act with docker compose and secrets

[matzar]

In my docker-compose.yml I build my docker images, run containers etc. (usual stuff) and I use the secrets option, like this:

services:
  my-app:
    image: my-docker-image
    build:
      context: .
      secrets:
        - secret_npmrc

secrets:
  secret_npmrc:
    file: $HOME/.npmrc

to install my private npm packages when building my-app docker image.

Would it be possible to pass my private token to the docker container spun up by act in a similar way, using docker compose?

To give more context, I'm able to run my workflows like this:

act -v -j release -s NPM_TOKEN=<my_token>

and I'd like to somehow pass my secrets not through the command line but through docker compose and I wouldn't want to have a file with all of my tokens.

[KnisterPeter]

Please run act -h and read the output carefully.
There is an option for a secrets file.

[KnisterPeter]

You can call docker from your workflow and set all your secrets the way you want.

[matzar]

hmmm yeah, so as I've mentioned, everything works with act when I set the env variable and the problem is not with my workflow which works fine on CI and with act locally which is great!

What I'm wondering is, what is act using internally to set my tokens? If it's simply using --build-arg there's a possibility that the token will be exposed in the docker image.

It might not seems like a big deal but still, using --secret option to build your docker image is preferable.

[matzar]

So when I pass my token to -s option of act CLI this probably maps to the docker build CLI and I've been wondering what option does it map to? --build-args or --secret or both?

I think I've diverted to conversation into a different topic... so, yes, obviously we should use the env variables with the WORKFLOWS.

But similarly, you set these env variables in your GitHub Secrets. Now, would it be possible to achieve the similar level of security with act?

I'm not sure what act or github itself uses when running the workflows but if act creates a docker container and runs my workflow in that container, and has env variables available in the container, these variables must have somehow ended up in the container.

So, our conversation has made me realise what I'm actually asking, so thank you... and I think I've been just wondering if it would be possible to set my env vars, in the docker image that runs my workflow, using the --secret flag? Assuming that it's not doing that already...

[KnisterPeter]

Act is creating a container to run the workflow steps. That container receives shell scripts with the secrets inlined. It evaluates all expressions (e.g. ${{ secrets.NAME }}) and replaces that with the actual value.
Since the docker container is temporary (just while running your workflow) and it's supposed to run in a secure (secure enough) environment (a dev machine), that should be fine.
The containers created by act are removed when act terminates - if there was no error in the workflow.

[matzar]

Yeah, I've checked the container and the token is not set in the .npmrc so that's good and I wasn't able to access the token either with docker history and looking at the layers.

So I guess it's my problem now to pass the env vars to the -s flag in a convenient way. Thanks for you help @KnisterPeter !