Repository navigation
Conversation
Ilyes512
changed the title
This was referenced Nov 9, 2026
Ilyes512
force-pushed
the
4.0/bake-workflow
branch
from
November 9, 2026 12:31
484dee1 to
62b2ff1
Compare
One call builds and publishes everything a consumer's docker-bake.hcl defines: - plan works out the version, the push decision and the other bake variables once, runs docker buildx bake --print and freezes the result, so every later job sees identical tags and labels (created included). - build runs once per platform, building every target for that platform in one bake invocation, and pushes by digest. - publish merges the digests per target with imagetools create and copies the labels onto the index and its descriptors. - status reports the result as a single "Image" check. push now follows the event instead of github.actor: no push for dependabot pull requests (also when a person re-runs them), pull requests from forks, dependabot branches, or events the tag rules don't cover. Build secrets come in through one build-secrets secret. Every input reaches the scripts through env, and every action is pinned by commit SHA. The plan job warns when the consumer's vendored specs.hcl differs from bake/specs.hcl at this version, by comparing it with SPECS_HCL_SHA256; lint.yml checks that hash, and tests the plan job's version and push rules. test-bake.yml runs the workflow on a test image (pushing only on a manual run), and builds, loads and runs one target the way a consumer's pull request test would.
They reach bake as REPOSITORY_NAME, REPOSITORY_DESCRIPTION and LICENSES, the fallbacks specs_labels uses for the title, description and licenses labels, so a migrated image keeps the labels metadata-action gave it. The repository is read once from the GitHub API with the token's contents: read; an unrecognised license (NOASSERTION) is left out. SPECS_HCL_SHA256 follows the specs.hcl change.
Ilyes512
force-pushed
the
4.0/bake-workflow
branch
from
November 9, 2026 14:01
62b2ff1 to
2177885
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One call builds and publishes every target in a consumer's bake files:
plan→build(one job per platform) →publish→status(Image).plan works out VERSION, push and the other bake variables once, runs
bake --printand freezes the result as an artifact. Every platform and the publish job therefore see identical tags and labels,createdincluded. It warns when the consumer'sspecs.hcldiffers from this version's (viaSPECS_HCL_SHA256). It also reads the repository's name, description and SPDX license from the GitHub API, as the fallbacks for thetitle,descriptionandlicenseslabels.build builds all targets for its platform in one
docker/bake-actionrun and pushes by digest. Cache scope is per image, target and platform. Default attestations are off, andattestin HCL opts in.publish runs
imagetools createper target, with the labels asindex:andmanifest-descriptor:annotations. It does no checkout.push follows the event: no push for dependabot PRs (also when re-run), fork PRs,
dependabot/*branches, or events the tag rules don't cover.Security:
build-secretsis a secret, not an input. All inputs go throughenv:.permissionsare set per job, all actions are pinned by SHA, and checkout usespersist-credentials: false.Runners:
ubuntu-26.04/ubuntu-26.04-armby default; therunnersinput overrides them.test-bake.ymlcalls the workflow with GitHub's$/self-repository syntax. actionlint 1.7.12 knows neither that syntax nor the 26.04 labels yet (Support the new$/self-repositoryuses:syntax rhysd/actionlint#711), so.github/actionlint.yamldeclares the labels (added in feat: add bake/specs.hcl with the shared tag, label and annotation rules #82) and ignores only the two$/format errors.Tests:
bake/test/plan.shruns the plan step's script, extracted with yq, for 18 GitHub contexts.test-bake.ymlruns the workflow on a test image (push only on a manual run withpushon) and aload: truePR-style test.created. A target with fewer platforms and anattestopt-in also worked.Part of the 4.0.0 stack (bake variant of the plan in #80). Merge bottom to top: #82 → #83 → #84 → #85 → #86.