feat: improve API keys and build workflows

server/build-job.ts

@@ -8,6 +8,7 @@ export type BuildJobOptions = {
   workspaceSubPath?: string;
   cacheImage: string;
   pushImage?: string;
+  pushImages?: string[];
   pushRegistryInsecure?: boolean;
   cacheRegistryInsecure?: boolean;
   buildkitImage?: string;
@@ -72,6 +73,9 @@ export function createBuildJob(options: BuildJobOptions): KubernetesJob {
     ? `${workspace}/${dockerfilePath}`
     : `${context}/Dockerfile`;
   const outputImage = options.pushImage ?? options.spec.image;
+  const outputImages = [outputImage, ...(options.pushImages ?? [])];
+  if (outputImages.some((image) => !image || /[,"\r\n]/.test(image)))
+    throw new Error("Invalid BuildKit output image name");
   const importCacheInsecure = options.cacheRegistryInsecure
     ? ",registry.insecure=true"
     : "";
@@ -92,7 +96,7 @@ export function createBuildJob(options: BuildJobOptions): KubernetesJob {
     ...options.spec.buildArgs.map((arg) => `--opt=build-arg:${arg}`),
     `--import-cache=type=registry,ref=${options.cacheImage}${importCacheInsecure}`,
     `--export-cache=type=registry,ref=${options.cacheImage},mode=max${exportCacheInsecure}`,
-    `--output=type=image,name=${outputImage},push=true${outputInsecure}`,
+    `--output=type=image,${outputImages.length === 1 ? `name=${outputImage}` : `"name=${outputImages.join(",")}"`},push=true${outputInsecure}`,
   ];
   const labels = {
     "app.kubernetes.io/name": "kuber-buildkit",