refactor build and bake inputs #55

crazy-max · 2025-12-04T12:42:26Z

relates to docker/buildx#3520 (review) and internal discussions.

Refactor the inputs for our workflows to be more consistent with our upstream actions and also avoid confusion like docker/buildx#3520 (review).

dvdksn · 2025-12-04T15:21:52Z

Yes @crazy-max would be great to keep examples here until we have something on docs.docker.com

crazy-max · 2025-12-05T10:05:54Z

@tonistiigi Pushed extra commit to remove GHA cache for now related to #56

.github/workflows/build.yml

tonistiigi · 2025-12-15T21:53:47Z

.github/workflows/build.yml

+      envs:
        type: string
-        description: "Which scope cache object belongs to if cache enabled (defaults to target name if set)"
+        description: "Environment variables to inject in the reusable workflow as list of key-value pair. This is similar to the GitHub Actions env context but as it cannot be used when calling a reusable workflow, we need to define our own input"


What is the use-case?

For build or bake, people might want to pass environment variables to the workflow for build-args with build or more importantly for bake to solve variables in the bake definition like: https://github.com/moby/buildkit/pull/6388/files#diff-edc3cacddc1f4df8e0e08c34f870525dffdf521312794ee0f1bccd1638534385R245-R248

After offline discussion let's remove this input. User can either use build-args or bake override.

tonistiigi · 2025-12-15T21:56:44Z

.github/workflows/build.yml

+        description: "List of build-time variables. If you want to set a build-arg through an environment variable, use the envs input"
        required: false
-      meta-tags:
+      context:


Do we validate that this can only be subpath for now? Should we call something like subpath.

I think we could be open to supporting external repositories here in the future but it should be create from the validation side that these would require a different kind of policy rules.

Do we validate that this can only be subpath for now? Should we call something like subpath.

Yes for build or bake this can only be a subdir of the Git context (defaults to .):

github-builder-experimental/.github/workflows/build.yml

Lines 349 to 350 in 4358d19

const buildContext = `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}.git#${process.env.GITHUB_REF}:${inpContext}`;

core.setOutput('context', buildContext);

github-builder-experimental/.github/workflows/bake.yml

Lines 221 to 224 in 4358d19

const bakeSource = `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}.git#${process.env.GITHUB_REF}:${inpContext}`;

await core.group(`Set bake source`, async () => {

core.info(bakeSource);

});

I think we could be open to supporting external repositories here in the future but it should be create from the validation side that these would require a different kind of policy rules.

I see yeah that makes sense

.github/workflows/build.yml

tonistiigi · 2025-12-15T21:59:34Z

.github/workflows/build.yml

+        description: "Raw authentication to registries, defined as YAML objects (for image output)"
        required: false
      github-token:
        description: "GitHub Token used to authenticate against a repository for Git context"


So this is for external Git repositories?

Not for external Git repos, we need to be able to fetch private repos which requires the GitHub Token set and used via GIT_AUTH_TOKEN:

github-builder-experimental/.github/workflows/build.yml

Line 422 in 4358d19

GIT_AUTH_TOKEN: ${{ secrets.github-token || github.token }}

github-builder-experimental/.github/workflows/bake.yml

Line 513 in 4358d19

BUILDX_BAKE_GIT_AUTH_TOKEN: ${{ secrets.github-token || github.token }}

Similar to what build-push-action and bake-action do today for Git context

crazy-max · 2025-12-17T11:07:47Z

README.md

+The [`build.yml` reusable workflow](.github/workflows/build.yml) lets you build
+container images and artifacts from a Dockerfile with a user experience similar
+to [`docker/build-push-action`](https://github.com/docker/build-push-action/).
+It provides a Docker-maintained, opinionated build pipeline that applies best
+practices for security, performance, and reliability by default, including
+isolated execution and signed SLSA provenanc while keeping per-repository
+configuration minimal.


@dvdksn Added this related to #61 (comment)

Can we add a similar but shorter note under the bake section to call out that it's a replacement for / composite of the docker/bake-action + ancillary support actions.

Yes I've done it in #65 but will move changes from this PR here.

Edit: moved and #65 closed

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

github-actions bot assigned crazy-max Dec 4, 2025

crazy-max force-pushed the build-inputs branch 9 times, most recently from 65a88d8 to ee9ed7a Compare December 4, 2025 14:10

crazy-max requested review from dvdksn and tonistiigi December 4, 2025 15:10

crazy-max marked this pull request as ready for review December 4, 2025 15:10

crazy-max force-pushed the build-inputs branch 3 times, most recently from c13ca88 to e9c5806 Compare December 5, 2025 09:39

crazy-max force-pushed the build-inputs branch 2 times, most recently from bb98b55 to d99e23b Compare December 5, 2025 12:42

crazy-max force-pushed the build-inputs branch from d99e23b to f432c1b Compare December 15, 2025 15:57

tonistiigi reviewed Dec 15, 2025

View reviewed changes

crazy-max force-pushed the build-inputs branch 3 times, most recently from 537c77b to e7da8ba Compare December 16, 2025 11:47

crazy-max mentioned this pull request Dec 16, 2025

readme: key advantages #61

Merged

crazy-max force-pushed the build-inputs branch 3 times, most recently from b9b7b8c to f37af04 Compare December 17, 2025 11:06

crazy-max commented Dec 17, 2025

View reviewed changes

crazy-max force-pushed the build-inputs branch from f37af04 to 94a49a8 Compare December 17, 2025 11:08

crazy-max added 2 commits December 17, 2025 12:11

build: refactor inputs

5be1246

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

build: remove gha cache

7eeaea0

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

crazy-max force-pushed the build-inputs branch from 94a49a8 to 7eeaea0 Compare December 17, 2025 11:11

ci: split build and bake tests

d90f277

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

crazy-max mentioned this pull request Dec 17, 2025

refactor build and bake inputs #65

Closed

crazy-max changed the title ~~build: refactor inputs~~ refactor build and bake inputs Dec 17, 2025

crazy-max added 3 commits December 18, 2025 10:30

bake: refactor inputs

e973509

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

bake: remove gha cache

6ef6598

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

remove envs input

6e46b8d

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

crazy-max force-pushed the build-inputs branch from f7e8450 to 6e46b8d Compare December 18, 2025 09:30

crazy-max merged commit dc9af42 into main Dec 18, 2025
112 checks passed

crazy-max deleted the build-inputs branch December 18, 2025 09:59

	const buildContext = `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}.git#${process.env.GITHUB_REF}:${inpContext}`;
	core.setOutput('context', buildContext);

	const bakeSource = `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}.git#${process.env.GITHUB_REF}:${inpContext}`;
	await core.group(`Set bake source`, async () => {
	core.info(bakeSource);
	});

refactor build and bake inputs #55

refactor build and bake inputs #55

Uh oh!

Conversation

crazy-max commented Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dvdksn commented Dec 4, 2025

Uh oh!

crazy-max commented Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

tonistiigi Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

crazy-max Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

crazy-max Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

tonistiigi Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

crazy-max Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

tonistiigi Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

crazy-max Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

crazy-max Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

dvdksn Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

crazy-max Dec 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

crazy-max commented Dec 4, 2025 •

edited

Loading

crazy-max commented Dec 5, 2025 •

edited

Loading

crazy-max Dec 16, 2025 •

edited

Loading

crazy-max Dec 16, 2025 •

edited

Loading

crazy-max Dec 16, 2025 •

edited

Loading

crazy-max Dec 17, 2025 •

edited

Loading