Как передать секретные данные для скачивания Python пакетов с git сервиса при сборке docker образа?

Вариант I

.gitlab-ci-yml

build:
  before_script:
    - echo "https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.specialistoff.net" > .git-credentials
  script:
    - >
      docker build
      -t $IMAGE_NAME:${CI_COMMIT_REF_SLUG}
      --file .cicd/Dockerfile
      --progress=plain
      --secret id=gitcred,src=.git-credentials
      --target product
      --label "image.branch=$CI_COMMIT_BRANCH"
      --label "image.created=$CI_JOB_STARTED_AT"
      --label "image.revision=$CI_COMMIT_SHA"
      --label "image.title=$CI_PROJECT_TITLE"
      --label "image.url=$CI_PROJECT_URL"
      --label "image.version=$CI_COMMIT_REF_NAME"
      .
    - docker push $IMAGE_NAME:${CI_COMMIT_REF_SLUG}

Dockerfile

FROM registry.specialistoff.net/toolchain AS builder

WORKDIR /build

RUN pip install build

COPY . .

RUN python3 -m build

FROM registry.specialistoff.net/toolchain AS product

ENV PYTHONUNBUFFERED=1

RUN git config --global credential.helper 'store --file /root/.git-credentials'

WORKDIR /app

COPY deploy/requirements.txt /root/requirements.txt
RUN --mount=type=secret,id=gitcred,target=/root/.git-credentials \
    pip install -r /root/requirements.txt

COPY --from=builder /build/dist /root/
RUN --mount=type=secret,id=gitcred,target=/root/.git-credentials \
    pip install --use-pep517 /root/worker-0.2-py3-none-any.whl

Вариант II (который у меня не заработал)

build:
  before_script:
    - echo "machine gitlab.specialistoff.net" > ~/.netrc
    - echo "login gitlab-ci-token" >> ~/.netrc
    - echo "password ${CI_JOB_TOKEN}" >> ~/.netrc