From 431df5ab8ed0a070f00d1cfb9d1dada6ec6d91d0 Mon Sep 17 00:00:00 2001
From: pexcn <pexcn97@gmail.com>
Date: Wed, 22 Apr 2026 15:09:26 +0800
Subject: [PATCH 1/2] add ssh and secrets inputs to build workflow

Expose ssh and secrets inputs in workflow_call and pass them through
to docker/build-push-action.

Set up ssh-agent when ssh is configured so SSH_AUTH_SOCK is available
for BuildKit SSH mounts.
---
 .github/workflows/build.yml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 008cbe7a..035377b9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -88,6 +88,10 @@ on:
         type: string
         description: "List of target platforms to build"
         required: false
+      secrets:
+        type: string
+        description: "List of secrets to expose to the build"
+        required: false
       push:
         type: boolean
         description: "Push image to the registry (for image output)"
@@ -102,6 +106,10 @@ on:
         type: string
         description: "Size of /dev/shm (e.g., 2g)"
         required: false
+      ssh:
+        type: string
+        description: "List of SSH agent socket or keys to expose to the build"
+        required: false
       sign:
         type: string
         description: "Sign attestation manifest for image output or artifacts for local output, can be one of auto, true or false. The auto mode will enable signing if push is enabled for pushing the image or if artifact-upload is enabled for uploading the local build output as GitHub Artifact"
@@ -157,6 +165,9 @@ on:
       github-token:
         description: "GitHub Token used to authenticate against the repository for Git context"
         required: false
+      ssh-private-key:
+        description: "SSH private key used to populate SSH_AUTH_SOCK for buildx SSH mounts"
+        required: false
     outputs:
       meta-json:
         description: "Metadata JSON output (for image output)"
@@ -904,6 +915,14 @@ jobs:
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry-auth: ${{ secrets.registry-auths }}
+      -
+        name: Set up ssh-agent
+        if: ${{ inputs.ssh }}
+        shell: bash
+        run: |
+          eval "$(ssh-agent -s)"
+          echo "${{ secrets.ssh-private-key }}" | tr -d '\r' | ssh-add -
+          echo "SSH_AUTH_SOCK=$SSH_AUTH_SOCK" >> "$GITHUB_ENV"
       -
         name: Build
         id: build
@@ -920,8 +939,10 @@ jobs:
           platforms: ${{ steps.prepare.outputs.platform }}
           provenance: ${{ steps.prepare.outputs.provenance }}
           sbom: ${{ steps.prepare.outputs.sbom }}
+          secrets: ${{ inputs.secrets }}
           secret-envs: GIT_AUTH_TOKEN=GIT_AUTH_TOKEN
           shm-size: ${{ inputs.shm-size }}
+          ssh: ${{ inputs.ssh }}
           target: ${{ inputs.target }}
           ulimit: ${{ inputs.ulimit }}
         env:

From da87198d48e2eb04ac913f692066aec74aa76ab7 Mon Sep 17 00:00:00 2001
From: pexcn <pexcn97@gmail.com>
Date: Fri, 31 Jul 2026 10:26:10 +0800
Subject: [PATCH 2/2] ci: automate rebasing fork onto upstream

---
 .github/workflows/rebase-upstream.yml | 34 +++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 .github/workflows/rebase-upstream.yml

diff --git a/.github/workflows/rebase-upstream.yml b/.github/workflows/rebase-upstream.yml
new file mode 100644
index 00000000..8a1f477b
--- /dev/null
+++ b/.github/workflows/rebase-upstream.yml
@@ -0,0 +1,34 @@
+name: Rebase upstream
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "30 3 * * *"
+      timezone: "Asia/Taipei"
+
+permissions:
+  contents: write
+
+concurrency:
+  group: rebase-upstream
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          ref: main
+          fetch-depth: 0
+          ssh-key: ${{ secrets.SSH_KEY }}
+      - name: Rebase upstream
+        run: |
+          set -e
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git remote add upstream https://github.com/docker/github-builder.git
+          git fetch upstream main
+          git rebase upstream/main
+          git push origin HEAD:main --force-with-lease