Fix: respect required: false for env_file in publish command

pkg/compose/publish.go

@@ -251,6 +251,11 @@ func processFile(ctx context.Context, file string, project *types.Project, extFi
 	}
 	for name, service := range base.Services {
 		for i, envFile := range service.EnvFiles {
+			if !envFile.Required {
+				if _, err := os.Stat(envFile.Path); os.IsNotExist(err) {
+					continue
+				}
+			}
 			hash := fmt.Sprintf("%x.env", sha256.Sum256([]byte(envFile.Path)))
 			envFiles[envFile.Path] = hash
 			f, err = transform.ReplaceEnvFile(f, name, i, hash)
@@ -351,8 +356,11 @@ func (s *composeService) checkEnvironmentVariables(project *types.Project, optio
 	errorList := map[string][]string{}
 
 	for _, service := range project.Services {
-		if len(service.EnvFiles) > 0 {
-			errorList[service.Name] = append(errorList[service.Name], fmt.Sprintf("service %q has env_file declared.", service.Name))
+		for _, envFile := range service.EnvFiles {
+			if envFile.Required {
+				errorList[service.Name] = append(errorList[service.Name], fmt.Sprintf("service %q has required env_file declared.", service.Name))
+				break
+			}
 		}
 	}
 
@@ -438,6 +446,12 @@ func (s *composeService) checkForSensitiveData(project *types.Project) ([]secret
 	for _, service := range project.Services {
 		// Check env files
 		for _, envFile := range service.EnvFiles {
+			// Skip optional env files that don't exist
+			if !envFile.Required {
+				if _, err := os.Stat(envFile.Path); os.IsNotExist(err) {
+					continue
+				}
+			}
 			findings, err := scan.ScanFile(envFile.Path)
 			if err != nil {
 				return nil, fmt.Errorf("failed to scan env file %s: %w", envFile.Path, err)

pkg/compose/publish_test.go

@@ -18,6 +18,7 @@ package compose
 
 import (
 	"slices"
+	"strings"
 	"testing"
 
 	"github.com/compose-spec/compose-go/v2/loader"
@@ -100,3 +101,75 @@ services:
 		return !slices.Contains([]string{".Data", ".Digest", ".Size"}, path.String())
 	}, cmp.Ignore()))
 }
+
+func Test_createLayers_withRequiredFalse(t *testing.T) {
+	project, err := loader.LoadWithContext(t.Context(), types.ConfigDetails{
+		WorkingDir:  "testdata/publish/",
+		Environment: types.Mapping{},
+		ConfigFiles: []types.ConfigFile{
+			{
+				Filename: "testdata/publish/compose-required-false.yaml",
+			},
+		},
+	})
+	assert.NilError(t, err)
+	project.ComposeFiles = []string{"testdata/publish/compose-required-false.yaml"}
+
+	service := &composeService{}
+	layers, err := service.createLayers(t.Context(), project, api.PublishOptions{
+		WithEnvironment: true,
+	})
+	assert.NilError(t, err)
+
+	assert.Equal(t, len(layers), 3)
+
+	assert.Equal(t, layers[0].Annotations["com.docker.compose.file"], "compose-required-false.yaml")
+
+	assert.Equal(t, layers[1].MediaType, "application/vnd.docker.compose.envfile")
+	assert.Equal(t, layers[2].MediaType, "application/vnd.docker.compose.envfile")
+
+	envFileHashes := []string{
+		layers[1].Annotations["com.docker.compose.envfile"],
+		layers[2].Annotations["com.docker.compose.envfile"],
+	}
+	assert.Assert(t, envFileHashes[0] != "")
+	assert.Assert(t, envFileHashes[1] != "")
+	assert.Assert(t, envFileHashes[0] != "missing.env")
+	assert.Assert(t, envFileHashes[1] != "missing.env")
+}
+
+func Test_checkEnvironmentVariables_withRequiredFalse(t *testing.T) {
+	project := &types.Project{
+		Services: types.Services{
+			"test": {
+				Name: "test",
+				EnvFiles: []types.EnvFile{
+					{
+						Path:     "missing.env",
+						Required: false,
+					},
+					{
+						Path:     "existing.env",
+						Required: true,
+					},
+				},
+			},
+			"test2": {
+				Name: "test2",
+				EnvFiles: []types.EnvFile{
+					{
+						Path:     "optional.env",
+						Required: false,
+					},
+				},
+			},
+		},
+	}
+
+	service := &composeService{}
+
+	err := service.checkEnvironmentVariables(project, api.PublishOptions{})
+	assert.Assert(t, err != nil)
+	assert.Assert(t, strings.Contains(err.Error(), `service "test" has required env_file declared.`))
+	assert.Assert(t, !strings.Contains(err.Error(), `service "test2"`))
+}

pkg/compose/testdata/publish/compose-required-false.yaml

@@ -0,0 +1,11 @@
+name: test-required-false
+services:
+  test:
+    image: test
+    env_file:
+      - path: missing.env
+        required: false
+      - path: optional.env
+        required: false
+      - path: existing.env
+        required: true

pkg/compose/testdata/publish/existing.env

@@ -0,0 +1 @@
+EXISTING_VAR=value

pkg/compose/testdata/publish/optional.env

@@ -0,0 +1 @@
+OPTIONAL_VAR=value