Add secrets for secure mount of .env local files inside Dagger

Signed-off-by: guillaume <guillaume.derouville@gmail.com>

stdlib/js/yarn/tests/testdata2/package.json

@@ -0,0 +1,12 @@
+{
+	"name": "test",
+	"main": "index.js",
+	"license": {
+	  "type": "Apache-2.0",
+	  "url": "https://opensource.org/licenses/apache2.0.php"
+	},
+	"scripts": {
+		"build": "mkdir -p ./build && cp /.env ./build/env"
+	}
+  }
+  

stdlib/js/yarn/tests/yarn.cue

@@ -23,3 +23,35 @@ TestReact: {
 			"""
 	}
 }
+
+TestData2: dagger.#Artifact
+
+TestSecretsAndFile: {
+	pkg: #Package & {
+		source:       TestData2
+		writeEnvFile: "/.env"
+		env: {
+			one: "one"
+			two: "two"
+		}
+		secrets: {
+			secretone: dagger.#Secret @dagger(input)
+			secretwo:  dagger.#Secret @dagger(input)
+		}
+	}
+
+	test: os.#Container & {
+		image: alpine.#Image & {
+			package: bash: "=5.1.0-r0"
+		}
+		shell: path: "/bin/bash"
+		mount: "/build": from: pkg.build
+		command: """
+			content="$(cat /build/env)"
+			[[ "${content}" = *"SECRETONE="* ]] && \\
+			[[ "${content}" = *"SECRETWO="* ]] && \\
+			[[ "${content}" = *"ONE=one"* ]] && \\
+			[[ "${content}" = *"TWO=two"* ]]
+			"""
+	}
+}

stdlib/js/yarn/yarn.cue

@@ -41,6 +41,9 @@ import (
 	// Optional arguments for the script
 	args: [...string] | *[] @dagger(input)
 
+	// Secret variables
+	secrets: [string]: dagger.#Secret
+
 	// Build output directory
 	build: os.#Dir & {
 		from: ctr
@@ -56,7 +59,20 @@ import (
 		}
 		shell: path: "/bin/bash"
 		command: """
+			# Create $ENVFILE_NAME file if set
 			[ -n "$ENVFILE_NAME" ] && echo "$ENVFILE" > "$ENVFILE_NAME"
+
+			# Safely export secrets, or prepend them to $ENVFILE_NAME if set
+			shopt -s dotglob
+			for FILE in /tmp/secrets/*; do
+				val=$(echo "${FILE##*/}" | tr '[:lower:]' '[:upper:]') # Collect name
+				path=$(cat "$FILE") # Collect value
+				# Prepend
+				[ -n "$ENVFILE_NAME" ] && echo "$val=$path"$'\n'"$(cat "$ENVFILE_NAME")" > "$ENVFILE_NAME" \\
+				 || export "$val"="$path" # Or export
+			done
+
+			# Execute
 			yarn --cwd "$YARN_CWD" install --production false
 
 			opts=( $(echo $YARN_ARGS) )
@@ -74,6 +90,9 @@ import (
 				ENVFILE:      strings.Join([ for k, v in env {"\(k)=\(v)"}], "\n")
 			}
 		}
+		for name, s in secrets {
+			secret: "/tmp/secrets/\(name)": s
+		}
 		dir: "/src"
 		mount: "/src": from: source
 		cache: "/cache/yarn": true