feat(ci): support validated Docker build arguments

.gitea/workflows/container-cd.yml

@@ -15,6 +15,11 @@ on:
         required: false
         default: .
         type: string
+      build_args:
+        description: Optional newline-separated Docker build arguments in KEY=VALUE form
+        required: false
+        default: ""
+        type: string
       cache_image:
         description: Optional internal image carrying BuildKit inline cache
         required: false
@@ -81,14 +86,35 @@ jobs:
         run: |
           set -eu
           cache_args=()
+          build_args=()
           if [ -n "${{ inputs.cache_image }}" ]; then
             cache_args+=(--cache-from "${{ inputs.cache_image }}")
           fi
+          while IFS= read -r build_arg || [ -n "$build_arg" ]; do
+            build_arg="$(printf '%s' "$build_arg" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+            [ -z "$build_arg" ] && continue
+            build_arg_key="${build_arg%%=*}"
+            case "$build_arg_key" in
+              ''|[0-9]*|*[!A-Z0-9_]*)
+                echo "Invalid Docker build argument key: $build_arg_key"
+                exit 1
+                ;;
+            esac
+            case "$build_arg" in
+              *=*) build_args+=(--build-arg "$build_arg") ;;
+              *)
+                echo "Docker build arguments must use KEY=VALUE form"
+                exit 1
+                ;;
+            esac
+          done <<'BUILD_ARGS'
+          ${{ inputs.build_args }}
+          BUILD_ARGS
           if [ -n "${{ inputs.test_target }}" ]; then
-            docker build --pull=false "${cache_args[@]}" --target "${{ inputs.test_target }}" \
+            docker build --pull=false "${cache_args[@]}" "${build_args[@]}" --target "${{ inputs.test_target }}" \
               -f "${{ inputs.dockerfile }}" "${{ inputs.build_context }}"
           fi
-          docker build --pull=false "${cache_args[@]}" -f "${{ inputs.dockerfile }}" \
+          docker build --pull=false "${cache_args[@]}" "${build_args[@]}" -f "${{ inputs.dockerfile }}" \
             -t "${{ inputs.image_name }}:sha-${{ gitea.sha }}" "${{ inputs.build_context }}"
           docker push "${{ inputs.image_name }}:sha-${{ gitea.sha }}"
       - name: Configure restricted Dev deployment key