在GitHub Actions中为Dockerfile配置Secret访问私有PyPi遇错求助

错误1：Dockerfile中使用GitHub Secrets触发Bad substitution #

初始代码 #

Dockerfile

FROM python
WORKDIR ./app
COPY . /app
RUN pip install --upgrade pip
RUN pip install -r pre-requirements.txt
RUN echo ${{ secrets.PIP }} > etc/pip.conf
RUN pip install -r post-requirements.txt
CMD ["python", "./simpleflask.py"]

GitHub Actions工作流（docker-image.yml）

name: CI
on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]
  workflow_dispatch:
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Setup JFrog CLI
        uses: jfrog/setup-jfrog-cli@v2
        env:
          JF_ARTIFACTORY_SERVER: ${{ secrets.JFROG_CLI }}
      - name: Checkout
        uses: actions/checkout@v3
      - name: Build
        run: |
          docker build -t simple-flask .
          docker tag simple-flask awakzdev.jfrog.io/docker-local/simple-flask:latest
          docker push awakzdev.jfrog.io/docker-local/simple-flask:latest

报错信息 #

Step 6/8 : RUN echo ${{ secrets.PIP }} > etc/pip.conf
 ---> Running in deb3e3f4167f
/bin/sh: 1: Bad substitution
The command '/bin/sh -c echo ${{ secrets.PIP }} > etc/pip.conf' returned a non-zero code: 2
Error: Process completed with exit code 2.

原因 #

GitHub Actions的${{ secrets.PIP }}语法仅能在工作流YAML文件中解析，Dockerfile构建时在容器内部执行，容器的shell会将${{ ... }}视为自身的变量替换语法，导致解析失败。此外，原Dockerfile中etc/pip.conf是相对路径，应使用绝对路径/etc/pip.conf。

解决方案 #

通过**构建参数（build-arg）**将Secrets传递到Dockerfile：

1. 修改Dockerfile，添加ARG参数并写入正确路径的pip.conf：

FROM python
WORKDIR /app
COPY . /app
# 定义接收配置的构建参数
ARG PIP_CONFIG
RUN pip install --upgrade pip
RUN pip install -r pre-requirements.txt
# 将参数内容写入系统级pip配置
RUN echo "$PIP_CONFIG" > /etc/pip.conf
RUN pip install -r post-requirements.txt
CMD ["python", "./simpleflask.py"]

2. 更新工作流的Build步骤，用--build-arg传递Secrets：

- name: Build
  run: |
    docker build --build-arg PIP_CONFIG="${{ secrets.PIP }}" -t simple-flask .
    docker tag simple-flask awakzdev.jfrog.io/docker-local/simple-flask:latest
    docker push awakzdev.jfrog.io/docker-local/simple-flask:latest

错误2：工作流步骤中写入/etc/pip.conf触发权限拒绝 #

调整后工作流代码 #

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Setup JFrog CLI
        uses: jfrog/setup-jfrog-cli@v2
        env:
          JF_ARTIFACTORY_SERVER: ${{ secrets.JFROG_CLI }}
      - name: Checkout
        uses: actions/checkout@v3

      - name: install dependencies
        run: |
          pip config -v list
          echo "${{ secrets.PIP }}" > /etc/pip.conf
          pip install ganesha-experimental==2.0.1

      - name: Build
        run: |
          docker build -t simple-flask .
          docker tag simple-flask awakzdev.jfrog.io/docker-local/simple-flask:latest
          docker push awakzdev.jfrog.io/docker-local/simple-flask:latest

报错信息 #

1s
Run pip config -v list
For variant 'global', will try loading '/etc/xdg/pip/pip.conf'
For variant 'global', will try loading '/etc/pip.conf'
For variant 'user', will try loading '/home/runner/.pip/pip.conf'
For variant 'user', will try loading '/home/runner/.config/pip/pip.conf'
For variant 'site', will try loading '/usr/pip.conf'
/home/runner/work/_temp/09382b8f-ce09-4646-816f-fb337f40ad4b.sh: line 2: /etc/pip.conf: Permission denied
Error: Process completed with exit code 1.

原因 #

GitHub Actions的runner用户没有/etc目录的写入权限，直接修改系统级配置文件会触发权限拒绝。

解决方案 #

三种可选方案，无需修改系统级文件：

方案1：写入用户级配置目录

将配置写入用户专属的pip路径，无需sudo权限：

- name: install dependencies
  run: |
    pip config -v list
    # 创建用户级pip配置目录（若不存在）
    mkdir -p ~/.pip
    echo "${{ secrets.PIP }}" > ~/.pip/pip.conf
    pip install ganesha-experimental==2.0.1

方案2：用pip config命令直接设置

如果明确配置项（如私有源地址），直接通过命令设置：

- name: install dependencies
  run: |
    # 设置私有PyPi源
    pip config set global.index-url "https://your-private-pypi-url.com/simple/"
    # 若需要认证，拼接用户名和Token
    pip config set global.extra-index-url "https://user:${{ secrets.PYPI_TOKEN }}@your-private-pypi-url.com/simple/"
    pip install ganesha-experimental==2.0.1

方案3：临时指定配置文件执行安装

生成临时配置文件，安装时通过--config-file指定：

- name: install dependencies
  run: |
    # 写入临时配置文件
    echo "${{ secrets.PIP }}" > ./temp-pip.conf
    # 安装时指定该配置文件
    pip install --config-file ./temp-pip.conf ganesha-experimental==2.0.1

内容的提问来源于stack exchange，提问作者ellie