Passes a credentials file to a build as a mounted secret rather than a build argument. This is the hardened pattern: the file is available during the build step but is never written into an image layer where anyone pulling the image could read it.