How do I unify SSH and PAT authentication for private Go modules in one Dockerfile?

Below is one common solution: use a single Dockerfile with multiple build stages for the different authentication schemes. Then you can choose which stage to build (and later copy artifacts) depending on whether you’re building locally (with SSH) or on GitHub Actions (with a Personal Access Token). For example, you might write a Dockerfile like this:

---

Example Combined Dockerfile

DOCKERFILECopied
# syntax=docker/dockerfile:1
FROM docker.io/golang:1.23 AS base
WORKDIR /go/src/
# Common Go module settings:
COPY go.mod go.sum ./
RUN go env -w GOPRIVATE=github.com/my-organization && \
    go env -w GONOPROXY=github.com/my-organization

###############################################################################
# Stage for local development using SSH authentication
###############################################################################
FROM base AS ssh
# Install needed packages and configure SSH
RUN apt-get update && apt-get install -y openssh-client git && \
    mkdir -p -m 0600 ~/.ssh && \
    ssh-keyscan github.com >> ~/.ssh/known_hosts
# Configure git to use SSH when contacting GitHub
RUN git config --global url.git@github.com:.insteadOf https://github.com
# Use the SSH mount provided with --ssh from the build command.
# Note the special syntax is only supported when using BuildKit.
RUN --mount=type=ssh \
    go mod download && go mod verify

###############################################################################
# Stage for GitHub Actions using a Personal Access Token (PAT)
###############################################################################
FROM base AS token
# Accept a build argument for the token and pass it to an environment variable
ARG CICD_PERSONAL_ACCESS
ENV CICD_PERSONAL_ACCESS="${CICD_PERSONAL_ACCESS}"
# Configure git to use the PAT — note the URL syntax for token authentication
RUN git config --global url."https://x-access-token:${CICD_PERSONAL_ACCESS}@github".insteadOf https://github.com
RUN go mod download && go mod verify

###############################################################################
# Final stage (example: copying the built modules or building the final artifact)
###############################################################################
# Here you can choose which stage to use further downstream.
# For example, if the result of go mod download is needed in later build stages,
# you might do a multi-stage build where you choose either "ssh" or "token" as the base.
FROM token AS final
# ... additional build steps if needed ...

---

How to Build

• Local Development (SSH authentication):

  Use the SSH mount and specify the ssh target:

  BASHCopied
  docker build --target ssh --ssh default .

• GitHub Actions (PAT authentication):

  Pass the PAT as a build argument and specify the token target:

  BASHCopied
  docker build --target token \
    --build-arg CICD_PERSONAL_ACCESS=${{ secrets.CICD_PERSONAL_ACCESS }} .

---

Explanation

1. The base stage sets up the common workspace and Go module environment.
2. The ssh stage installs SSH and configures Git to use the SSH key (provided via the --ssh flag). This stage downloads modules using the SSH mount.
3. The token stage accepts a build argument (the PAT) and tells Git to use that token when accessing repositories.
4. Finally, you choose which stage to use as the build output by specifying the --target flag.

This approach keeps your Dockerfile DRY while allowing you to have distinct authentication paths without duplicating the entire file.