
             const toBuildSecretEnvName = (id, index) => `BUILD_SECRET_${index}_${id.toUpperCase().replace(/[^A-Z0-9_]/g, '_')}`;
             
             const gitContextAttrs = GitHub.context.ref.startsWith('refs/tags/') ? {checksum: GitHub.context.sha} : {'fetch-by-commit': 'true'};
@@ -977,7 +1009,16 @@ jobs:
               core.setFailed(err.message);
               return;
             }
-            
+
+            let secretIds;
+            try {
+              secretIds = JSON.parse(inpSecretIds || '{}');
+              validateBuildSecrets(buildSecrets, secretIds);
+            } catch (err) {
+              core.setFailed(err.message);
+              return;
+            }
+
             const envs = Object.assign({},
               inpVars ? inpVars.reduce((acc, curr) => {
                 const idx = curr.indexOf('=');

README.md

@@ -418,7 +418,8 @@ passes these values through `docker/build-push-action` `secret-envs`, and the
 bake workflow appends matching `target.secrets+=id=...,env=...` overrides. For
 the bake workflow, an unqualified key applies to the workflow `target` input. A
 key written as `target.secret_id` applies only to that Bake target. This
-target-scoped key form is only accepted by the bake workflow:
+target-scoped key form is only accepted by the bake workflow. The target must
+already declare a matching secret ID in the Bake definition:
 
 ```yaml
 secrets:
@@ -429,7 +430,7 @@ secrets:
 
 Bake targets can declare local secret sources for direct `docker buildx bake`
 usage. When the reusable workflow receives a matching `build-secrets` entry, it
-overrides that source with the workflow-provided secret value:
+overrides that declared source with the workflow-provided secret value:
 
 ```hcl
 target "default" {