Skip to content

Commit 24c9901

Browse files
crazy-maxcrazy-max
committed
bake: pass variables explicitly to buildx
Disable Bake environment variable lookup so workflow and runner environment values do not implicitly override Bake variables. Forward only GITHUB_ and RUNNER_ prefixed values as explicit Bake vars, then pass the caller vars input through docker/bake-action. Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
1 parent 9a2f6f6 commit 24c9901

5 files changed

Lines changed: 86 additions & 32 deletions

File tree

‎.github/workflows/.test-bake.yml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -598,11 +598,10 @@ jobs:
598598
contents: read
599599
id-token: write
600600
with:
601-
setup-qemu: true
602601
artifact-upload: false
603602
context: test
604603
output: local
605-
target: go
604+
target: vars
606605
vars: |
607606
XX_VERSION=1.9.0
608607

‎.github/workflows/bake.yml‎

Lines changed: 34 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -342,6 +342,7 @@ jobs:
342342
const { GitHub } = require('@docker/github-builder-runtime/lib/github/github');
343343
const { RunnerMapping } = require('@docker/github-builder-runtime/lib/github-builder/runner-mapping');
344344
const { BakeTargets } = require('@docker/github-builder-runtime/lib/github-builder/bake-targets');
345+
const { BakeVars } = require('@docker/github-builder-runtime/lib/github-builder/bake-vars');
345346
const { Util } = require('@docker/github-builder-runtime/lib/util');
346347
347348
const inpSbomImage = core.getInput('sbom-image');
@@ -354,7 +355,7 @@ jobs:
354355
const inpArtifactUpload = core.getBooleanInput('artifact-upload');
355356
const inpJobNamePrefix = core.getInput('job-name-prefix');
356357
const inpContext = core.getInput('context');
357-
const inpVars = Util.getInputList('vars');
358+
const inpVars = Util.getInputList('vars', {ignoreComma: true, quote: false});
358359
const inpFiles = Util.getInputList('files');
359360
const inpOutput = core.getInput('output');
360361
const inpPush = core.getBooleanInput('push');
@@ -404,19 +405,20 @@ jobs:
404405
}
405406
const registryLogin = inpRegistryLogin === 'auto' ? inpOutput === 'image' && inpPush : inpRegistryLogin === 'true';
406407
407-
const envs = Object.assign({},
408-
inpVars ? inpVars.reduce((acc, curr) => {
409-
const idx = curr.indexOf('=');
410-
if (idx !== -1) {
411-
acc[curr.substring(0, idx)] = curr.substring(idx + 1);
412-
}
413-
return acc;
414-
}, {}) : {},
415-
{
416-
BUILDKIT_MULTI_PLATFORM: '1',
417-
BUILDX_BAKE_GIT_AUTH_TOKEN: inpGitHubToken
418-
}
419-
);
408+
const bakeVars = BakeVars.resolve(inpVars);
409+
const bakeVarKeys = bakeVars.map(value => {
410+
const idx = value.indexOf('=');
411+
return idx === -1 ? '<invalid>' : value.substring(0, idx);
412+
});
413+
await core.group(`Set bake vars`, async () => {
414+
core.info(JSON.stringify(bakeVarKeys.sort(), null, 2));
415+
});
416+
417+
const envs = {
418+
BUILDKIT_MULTI_PLATFORM: '1',
419+
BUILDX_BAKE_DISABLE_VARS_ENV_LOOKUP: '1',
420+
BUILDX_BAKE_GIT_AUTH_TOKEN: inpGitHubToken
421+
};
420422
await core.group(`Set envs`, async () => {
421423
core.info(JSON.stringify(Object.keys(envs).sort(), null, 2));
422424
});
@@ -443,7 +445,8 @@ jobs:
443445
overrides: [...validationOverrides, '*.secrets='],
444446
sbom: inpSbom ? `generator=${inpSbomImage}` : 'false',
445447
source: bakeSource,
446-
targets: [inpTarget]
448+
targets: [inpTarget],
449+
vars: bakeVars
447450
}, {
448451
env: Object.keys(envs).length > 0 ? envs : undefined
449452
});
@@ -851,6 +854,7 @@ jobs:
851854
const os = require('os');
852855
const { Build } = require('@docker/github-builder-runtime/lib/buildx/build');
853856
const { BuildSecrets } = require('@docker/github-builder-runtime/lib/github-builder/build-secrets');
857+
const { BakeVars } = require('@docker/github-builder-runtime/lib/github-builder/bake-vars');
854858
const { GitHub } = require('@docker/github-builder-runtime/lib/github/github');
855859
const { Util } = require('@docker/github-builder-runtime/lib/util');
856860
@@ -873,7 +877,7 @@ jobs:
873877
const inpSbom = core.getBooleanInput('sbom');
874878
const inpSet = Util.getInputList('set', {ignoreComma: true, quote: false});
875879
const inpTarget = core.getInput('target');
876-
const inpVars = Util.getInputList('vars');
880+
const inpVars = Util.getInputList('vars', {ignoreComma: true, quote: false});
877881
const inpBuildkitProxyNetwork = core.getBooleanInput('buildkit-proxy-network');
878882
879883
const inpMetaImages = core.getMultilineInput('meta-images');
@@ -918,21 +922,20 @@ jobs:
918922
}
919923
core.setOutput('secret-dir', buildSecrets.directory);
920924
921-
const envs = Object.assign({},
922-
inpVars ? inpVars.reduce((acc, curr) => {
923-
const idx = curr.indexOf('=');
924-
if (idx !== -1) {
925-
acc[curr.substring(0, idx)] = curr.substring(idx + 1);
926-
}
927-
return acc;
928-
}, {}) : {},
929-
{
930-
BUILDKIT_MULTI_PLATFORM: '1'
931-
}
932-
);
925+
const bakeVars = BakeVars.resolve(inpVars);
926+
const bakeVarKeys = bakeVars.map(value => {
927+
const idx = value.indexOf('=');
928+
return idx === -1 ? '<invalid>' : value.substring(0, idx);
929+
});
930+
await core.group(`Set bake vars`, async () => {
931+
core.info(JSON.stringify(bakeVarKeys.sort(), null, 2));
932+
core.setOutput('vars', bakeVars.join(os.EOL));
933+
});
933934
934-
// Git authentication is supplied directly to the Bake action.
935-
delete envs.BUILDX_BAKE_GIT_AUTH_TOKEN;
935+
const envs = {
936+
BUILDKIT_MULTI_PLATFORM: '1',
937+
BUILDX_BAKE_DISABLE_VARS_ENV_LOOKUP: '1'
938+
};
936939
937940
await core.group(`Set envs`, async () => {
938941
core.info(JSON.stringify(Object.keys(envs).sort(), null, 2));
@@ -1013,6 +1016,7 @@ jobs:
10131016
targets: ${{ steps.prepare.outputs.target }}
10141017
sbom: ${{ steps.prepare.outputs.sbom }}
10151018
set: ${{ steps.prepare.outputs.overrides }}
1019+
vars: ${{ steps.prepare.outputs.vars }}
10161020
github-token: ${{ secrets.github-token || github.token }}
10171021
env: ${{ fromJson(steps.prepare.outputs.envs || '{}') }}
10181022
-

‎README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -375,6 +375,13 @@ jobs:
375375
| `meta-flavor` | List | | [Flavor](https://github.com/docker/metadata-action?tab=readme-ov-file#flavor-input) defines a global behavior for `meta-tags` |
376376
| `buildkit-proxy-network` | Bool | `false` | Enable BuildKit proxy network mode for default Dockerfile `RUN` networking. See [BuildKit proxy network](#buildkit-proxy-network). |
377377

378+
> [!NOTE]
379+
> The `vars` input is passed to Buildx as explicit Bake variables. Ambient
380+
> environment lookup for Bake variables is disabled. The `CI` environment variable
381+
> and variables with `GITHUB_` or `RUNNER_` prefixes are forwarded as explicit vars
382+
> for workflows that declare them in their Bake definition. Caller-provided vars
383+
> take precedence over these forwarded values.
384+
378385
### Secrets
379386

380387
| Name | Default | Description |

‎test/docker-bake.hcl‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,22 @@ variable "XX_VERSION" {
1515
default = null
1616
}
1717

18+
variable "BUILDX_VERSION" {
19+
default = "not-leaked"
20+
}
21+
22+
variable "CI" {
23+
default = ""
24+
}
25+
26+
variable "GITHUB_SHA" {
27+
default = ""
28+
}
29+
30+
variable "RUNNER_OS" {
31+
default = ""
32+
}
33+
1834
target "go" {
1935
inherits = ["docker-metadata-action"]
2036
args = {
@@ -23,6 +39,17 @@ target "go" {
2339
dockerfile = "go.Dockerfile"
2440
}
2541

42+
target "vars" {
43+
args = {
44+
BUILDX_VERSION = BUILDX_VERSION
45+
CI = CI
46+
GITHUB_SHA = GITHUB_SHA
47+
RUNNER_OS = RUNNER_OS
48+
XX_VERSION = XX_VERSION
49+
}
50+
dockerfile = "vars.Dockerfile"
51+
}
52+
2653
target "go-cross" {
2754
inherits = ["go"]
2855
platforms = ["linux/amd64", "linux/arm64"]

‎test/vars.Dockerfile‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# syntax=docker/dockerfile:1
2+
3+
FROM alpine
4+
ARG BUILDX_VERSION
5+
ARG CI
6+
ARG GITHUB_SHA
7+
ARG RUNNER_OS
8+
ARG XX_VERSION
9+
RUN test "$BUILDX_VERSION" = "not-leaked"
10+
RUN test "$CI" = "true"
11+
RUN test -n "$GITHUB_SHA"
12+
RUN test -n "$RUNNER_OS"
13+
RUN test "$XX_VERSION" = "1.9.0"
14+
RUN mkdir -p /out && printf 'ok\n' > /out/vars.txt
15+
16+
FROM scratch
17+
COPY --from=0 /out /

0 commit comments

Comments
 (0)