Skip to content

Commit 3d5fa9b

Browse files
crazy-maxcrazy-max
authored
Merge pull request #277 from crazy-max/bake-vars
bake: pass variables explicitly to buildx
2 parents 377ca3c + fcb5a0c commit 3d5fa9b

5 files changed

Lines changed: 115 additions & 44 deletions

File tree

‎.github/workflows/.test-bake.yml‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -598,13 +598,20 @@ jobs:
598598
contents: read
599599
id-token: write
600600
with:
601-
setup-qemu: true
602-
artifact-upload: false
603601
context: test
604-
output: local
605-
target: go
602+
output: image
603+
push: false
604+
target: vars
606605
vars: |
607606
XX_VERSION=1.9.0
607+
DOCKER_METADATA_OUTPUT_VERSION=caller-version
608+
meta-images: example/app
609+
meta-tags: |
610+
type=raw,value=vars-one
611+
type=raw,value=vars-two
612+
meta-labels: |
613+
org.example.vars.one=one
614+
org.example.vars.two=two
608615
609616
bake-auth-scope:
610617
uses: ./.github/workflows/bake.yml

‎.github/workflows/bake.yml‎

Lines changed: 29 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -342,6 +342,7 @@ jobs:
342342
const { GitHub } = require('@docker/github-builder-runtime/lib/github/github');
343343
const { RunnerMapping } = require('@docker/github-builder-runtime/lib/github-builder/runner-mapping');
344344
const { BakeTargets } = require('@docker/github-builder-runtime/lib/github-builder/bake-targets');
345+
const { BakeVars } = require('@docker/github-builder-runtime/lib/github-builder/bake-vars');
345346
const { Util } = require('@docker/github-builder-runtime/lib/util');
346347
347348
const inpSbomImage = core.getInput('sbom-image');
@@ -354,7 +355,7 @@ jobs:
354355
const inpArtifactUpload = core.getBooleanInput('artifact-upload');
355356
const inpJobNamePrefix = core.getInput('job-name-prefix');
356357
const inpContext = core.getInput('context');
357-
const inpVars = Util.getInputList('vars');
358+
const inpVars = Util.getInputList('vars', {ignoreComma: true, quote: false});
358359
const inpFiles = Util.getInputList('files');
359360
const inpOutput = core.getInput('output');
360361
const inpPush = core.getBooleanInput('push');
@@ -404,21 +405,12 @@ jobs:
404405
}
405406
const registryLogin = inpRegistryLogin === 'auto' ? inpOutput === 'image' && inpPush : inpRegistryLogin === 'true';
406407
407-
const envs = Object.assign({},
408-
inpVars ? inpVars.reduce((acc, curr) => {
409-
const idx = curr.indexOf('=');
410-
if (idx !== -1) {
411-
acc[curr.substring(0, idx)] = curr.substring(idx + 1);
412-
}
413-
return acc;
414-
}, {}) : {},
415-
{
416-
BUILDKIT_MULTI_PLATFORM: '1',
417-
BUILDX_BAKE_GIT_AUTH_TOKEN: inpGitHubToken
418-
}
419-
);
420-
await core.group(`Set envs`, async () => {
421-
core.info(JSON.stringify(Object.keys(envs).sort(), null, 2));
408+
const bakeVars = BakeVars.resolve(inpVars);
409+
await core.group(`Set bake vars`, async () => {
410+
core.info(JSON.stringify(bakeVars.map(value => {
411+
const idx = value.indexOf('=');
412+
return idx === -1 ? '<invalid>' : value.substring(0, idx);
413+
}).sort(), null, 2));
422414
});
423415
424416
const metaImages = inpMetaImages.map(image => image.toLowerCase());
@@ -443,9 +435,14 @@ jobs:
443435
overrides: [...validationOverrides, '*.secrets='],
444436
sbom: inpSbom ? `generator=${inpSbomImage}` : 'false',
445437
source: bakeSource,
446-
targets: [inpTarget]
438+
targets: [inpTarget],
439+
vars: bakeVars,
440+
githubToken: inpGitHubToken
447441
}, {
448-
env: Object.keys(envs).length > 0 ? envs : undefined
442+
env: {
443+
BUILDKIT_MULTI_PLATFORM: '1',
444+
BUILDX_BAKE_DISABLE_VARS_ENV_LOOKUP: '1'
445+
}
449446
});
450447
if (!def) {
451448
throw new Error('Bake definition not set');
@@ -852,6 +849,7 @@ jobs:
852849
const os = require('os');
853850
const { Build } = require('@docker/github-builder-runtime/lib/buildx/build');
854851
const { BuildSecrets } = require('@docker/github-builder-runtime/lib/github-builder/build-secrets');
852+
const { BakeVars } = require('@docker/github-builder-runtime/lib/github-builder/bake-vars');
855853
const { GitHub } = require('@docker/github-builder-runtime/lib/github/github');
856854
const { Util } = require('@docker/github-builder-runtime/lib/util');
857855
@@ -874,7 +872,7 @@ jobs:
874872
const inpSbom = core.getBooleanInput('sbom');
875873
const inpSet = Util.getInputList('set', {ignoreComma: true, quote: false});
876874
const inpTarget = core.getInput('target');
877-
const inpVars = Util.getInputList('vars');
875+
const inpVars = Util.getInputList('vars', {ignoreComma: true, quote: false});
878876
const inpBuildkitProxyNetwork = core.getBooleanInput('buildkit-proxy-network');
879877
880878
const inpMetaImages = core.getMultilineInput('meta-images');
@@ -919,27 +917,15 @@ jobs:
919917
}
920918
core.setOutput('secret-dir', buildSecrets.directory);
921919
922-
const envs = Object.assign({},
923-
inpVars ? inpVars.reduce((acc, curr) => {
924-
const idx = curr.indexOf('=');
925-
if (idx !== -1) {
926-
acc[curr.substring(0, idx)] = curr.substring(idx + 1);
927-
}
928-
return acc;
929-
}, {}) : {},
930-
{
931-
BUILDKIT_MULTI_PLATFORM: '1'
932-
}
933-
);
934-
935-
// Git authentication is supplied directly to the Bake action.
936-
delete envs.BUILDX_BAKE_GIT_AUTH_TOKEN;
937-
938-
await core.group(`Set envs`, async () => {
939-
core.info(JSON.stringify(Object.keys(envs).sort(), null, 2));
940-
core.setOutput('envs', JSON.stringify(envs));
920+
const bakeVars = BakeVars.resolve(inpVars);
921+
await core.group(`Set bake vars`, async () => {
922+
core.info(JSON.stringify(bakeVars.map(value => {
923+
const idx = value.indexOf('=');
924+
return idx === -1 ? '<invalid>' : value.substring(0, idx);
925+
}).sort(), null, 2));
926+
core.setOutput('vars', JSON.stringify(bakeVars));
941927
});
942-
928+
943929
let bakeFiles = inpFiles;
944930
await core.group(`Set bake files`, async () => {
945931
if (bakeFiles.length === 0) {
@@ -1014,8 +1000,11 @@ jobs:
10141000
targets: ${{ steps.prepare.outputs.target }}
10151001
sbom: ${{ steps.prepare.outputs.sbom }}
10161002
set: ${{ steps.prepare.outputs.overrides }}
1003+
vars: ${{ steps.prepare.outputs.vars }}
10171004
github-token: ${{ secrets.github-token || github.token }}
1018-
env: ${{ fromJson(steps.prepare.outputs.envs || '{}') }}
1005+
env:
1006+
BUILDKIT_MULTI_PLATFORM: '1'
1007+
BUILDX_BAKE_DISABLE_VARS_ENV_LOOKUP: '1'
10191008
-
10201009
name: Remove build secrets
10211010
if: ${{ always() && steps.prepare.outputs.secret-dir != '' }}

‎README.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -375,6 +375,14 @@ jobs:
375375
| `meta-flavor` | List | | [Flavor](https://github.com/docker/metadata-action?tab=readme-ov-file#flavor-input) defines a global behavior for `meta-tags` |
376376
| `buildkit-proxy-network` | Bool | `false` | Enable BuildKit proxy network mode for default Dockerfile `RUN` networking. See [BuildKit proxy network](#buildkit-proxy-network). |
377377

378+
> [!NOTE]
379+
> The `vars` input is passed to Buildx as explicit Bake variables. Ambient
380+
> environment lookup for Bake variables is disabled. The `CI` environment variable
381+
> and variables with `GITHUB_`, `RUNNER_`, or `DOCKER_METADATA_OUTPUT_` prefixes
382+
> are forwarded as explicit vars for workflows that declare them in their Bake
383+
> definition. Multiline metadata values are preserved. Caller-provided vars take
384+
> precedence over these forwarded values.
385+
378386
### Secrets
379387

380388
| Name | Default | Description |

‎test/docker-bake.hcl‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,34 @@ variable "XX_VERSION" {
1515
default = null
1616
}
1717

18+
variable "BUILDX_VERSION" {
19+
default = "not-leaked"
20+
}
21+
22+
variable "CI" {
23+
default = ""
24+
}
25+
26+
variable "GITHUB_SHA" {
27+
default = ""
28+
}
29+
30+
variable "RUNNER_OS" {
31+
default = ""
32+
}
33+
34+
variable "DOCKER_METADATA_OUTPUT_VERSION" {
35+
default = ""
36+
}
37+
38+
variable "DOCKER_METADATA_OUTPUT_TAGS" {
39+
default = ""
40+
}
41+
42+
variable "DOCKER_METADATA_OUTPUT_LABELS" {
43+
default = ""
44+
}
45+
1846
target "go" {
1947
inherits = ["docker-metadata-action"]
2048
args = {
@@ -23,6 +51,20 @@ target "go" {
2351
dockerfile = "go.Dockerfile"
2452
}
2553

54+
target "vars" {
55+
args = {
56+
BUILDX_VERSION = BUILDX_VERSION
57+
CI = CI
58+
GITHUB_SHA = GITHUB_SHA
59+
RUNNER_OS = RUNNER_OS
60+
XX_VERSION = XX_VERSION
61+
DOCKER_METADATA_OUTPUT_VERSION = DOCKER_METADATA_OUTPUT_VERSION
62+
DOCKER_METADATA_OUTPUT_TAGS = DOCKER_METADATA_OUTPUT_TAGS
63+
DOCKER_METADATA_OUTPUT_LABELS = DOCKER_METADATA_OUTPUT_LABELS
64+
}
65+
dockerfile = "vars.Dockerfile"
66+
}
67+
2668
target "go-cross" {
2769
inherits = ["go"]
2870
platforms = ["linux/amd64", "linux/arm64"]

‎test/vars.Dockerfile‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# syntax=docker/dockerfile:1
2+
3+
FROM alpine
4+
ARG BUILDX_VERSION
5+
ARG CI
6+
ARG GITHUB_SHA
7+
ARG RUNNER_OS
8+
ARG XX_VERSION
9+
ARG DOCKER_METADATA_OUTPUT_VERSION
10+
ARG DOCKER_METADATA_OUTPUT_TAGS
11+
ARG DOCKER_METADATA_OUTPUT_LABELS
12+
RUN test "$BUILDX_VERSION" = "not-leaked"
13+
RUN test "$CI" = "true"
14+
RUN test -n "$GITHUB_SHA"
15+
RUN test -n "$RUNNER_OS"
16+
RUN test "$XX_VERSION" = "1.9.0"
17+
RUN test "$DOCKER_METADATA_OUTPUT_VERSION" = "caller-version"
18+
RUN printf '%s\n' "$DOCKER_METADATA_OUTPUT_TAGS" | grep -Fx 'example/app:vars-one' \
19+
&& printf '%s\n' "$DOCKER_METADATA_OUTPUT_TAGS" | grep -Fx 'example/app:vars-two'
20+
RUN printf '%s\n' "$DOCKER_METADATA_OUTPUT_LABELS" | grep -Fx 'org.example.vars.one=one' \
21+
&& printf '%s\n' "$DOCKER_METADATA_OUTPUT_LABELS" | grep -Fx 'org.example.vars.two=two'
22+
RUN mkdir -p /out && printf 'ok\n' > /out/vars.txt
23+
24+
FROM scratch
25+
COPY --from=0 /out /

0 commit comments

Comments
 (0)