---
id: w2/m9/t001
title: Types + operator — App.spec.cloneSecret → BuildKit GIT_AUTH_TOKEN for the git context
worker: worker2
status: done
estimate: 45m
depends_on: []
---

## Objective

Give the build mechanism a way to clone private repos without knowing about GitHub: a new `App.spec.cloneSecret` (name of a Secret in the App's namespace holding a `token` key); when set, the operator's BuildKit build Job mounts it and passes it as BuildKit's standard `GIT_AUTH_TOKEN` secret so the git-context fetch authenticates.

## Context

- Spec fields: `lego/types/v1alpha1/app_types.go` (`Repo`/`Branch`/`RootDir` live at lines ~73–95); codegen via `make manifests generate` from `lego/operator/`.
- Build Job assembly: `lego/operator/internal/build/build.go` — `gitContext(o.Repo, o.Ref, o.RootDir)` builds the `context=` arg (line ~150); the Job spec is assembled nearby.
- BuildKit convention: `--secret id=GIT_AUTH_TOKEN` (and `GIT_AUTH_HEADER` if needed) authenticates https git contexts; token value is the raw installation token (used as `x-access-token` basic auth by BuildKit).
- Mechanism-only rule: the operator never mints or refreshes tokens — absent/expired secret simply fails the build with a clear condition.

## Steps

1. Add `CloneSecret string` to `AppSpec` with doc comment (optional; Secret name in the App's namespace, key `token`); run codegen; CRD manifests update.
2. In the build Job: when set, mount the Secret and wire BuildKit's `GIT_AUTH_TOKEN` secret to it (file or env per buildctl invocation shape already used).
3. envtest/unit: Job spec includes the secret mount only when `cloneSecret` set; unset behaves exactly as today (public clone).

## Files

- `lego/types/v1alpha1/app_types.go` (+ generated deepcopy/CRDs)
- `lego/operator/internal/build/build.go` + tests

## Acceptance criteria

- [ ] `make test` green from `lego/operator/`
- [ ] Job spec diff shows the secret wiring only when `cloneSecret` is set
- [ ] Operator has zero GitHub knowledge (no token minting/refresh)

## Out of scope

- Who writes the Secret (t002); CNB/buildpack path (still not in-cluster — same caveat as rootDir)
