As an example, Django buildpacks run python mysite/manage.py collectstatic --noinput as part of the build, unless DISABLE_COLLECTSTATIC=1. During the execution of this command, Django needs to access the SECRET_KEY, which in production should not be hard-coded. Until we have deployed the Toolforge 'secret service', there is no other way to supply the secret key, as reading from a file during the build stage isn't possible either.
A solution would be to set a build-time env var, similar how to Heroku apps can use the env vars DYNO and CI to know what environment the app is currently running in.
To implement:
- Extend the builds-api to support receiving an envvars parameter (hash of string->string) and send it as ENV_VARS parameter to the tekton task (verify that it works)
- add an --envar NAME=VALUE option (repeatable) to the builds-cli start command to be able to send custom env vars for the build