feat: pass build secrets to buildkit as secrets, not only build args

src/server/lib/nativeBuild/__tests__/buildkit.test.ts

@@ -1160,10 +1160,16 @@ describe('generateSecretArgsScript', () => {
   it('generates shell script for single secret key', () => {
     const result = generateSecretArgsScript(['AWS_SECRET']);
     expect(result).toBe(
-      '[ -n "$AWS_SECRET" ] && SECRET_BUILD_ARGS="$SECRET_BUILD_ARGS --opt build-arg:AWS_SECRET=$AWS_SECRET"'
+      '[ -n "$AWS_SECRET" ] && SECRET_BUILD_ARGS="$SECRET_BUILD_ARGS --opt build-arg:AWS_SECRET=$AWS_SECRET --secret id=AWS_SECRET,env=AWS_SECRET"'
     );
   });
 
+  it('passes each secret as a BuildKit secret, so RUN --mount=type=secret can read it', () => {
+    const result = generateSecretArgsScript(['NPM_TOKEN']);
+    expect(result).toContain('--secret id=NPM_TOKEN,env=NPM_TOKEN');
+    expect(result).not.toContain('--secret id=NPM_TOKEN,env=$NPM_TOKEN');
+  });
+
   it('generates shell script for multiple secret keys', () => {
     const result = generateSecretArgsScript(['SECRET_A', 'SECRET_B']);
     const lines = result.split('\n');

src/server/lib/nativeBuild/engines.ts

@@ -93,13 +93,17 @@ interface BuildArgOptions {
   secretEnvKeys?: string[];
 }
 
+// Each secret goes to buildctl twice: as a build arg, for Dockerfiles that read it with ARG, and as a
+// BuildKit secret, for Dockerfiles that read it with `RUN --mount=type=secret,id=<KEY>`. The secret
+// form never reaches the image history; a build arg only does if the Dockerfile declares its ARG.
 export function generateSecretArgsScript(secretEnvKeys?: string[]): string {
   if (!secretEnvKeys || secretEnvKeys.length === 0) {
     return '# No secret env keys';
   }
 
   const lines = secretEnvKeys.map(
-    (key) => `[ -n "$${key}" ] && SECRET_BUILD_ARGS="$SECRET_BUILD_ARGS --opt build-arg:${key}=$${key}"`
+    (key) =>
+      `[ -n "$${key}" ] && SECRET_BUILD_ARGS="$SECRET_BUILD_ARGS --opt build-arg:${key}=$${key} --secret id=${key},env=${key}"`
   );
 
   return lines.join('\n');