BuildRun can override Build's Output image, but only the ref (not the secret)

[imjasonh]

Found while discussing #677 (comment)

Today, if a BuildRun specifies an output image to override its Build's output, only the ImageURL (ref) field is used, and if the BuildRun specifies credentials, those will always be ignored.

This brings up the question as well of having to decide what to do if the Build specifies credentials and the BuildRun doesn't (should the Build's creds be used instead?), or if the Build doesn't and the BuildRun does, etc.

/kind bug

[zhangtbj]

We had some discussion about what can be override or not in the BuildRun, here is the original ADR:
https://github.com/shipwright-io/build/blob/master/docs/proposals/build-execution-using-build-run.md#deciding-what-should-be-overridden

Because right now, we don't have full build.spec in the buildrun, so we just allow few properties to be override to avoid making config mess.

If we want to change something, let us also discuss or update in the ADR, so that we can discuss the potential problem and confirm the solution.

Thanks!

[qu1queee]

@zhangtbj thanks, but I still think this is just something we missed. From the proposal, adding the credentials in the BuildRun does not compromise the integrity of the Build, so I think is fine to do.

[qu1queee]

@sbose78 also asked on this when this override in the BuildRun was introduced, see his comment

[adambkaplan]

Summarizing discussion in the grooming call - this is something we should fix. It is prompting a broader discussion of when and why a user would need to override fields on the Build object when running a specific build.