Pass NPM_TOKEN through docker --secret

packages/create-app/templates/default-app/package.json.hbs

@@ -8,7 +8,7 @@
   "scripts": {
     "start": "yarn workspace app start",
     "build": "lerna run build",
-    "build-image": "yarn workspace backend build-image --build-arg NPM_TOKEN",
+    "build-image": "DOCKER_BUILDKIT=1 yarn workspace backend build-image",
     "tsc": "tsc",
     "tsc:full": "tsc --skipLibCheck false --incremental false",
     "clean": "backstage-cli clean && lerna run clean",

packages/create-app/templates/default-app/packages/backend/Dockerfile

@@ -1,5 +1,5 @@
+# syntax = docker/dockerfile:1.0-experimental
 FROM node:12-buster
-ARG NPM_TOKEN
 
 WORKDIR /usr/src/app
 
@@ -8,7 +8,7 @@ WORKDIR /usr/src/app
 # and along with yarn.lock and the root package.json, that's enough to run yarn install.
 ADD .npmrc* yarn.lock package.json skeleton.tar ./
 
-RUN yarn install --frozen-lockfile --production --network-timeout 300000 && rm -rf "$(yarn cache dir)"
+RUN --mount=type=secret,id=NPM_TOKEN NPM_TOKEN=$(cat /run/secrets/NPM_TOKEN) yarn install --frozen-lockfile --production --network-timeout 300000 && rm -rf "$(yarn cache dir)"
 
 # This will copy the contents of the dist-workspace when running the build-image command.
 # Do not use this Dockerfile outside of that command, as it will copy in the source code instead.