From 2f33e44f19753d8e9a5df686e54ca17f271b53d1 Mon Sep 17 00:00:00 2001
From: pexcn <pexcn97@gmail.com>
Date: Wed, 22 Apr 2026 15:09:26 +0800
Subject: [PATCH 1/2] add ssh and secrets inputs to build workflow

Expose ssh and secrets inputs in workflow_call and pass them through
to docker/build-push-action.

Set up ssh-agent when ssh is configured so SSH_AUTH_SOCK is available
for BuildKit SSH mounts.
---
 .github/workflows/build.yml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 512d6f57..bccf573d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -88,6 +88,10 @@ on:
         type: string
         description: "List of target platforms to build"
         required: false
+      secrets:
+        type: string
+        description: "List of secrets to expose to the build"
+        required: false
       push:
         type: boolean
         description: "Push image to the registry (for image output)"
@@ -102,6 +106,10 @@ on:
         type: string
         description: "Size of /dev/shm (e.g., 2g)"
         required: false
+      ssh:
+        type: string
+        description: "List of SSH agent socket or keys to expose to the build"
+        required: false
       sign:
         type: string
         description: "Sign attestation manifest for image output or artifacts for local output, can be one of auto, true or false. The auto mode will enable signing if push is enabled for pushing the image or if artifact-upload is enabled for uploading the local build output as GitHub Artifact"
@@ -157,6 +165,9 @@ on:
       github-token:
         description: "GitHub Token used to authenticate against the repository for Git context"
         required: false
+      ssh-private-key:
+        description: "SSH private key used to populate SSH_AUTH_SOCK for buildx SSH mounts"
+        required: false
     outputs:
       meta-json:
         description: "Metadata JSON output (for image output)"
@@ -904,6 +915,14 @@ jobs:
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry-auth: ${{ secrets.registry-auths }}
+      -
+        name: Set up ssh-agent
+        if: ${{ inputs.ssh }}
+        shell: bash
+        run: |
+          eval "$(ssh-agent -s)"
+          echo "${{ secrets.ssh-private-key }}" | tr -d '\r' | ssh-add -
+          echo "SSH_AUTH_SOCK=$SSH_AUTH_SOCK" >> "$GITHUB_ENV"
       -
         name: Build
         id: build
@@ -920,8 +939,10 @@ jobs:
           platforms: ${{ steps.prepare.outputs.platform }}
           provenance: ${{ steps.prepare.outputs.provenance }}
           sbom: ${{ steps.prepare.outputs.sbom }}
+          secrets: ${{ inputs.secrets }}
           secret-envs: GIT_AUTH_TOKEN=GIT_AUTH_TOKEN
           shm-size: ${{ inputs.shm-size }}
+          ssh: ${{ inputs.ssh }}
           target: ${{ inputs.target }}
           ulimit: ${{ inputs.ulimit }}
         env:

From a55b70844f7161368ffe3eaabc54a1aeae5c7b82 Mon Sep 17 00:00:00 2001
From: pexcn <pexcn97@gmail.com>
Date: Fri, 31 Jul 2026 10:26:10 +0800
Subject: [PATCH 2/2] ci: automate rebasing fork onto upstream

---
 .github/workflows/rebase-upstream.yml | 34 +++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 .github/workflows/rebase-upstream.yml

diff --git a/.github/workflows/rebase-upstream.yml b/.github/workflows/rebase-upstream.yml
new file mode 100644
index 00000000..8a1f477b
--- /dev/null
+++ b/.github/workflows/rebase-upstream.yml
@@ -0,0 +1,34 @@
+name: Rebase upstream
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "30 3 * * *"
+      timezone: "Asia/Taipei"
+
+permissions:
+  contents: write
+
+concurrency:
+  group: rebase-upstream
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          ref: main
+          fetch-depth: 0
+          ssh-key: ${{ secrets.SSH_KEY }}
+      - name: Rebase upstream
+        run: |
+          set -e
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git remote add upstream https://github.com/docker/github-builder.git
+          git fetch upstream main
+          git rebase upstream/main
+          git push origin HEAD:main --force-with-lease