Use Task.Input's for env vars that will be otherwise cached

[nderraugh]

Problem:
If you run mill __.docker.buildImage with incorrectly set DOCKER_USERNAME and DOCKER_PASSWORD values they will be stored in the Task's output cache and used on future task executions due to the use of sys.env in MDShared object. Details (here)[https://mill-build.org/mill/fundamentals/tasks.html#_environment_variable_inputs].

Tentative Fix:
I put a draft together to test my own undertanding of Task.Input's. That's this PR.

Workaround:
The workaround is to delete the task cache, something like rm -rf out/, mill clean is insufficient.

[GeorgOfenbeck]

Hello @nderraugh,

I looked into it - you are right that stuff is cached - but i dont think he username/pw is the issue you are facing.

To verify i did the following:
Copied my "mill-docker/test/resources/examples-buildsettings" test out and used it as example.
Ran "mill project.docker.buildImage" -> checked whats actually cached.

Given the signature
"def buildImage: T[BuildResult] = T {" -> the output of this is cached.

e.g for my example a successful run would put the following file:
examples-buildsettings/out/project/docker/buildImage.json

If one runs the Task a second time (even with changed credentials) it will indeed not excute again.

However - if the credentials were incorrect the buildImage should not terminate successful and as such do not produce the .json file.

Reruning the task after it was unsuccesful (and thereby not cached) it will fetch changed credentials.

One can debate if buildImage is a Task that should have caching at all -> my idea at the time was that if none of the inputs change and it built successfully before you most likly do not want to rebuild.

Let me know if missed it somehow (in particular i would be curious if removing "just" out/project/docker/buildImage.json is sufficent for you case.

[nderraugh]

I was able to reproduce the behaviour using your examples-buildsettings with mill 0.12.10 as follows:

export DOCKER_USERNAME=nderraugh-asdf    #not my username
export DOCKER_PASSWORD=MYTOKEN    #replace with real token
mill project.docker.buildImage
... (wait for auth failure)
export DOCKER_USERNAME=nderraugh    #my username
mill project.docker.buildImage
...(wait for same auth failure)

Upon reproducing the same auth failure with the correct username and password delete the out directory and run:

mill project.docker.buildImage

At this point you should have a different error. I get:

[66] LogEvent:      I/O error for image [registry-1.docker.io/library/eclipse-temurin]:
[66] LogEvent:          java.net.SocketException
[66] LogEvent:          Socket closed
[66] LogEvent:      I/O error for image [registry-1.docker.io/library/eclipse-temurin]:
[66] LogEvent:          java.net.SocketException
[66] LogEvent:          Socket closed
[66/66, 1 failed] =====================

I do not have a out/project/docker/buildImage.json at any point. 🤔 But can reproduce the behaviour regardless.

I tried deleting bits and bobs, but haven't yet figured out the relationship to the file causing the problem. (I'll circle back when I have more time).

I think it makes sense to cache the buildImage task. But not if the inputs change. I realize this is probably an edge case for most people.