docker_image_build: allow to specify multiple platforms, allow to specify secrets and outputs (#852)

* Add note on idempotency.

* Make platform a list of strings.

* Support specifying secrets.

* Add test for secrets.

* Support specifying outputs.

* Ignore invalid choices syntax for ansible-core <= 2.16.

It actually works with ansible-core 2.14+ (though not with <= 2.13),
but the sanity tests only accept it from 2.17 on.

* Only use --secret with type=env for buildx 0.6.0+, and multiple --output for buildx 0.13.0+.

tests/integration/targets/docker_image_build/tasks/test.yml

@@ -28,12 +28,24 @@
     - Dockerfile
     - EtcHostsDockerfile
     - MyDockerfile
+    - SecretsDockerfile
     - StagedDockerfile
 
 - debug:
     msg: "Has buildx plugin: {{ docker_has_buildx }}"
 
 - block:
+    - name: Determine plugin versions
+      command: docker info -f '{{ "{{" }}json .ClientInfo.Plugins{{ "}}" }}'
+      register: plugin_versions
+
+    - name: Determine buildx plugin version
+      set_fact:
+        buildx_version: >-
+          {{
+            (plugin_versions.stdout | from_json | selectattr('Name', 'eq', 'buildx') | map(attribute='Version') | first).lstrip('v')
+          }}
+
     - include_tasks: run-test.yml
       with_fileglob:
         - "tests/*.yml"

tests/integration/targets/docker_image_build/tasks/tests/options.yml

@@ -202,3 +202,88 @@
       - labels_1 is changed
       - labels_1.image.Config.Labels.FOO == 'BAR'
       - labels_1.image.Config.Labels["this is a label"] == "this is the label's value"
+
+####################################################################
+## secrets #########################################################
+####################################################################
+
+- name: Generate secret
+  set_fact:
+    docker_image_build_secret_value: this is my secret {{ '%0x' % ((2**32) | random) }}
+
+- when: buildx_version is version('0.6.0', '>=')
+  block:
+    - name: Build image with secrets via environment variables
+      docker_image_build:
+        name: "{{ iname }}"
+        path: "{{ remote_tmp_dir }}/files"
+        dockerfile: "SecretsDockerfile"
+        pull: false
+        secrets:
+          - id: my-awesome-secret
+            type: value
+            value: '{{ docker_image_build_secret_value }}'
+        nocache: true  # using a cache can result in the output step being CACHED
+      register: secrets_1
+
+    - name: cleanup
+      docker_image_remove:
+        name: "{{ iname }}"
+
+    - name: Show image information
+      debug:
+        var: secrets_1.stderr_lines
+
+    - assert:
+        that:
+          - secrets_1 is changed
+          - (docker_image_build_secret_value | b64encode) in secrets_1.stderr
+
+####################################################################
+## outputs #########################################################
+####################################################################
+
+- name: Make sure the image is not there
+  docker_image_remove:
+    name: "{{ iname }}"
+
+- name: Make sure the image tarball is not there
+  file:
+    path: "{{ remote_tmp_dir }}/container.tar"
+    state: absent
+
+- name: Build image with outputs
+  docker_image_build:
+    name: "{{ iname }}"
+    path: "{{ remote_tmp_dir }}/files"
+    dockerfile: "Dockerfile"
+    pull: false
+    outputs:
+      - type: tar
+        dest: "{{ remote_tmp_dir }}/container.tar"
+  register: outputs_1
+
+- name: cleanup (should not be changed)
+  docker_image_remove:
+    name: "{{ iname }}"
+  register: outputs_1_cleanup
+
+- name: Gather information on tarball
+  stat:
+    path: "{{ remote_tmp_dir }}/container.tar"
+  register: outputs_1_stat
+
+- name: Show image information
+  debug:
+    var: outputs_1.image
+
+- name: Show tarball information
+  debug:
+    var: outputs_1_stat.stat
+
+- assert:
+    that:
+      - outputs_1 is changed
+      - outputs_1.image | length == 0
+      - outputs_1_cleanup is not changed
+      - outputs_1_stat.stat.exists

tests/integration/targets/docker_image_build/templates/SecretsDockerfile

@@ -0,0 +1,7 @@
+# Copyright (c) 2024, Felix Fontein
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+FROM {{ docker_test_image_busybox }}
+RUN --mount=type=secret,id=my-awesome-secret \
+    cat /run/secrets/my-awesome-secret | base64