Merge pull request #350 from docker/dependabot/github_actions/actions/github-script-8

chore(deps): Bump actions/github-script from 7 to 8
2025-12-06 15:58:07 +08:00 · 2025-09-13 13:12:26 +02:00 · 2025-09-04 23:01:25 +00:00 · 2025-08-20 17:02:25 +02:00 · 2025-08-20 16:56:24 +02:00 · 2025-08-20 16:54:19 +02:00
26 changed files with 3223 additions and 2845 deletions
--- a/.github/subaction-list-targets.png
+++ b/.github/subaction-list-targets.png
--- a/.github/subaction-matrix.png
+++ b/.github/subaction-matrix.png
--- a/.github/workflows/ci-subaction.yml
+++ b/.github/workflows/ci-subaction.yml
@@ -25,75 +25,112 @@ on:
      - 'test/**'

 jobs:
-  list-targets-group:
+  list-targets:
    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          -
+            testdir: group
+            expected: >
+              ["t1","t2"]
+          -
+            testdir: group-matrix
+            target: validate
+            expected: >
+              ["lint-default","lint-labs","lint-nydus","lint-proto","lint-yaml","validate-doctoc","validate-vendor"]
+          -
+            testdir: multi-files
+            files: |
+              docker-bake.json
+              docker-bake.hcl
+            expected: >
+              ["v1-tag","v2-tag"]
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Matrix gen
        id: gen
        uses: ./subaction/list-targets
        with:
-          workdir: ./test/group
+          workdir: ./test/${{ matrix.testdir }}
+          files: ${{ matrix.files }}
+          target: ${{ matrix.target }}
      -
-        name: Check targets
-        uses: actions/github-script@v7
+        name: Check output
+        uses: actions/github-script@v8
+        env:
+          INPUT_TARGETS: ${{ steps.gen.outputs.targets }}
+          INPUT_EXPECTED: ${{ matrix.expected }}
        with:
          script: |
-            const targets = `${{ steps.gen.outputs.targets }}`;
-            if (!targets) {
-              core.setFailed('No targets generated');
+            const targets = JSON.stringify(JSON.parse(core.getInput('targets')));
+            const expected = JSON.stringify(JSON.parse(core.getInput('expected')));
+            if (targets !== expected) {
+              throw new Error(`Targets do not match expected values: ${targets} != ${expected}`);
+            } else {
+              core.info(`✅`);
            }
-            core.info(`targets=${targets}`);

-  list-targets-group-matrix:
+  matrix:
    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          -
+            testdir: group
+            expected: >
+              [{"target":"t1"},{"target":"t2"}]
+          -
+            testdir: group-matrix
+            target: validate
+            expected: >
+              [{"target":"lint-default"},{"target":"lint-labs"},{"target":"lint-nydus"},{"target":"lint-proto"},{"target":"lint-yaml"},{"target":"validate-doctoc"},{"target":"validate-vendor"}]
+          -
+            testdir: group-with-platform
+            target: validate
+            expected: >
+              [{"target":"lint"},{"target":"lint-gopls"},{"target":"validate-docs"},{"target":"validate-vendor"}]
+          -
+            testdir: group-with-platform
+            target: validate
+            fields: platforms
+            expected: >
+              [{"target":"lint","platforms":"darwin/amd64"},{"target":"lint","platforms":"darwin/arm64"},{"target":"lint","platforms":"linux/amd64"},{"target":"lint","platforms":"linux/arm64"},{"target":"lint","platforms":"linux/s390x"},{"target":"lint","platforms":"linux/ppc64le"},{"target":"lint","platforms":"linux/riscv64"},{"target":"lint","platforms":"windows/amd64"},{"target":"lint","platforms":"windows/arm64"},{"target":"lint-gopls","platforms":"darwin/amd64"},{"target":"lint-gopls","platforms":"darwin/arm64"},{"target":"lint-gopls","platforms":"linux/amd64"},{"target":"lint-gopls","platforms":"linux/arm64"},{"target":"lint-gopls","platforms":"linux/s390x"},{"target":"lint-gopls","platforms":"linux/ppc64le"},{"target":"lint-gopls","platforms":"linux/riscv64"},{"target":"lint-gopls","platforms":"windows/amd64"},{"target":"lint-gopls","platforms":"windows/arm64"},{"target":"validate-docs"},{"target":"validate-vendor"}]
+          -
+            testdir: group-with-platform
+            target: validate
+            fields: platforms,dockerfile
+            expected: >
+               [{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile"},{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"darwin/amd64"},{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"darwin/arm64"},{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/amd64"},{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/arm64"},{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/s390x"},{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/ppc64le"},{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/riscv64"},{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"windows/amd64"},{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"windows/arm64"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"darwin/amd64"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"darwin/arm64"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/amd64"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/arm64"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/s390x"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/ppc64le"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/riscv64"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"windows/amd64"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"windows/arm64"},{"target":"validate-docs","dockerfile":"./hack/dockerfiles/docs.Dockerfile"},{"target":"validate-vendor","dockerfile":"./hack/dockerfiles/vendor.Dockerfile"}]
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Matrix gen
        id: gen
-        uses: ./subaction/list-targets
+        uses: ./subaction/matrix
        with:
-          workdir: ./test/group-matrix
-          target: validate
+          workdir: ./test/${{ matrix.testdir }}
+          target: ${{ matrix.target }}
+          fields: ${{ matrix.fields }}
      -
-        name: Check targets
-        uses: actions/github-script@v7
+        name: Check output
+        uses: actions/github-script@v8
+        env:
+          INPUT_MATRIX: ${{ steps.gen.outputs.matrix }}
+          INPUT_EXPECTED: ${{ matrix.expected }}
        with:
          script: |
-            const targets = `${{ steps.gen.outputs.targets }}`;
-            if (!targets) {
-              core.setFailed('No targets generated');
+            const matrix = JSON.stringify(JSON.parse(core.getInput('matrix')));
+            const expected = JSON.stringify(JSON.parse(core.getInput('expected')));
+            if (matrix !== expected) {
+              throw new Error(`Matrix do not match expected values: ${matrix} != ${expected}`);
+            } else {
+              core.info(`✅`);
            }
-            core.info(`targets=${targets}`);
-
-  list-targets-multi-files:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-      -
-        name: Matrix gen
-        id: gen
-        uses: ./subaction/list-targets
-        with:
-          workdir: ./test/multi-files
-          files: |
-            docker-bake.json
-            docker-bake.hcl
-      -
-        name: Check targets
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const targets = `${{ steps.gen.outputs.targets }}`;
-            if (!targets) {
-              core.setFailed('No targets generated');
-            }
-            core.info(`targets=${targets}`);
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -52,7 +52,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v3
@@ -82,7 +82,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Build
        continue-on-error: true
@@ -99,7 +99,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Stop docker
        run: |
@@ -116,7 +116,6 @@ jobs:
      -
        name: Check
        run: |
-          echo "${{ toJson(steps.bake) }}"
          if [ "${{ steps.bake.outcome }}" != "failure" ] || [ "${{ steps.bake.conclusion }}" != "success" ]; then
            echo "::error::Should have failed"
            exit 1
@@ -127,7 +126,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Uninstall docker cli
        run: |
@@ -156,7 +155,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Build
        uses: ./
@@ -178,7 +177,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -220,7 +219,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -275,7 +274,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Build
        uses: ./
@@ -297,7 +296,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -322,7 +321,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Set malformed docker config
        run: |
@@ -351,7 +350,7 @@ jobs:
          curl --retry 5 --retry-all-errors --retry-delay 0 --connect-timeout 5 --proxy http://127.0.0.1:3128 -v --insecure --head https://www.google.com
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Set proxy config
        run: |
@@ -390,7 +389,7 @@ jobs:
          curl --retry 5 --retry-all-errors --retry-delay 0 --connect-timeout 5 --proxy http://127.0.0.1:3128 -v --insecure --head https://www.google.com
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -415,7 +414,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -432,7 +431,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -461,7 +460,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -505,7 +504,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -538,7 +537,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -561,7 +560,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -585,7 +584,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -606,7 +605,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -635,7 +634,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -653,6 +652,35 @@ jobs:
        env:
          DOCKER_BUILD_RECORD_RETENTION_DAYS: ${{ matrix.days }}

+  export-legacy:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        legacy:
+          - false
+          - true
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v5
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
+          driver-opts: |
+            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
+      -
+        name: Build
+        uses: ./
+        with:
+          files: |
+            ./test/config.hcl
+          targets: app
+        env:
+          DOCKER_BUILD_EXPORT_LEGACY: ${{ matrix.legacy }}
+
  checks:
    runs-on: ubuntu-latest
    strategy:
@@ -664,7 +692,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -686,7 +714,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -718,7 +746,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -734,3 +762,108 @@ jobs:
            ./test/config.hcl
          allow: network.host
          targets: app-entitlements
+
+  no-default-attestations:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v5
+      -
+        name: Build
+        uses: ./
+        with:
+          source: .
+          files: |
+            ./test/config.hcl
+        env:
+          BUILDX_NO_DEFAULT_ATTESTATIONS: 1
+
+  call-check:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v5
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
+          driver-opts: |
+            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
+      -
+        name: Build
+        id: bake
+        continue-on-error: true
+        uses: ./
+        with:
+          workdir: ./test
+          source: .
+          files: |
+            ./lint.hcl
+          call: check
+          targets: lint
+      -
+        name: Check
+        run: |
+          if [ "${{ steps.bake.outcome }}" != "failure" ] || [ "${{ steps.bake.conclusion }}" != "success" ]; then
+            echo "::error::Should have failed"
+            exit 1
+          fi
+
+  call-check-multi:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v5
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
+          driver-opts: |
+            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
+      -
+        name: Build
+        id: bake
+        continue-on-error: true
+        uses: ./
+        with:
+          workdir: ./test
+          source: .
+          files: |
+            ./lint.hcl
+          call: check
+      -
+        name: Check
+        run: |
+          if [ "${{ steps.bake.outcome }}" != "failure" ] || [ "${{ steps.bake.conclusion }}" != "success" ]; then
+            echo "::error::Should have failed"
+            exit 1
+          fi
+
+  call-check-nowarning:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v5
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
+          driver-opts: |
+            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
+      -
+        name: Build
+        id: bake
+        continue-on-error: true
+        uses: ./
+        with:
+          source: .
+          files: |
+            ./test/config.hcl
+          call: check
--- a/.github/workflows/pr-assign-author.yml
+++ b/.github/workflows/pr-assign-author.yml
@@ -0,0 +1,17 @@
+name: pr-assign-author
+
+permissions:
+  contents: read
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+
+jobs:
+  run:
+    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@1b673f36fad86812f538c1df9794904038a23cbf
+    permissions:
+      contents: read
+      pull-requests: write
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -15,7 +15,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: Publish
        uses: actions/publish-immutable-action@v0.0.4
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -21,10 +21,14 @@ jobs:
  test:
    runs-on: ubuntu-latest
    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v5
      -
        name: Test
        uses: docker/bake-action@v6
        with:
+          source: .
          targets: test
      -
        name: Upload coverage
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -19,7 +19,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      -
        name: List targets
        id: generate
--- a/.yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
+++ b/.yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
--- a/.yarnrc.yml
+++ b/.yarnrc.yml
@@ -1,3 +1,9 @@
+# https://yarnpkg.com/configuration/yarnrc
+
+compressionLevel: mixed
+enableGlobalCache: false
+enableHardenedMode: true
+
 logFilters:
  - code: YN0013
    level: discard
@@ -5,9 +11,7 @@ logFilters:
    level: discard
  - code: YN0076
    level: discard
+  - code: YN0086
+    level: discard

 nodeLinker: node-modules
-
-plugins:
-  - path: .yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
-    spec: "@yarnpkg/plugin-interactive-tools"
--- a/README.md
+++ b/README.md
@@ -22,7 +22,7 @@ ___
  * [outputs](#outputs)
  * [environment variables](#environment-variables)
 * [Subactions](#subactions)
-  * [`list-targets`](subaction/list-targets)
+  * [`matrix`](subaction/matrix)
 * [Contributing](#contributing)

 ## Usage
@@ -157,6 +157,19 @@ additional details about the build execution for all the bake targets,
 including build stats, logs, outputs, and more. The build record can be
 imported to Docker Desktop for inspecting the build in greater detail.

+> [!WARNING]
+>
+> If you're using the [`actions/download-artifact`](https://github.com/actions/download-artifact)
+> action in your workflow, you need to ignore the build record artifacts
+> if `name` and `pattern` inputs are not specified ([defaults to download all artifacts](https://github.com/actions/download-artifact?tab=readme-ov-file#download-all-artifacts) of the workflow),
+> otherwise the action will fail:
+> ```yaml
+> - uses: actions/download-artifact@v4
+>   with:
+>     pattern: "!*.dockerbuild"
+> ```
+> More info: https://github.com/actions/toolkit/pull/1874
+
 Summaries are enabled by default, but can be disabled with the
 `DOCKER_BUILD_SUMMARY` [environment variable](#environment-variables).

@@ -187,11 +200,11 @@ The following inputs can be used as `step.with` keys
 | Name           | Type        | Description                                                                                                                                                        |
 |----------------|-------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `builder`      | String      | Builder instance (see [setup-buildx](https://github.com/docker/setup-buildx-action) action)                                                                        |
-| `source`       | String      | Context to build from. Can be either local (`.`) or a [remote bake definition](https://docs.docker.com/build/customize/bake/file-definition/#remote-definition)    |
-| `allow`        | List/CSV    | Allow build to access specified resources (e.g., `network.host`)                                                                                                   |
-| `files`        | List/CSV    | List of [bake definition files](https://docs.docker.com/build/customize/bake/file-definition/)                                                                     |
 | `workdir`      | String      | Working directory of execution                                                                                                                                     |
-| `targets`      | List/CSV    | List of bake targets (`default` target used if empty)                                                                                                              |
+| `source`       | String      | Context to build from. Can be either local (`.`) or a [remote bake definition](https://docs.docker.com/build/bake/remote-definition/)                              |
+| `allow`        | List/CSV    | Allow build to access specified resources (e.g., `network.host`)                                                                                                   |
+| `call`         | String      | Set method for evaluating build (e.g., check)                                                                                                                      |
+| `files`        | List/CSV    | List of [bake definition files](https://docs.docker.com/build/customize/bake/file-definition/)                                                                     |
 | `no-cache`     | Bool        | Do not use cache when building the image (default `false`)                                                                                                         |
 | `pull`         | Bool        | Always attempt to pull a newer version of the image (default `false`)                                                                                              |
 | `load`         | Bool        | Load is a shorthand for `--set=*.output=type=docker` (default `false`)                                                                                             |
@@ -199,6 +212,7 @@ The following inputs can be used as `step.with` keys
 | `push`         | Bool        | Push is a shorthand for `--set=*.output=type=registry` (default `false`)                                                                                           |
 | `sbom`         | Bool/String | [SBOM](https://docs.docker.com/build/attestations/sbom/) is a shorthand for `--set=*.attest=type=sbom`                                                             |
 | `set`          | List        | List of [targets values to override](https://docs.docker.com/engine/reference/commandline/buildx_bake/#set) (e.g., `targetpattern.key=value`)                      |
+| `targets`      | List/CSV    | List of bake targets (`default` target used if empty)                                                                                                              |
 | `github-token` | String      | API token used to authenticate to a Git repository for [remote definitions](https://docs.docker.com/build/bake/remote-definition/) (default `${{ github.token }}`) |

 ### outputs
@@ -217,10 +231,11 @@ The following outputs are available
 | `DOCKER_BUILD_SUMMARY`               | Bool   | `true`  | If `false`, [build summary](https://docs.docker.com/build/ci/github-actions/build-summary/) generation is disabled                                                                                                                                                 |
 | `DOCKER_BUILD_RECORD_UPLOAD`         | Bool   | `true`  | If `false`, build record upload as [GitHub artifact](https://docs.github.com/en/actions/using-workflows/storing-workflow-data-as-artifacts) is disabled                                                                                                            |
 | `DOCKER_BUILD_RECORD_RETENTION_DAYS` | Number |         | Duration after which build record artifact will expire in days. Defaults to repository/org [retention settings](https://docs.github.com/en/actions/learn-github-actions/usage-limits-billing-and-administration#artifact-and-log-retention-policy) if unset or `0` |
+| `DOCKER_BUILD_EXPORT_LEGACY`         | Bool   | `false` | If `true`, exports build using legacy export-build tool instead of [`buildx history export` command](https://docs.docker.com/reference/cli/docker/buildx/history/export/)                                                                                          |

 ## Subactions

-* [`list-targets`](subaction/list-targets)
+* [`matrix`](subaction/matrix)

 ## Contributing

--- a/tests/context.test.ts
+++ b/tests/context.test.ts
@@ -1,4 +1,4 @@
-import {beforeEach, describe, expect, jest, test} from '@jest/globals';
+import {afterEach, beforeEach, describe, expect, jest, test} from '@jest/globals';
 import * as fs from 'fs';
 import * as path from 'path';

@@ -122,6 +122,7 @@ jest.spyOn(Bake.prototype, 'getDefinition').mockImplementation(async (): Promise
 });

 describe('getArgs', () => {
+  const originalEnv = process.env;
  beforeEach(() => {
    process.env = Object.keys(process.env).reduce((object, key) => {
      if (!key.startsWith('INPUT_')) {
@@ -130,6 +131,9 @@ describe('getArgs', () => {
      return object;
    }, {});
  });
+  afterEach(() => {
+    process.env = originalEnv;
+  });

  // prettier-ignore
  test.each([
@@ -145,7 +149,8 @@ describe('getArgs', () => {
      ]),
      [
        'bake',
-      ]
+      ],
+      undefined
    ],
    [
      1,
@@ -160,7 +165,8 @@ describe('getArgs', () => {
      [
        'bake',
        '--metadata-file', metadataJson
-      ]
+      ],
+      undefined
    ],
    [
      2,
@@ -177,7 +183,8 @@ describe('getArgs', () => {
        'bake',
        '--metadata-file', metadataJson,
        'webapp', 'validate'
-      ]
+      ],
+      undefined
    ],
    [
      3,
@@ -195,7 +202,8 @@ describe('getArgs', () => {
        '--set', '*.cache-from=type=gha',
        '--set', '*.cache-to=type=gha',
        '--metadata-file', metadataJson
-      ]
+      ],
+      undefined
    ],
    [
      4,
@@ -211,7 +219,8 @@ describe('getArgs', () => {
        'bake',
        '--metadata-file', metadataJson,
        "--provenance", `mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
-      ]
+      ],
+      undefined
    ],
    [
      5,
@@ -228,7 +237,8 @@ describe('getArgs', () => {
        'bake',
        '--metadata-file', metadataJson,
        "--provenance", `builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`
-      ]
+      ],
+      undefined
    ],
    [
      6,
@@ -245,7 +255,8 @@ describe('getArgs', () => {
        'bake',
        '--metadata-file', metadataJson,
        "--provenance", `mode=max,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`
-      ]
+      ],
+      undefined
    ],
    [
      7,
@@ -262,7 +273,8 @@ describe('getArgs', () => {
        'bake',
        '--metadata-file', metadataJson,
        "--provenance", 'false'
-      ]
+      ],
+      undefined
    ],
    [
      8,
@@ -279,7 +291,8 @@ describe('getArgs', () => {
        'bake',
        '--metadata-file', metadataJson,
        "--provenance", 'builder-id=foo'
-      ]
+      ],
+      undefined
    ],
    [
      9,
@@ -300,7 +313,8 @@ describe('getArgs', () => {
        '--metadata-file', metadataJson,
        '--provenance', `mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
        'image-all'
-      ]
+      ],
+      undefined
    ],
    [
      10,
@@ -320,7 +334,8 @@ describe('getArgs', () => {
        '--metadata-file', metadataJson,
        '--provenance', `mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
        'image-all'
-      ]
+      ],
+      undefined
    ],
    [
      11,
@@ -338,7 +353,8 @@ describe('getArgs', () => {
        '--file', './foo.hcl',
        '--metadata-file', metadataJson,
        '--provenance', `mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
-      ]
+      ],
+      undefined
    ],
    [
      12,
@@ -356,7 +372,8 @@ describe('getArgs', () => {
        '--allow', 'network.host',
        '--metadata-file', metadataJson,
        "--provenance", `mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`
-      ]
+      ],
+      undefined
    ],
    [
      13,
@@ -375,11 +392,35 @@ describe('getArgs', () => {
        '--file', './foo.hcl',
        '--metadata-file', metadataJson,
        '--provenance', `mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
-      ]
+      ],
+      undefined
+    ],
+    [
+      14,
+      '0.15.0',
+      new Map<string, string>([
+        ['source', '.'],
+        ['load', 'false'],
+        ['no-cache', 'false'],
+        ['push', 'false'],
+        ['pull', 'false']
+      ]),
+      [
+        'bake',
+        '--metadata-file', metadataJson
+      ],
+      new Map<string, string>([
+        ['BUILDX_NO_DEFAULT_ATTESTATIONS', '1']
+      ])
    ],
  ])(
    '[%d] given %p with %p as inputs, returns %p',
-    async (num: number, buildxVersion: string, inputs: Map<string, string>, expected: Array<string>) => {
+    async (num: number, buildxVersion: string, inputs: Map<string, string>, expected: Array<string>, envs: Map<string, string> | undefined) => {
+      if (envs) {
+        envs.forEach((value: string, name: string) => {
+          process.env[name] = value;
+        });
+      }
      inputs.forEach((value: string, name: string) => {
        setInput(name, value);
      });
--- a/action.yml
+++ b/action.yml
@@ -10,22 +10,22 @@ inputs:
  builder:
    description: "Builder instance"
    required: false
+  workdir:
+    description: "Working directory of bake execution"
+    required: false
+    default: '.'
  source:
    description: "Context to build from. Can be either local or a remote bake definition"
    required: false
  allow:
    description: "Allow build to access specified resources (e.g., network.host)"
    required: false
+  call:
+    description: "Set method for evaluating build (e.g., check)"
+    required: false
  files:
    description: "List of bake definition files"
    required: false
-  workdir:
-    description: "Working directory of bake execution"
-    required: false
-    default: '.'
-  targets:
-    description: "List of bake targets"
-    required: false
  no-cache:
    description: "Do not use cache when building the image"
    required: false
@@ -51,6 +51,9 @@ inputs:
  set:
    description: "List of targets values to override (eg. targetpattern.key=value)"
    required: false
+  targets:
+    description: "List of bake targets"
+    required: false
  github-token:
    description: "API token used to authenticate to a Git repository for remote definitions"
    default: ${{ github.token }}
--- a/dist/index.js
+++ b/dist/index.js
--- a/dist/index.js.map
+++ b/dist/index.js.map
--- a/dist/sourcemap-register.js
+++ b/dist/sourcemap-register.js
--- a/package.json
+++ b/package.json
@@ -24,25 +24,25 @@
  ],
  "author": "Docker Inc.",
  "license": "Apache-2.0",
-  "packageManager": "yarn@3.6.3",
+  "packageManager": "yarn@4.9.2",
  "dependencies": {
    "@actions/core": "^1.11.1",
-    "@docker/actions-toolkit": "^0.56.0",
+    "@docker/actions-toolkit": "^0.63.0",
    "handlebars": "^4.7.8"
  },
  "devDependencies": {
-    "@types/node": "^20.12.12",
-    "@typescript-eslint/eslint-plugin": "^7.9.0",
-    "@typescript-eslint/parser": "^7.9.0",
-    "@vercel/ncc": "^0.38.1",
-    "eslint": "^8.57.0",
-    "eslint-config-prettier": "^9.1.0",
-    "eslint-plugin-jest": "^28.5.0",
-    "eslint-plugin-prettier": "^5.1.3",
+    "@types/node": "^20.19.9",
+    "@typescript-eslint/eslint-plugin": "^7.18.0",
+    "@typescript-eslint/parser": "^7.18.0",
+    "@vercel/ncc": "^0.38.3",
+    "eslint": "^8.57.1",
+    "eslint-config-prettier": "^9.1.2",
+    "eslint-plugin-jest": "^28.14.0",
+    "eslint-plugin-prettier": "^5.5.4",
    "jest": "^29.7.0",
-    "prettier": "^3.2.5",
-    "ts-jest": "^29.1.2",
+    "prettier": "^3.6.2",
+    "ts-jest": "^29.4.1",
    "ts-node": "^10.9.2",
-    "typescript": "^5.4.5"
+    "typescript": "^5.9.2"
  }
 }
--- a/src/context.ts
+++ b/src/context.ts
@@ -11,11 +11,12 @@ import {Util} from '@docker/actions-toolkit/lib/util';
 import {BakeDefinition} from '@docker/actions-toolkit/lib/types/buildx/bake';

 export interface Inputs {
-  allow: string[];
  builder: string;
-  files: string[];
  workdir: string;
-  targets: string[];
+  source: string;
+  allow: string[];
+  call: string;
+  files: string[];
  'no-cache': boolean;
  pull: boolean;
  load: boolean;
@@ -23,17 +24,18 @@ export interface Inputs {
  push: boolean;
  sbom: string;
  set: string[];
-  source: string;
+  targets: string[];
  'github-token': string;
 }

 export async function getInputs(): Promise<Inputs> {
  return {
-    allow: Util.getInputList('allow'),
    builder: core.getInput('builder'),
-    files: Util.getInputList('files'),
    workdir: core.getInput('workdir') || '.',
-    targets: Util.getInputList('targets'),
+    source: getSourceInput('source'),
+    allow: Util.getInputList('allow'),
+    call: core.getInput('call'),
+    files: Util.getInputList('files'),
    'no-cache': core.getBooleanInput('no-cache'),
    pull: core.getBooleanInput('pull'),
    load: core.getBooleanInput('load'),
@@ -41,33 +43,11 @@ export async function getInputs(): Promise<Inputs> {
    push: core.getBooleanInput('push'),
    sbom: core.getInput('sbom'),
    set: Util.getInputList('set', {ignoreComma: true, quote: false}),
-    source: getSourceInput('source'),
+    targets: Util.getInputList('targets'),
    'github-token': core.getInput('github-token')
  };
 }

-export function sanitizeInputs(inputs: Inputs) {
-  const res = {};
-  for (const key of Object.keys(inputs)) {
-    if (key === 'github-token') {
-      continue;
-    }
-    const value: string | string[] | boolean = inputs[key];
-    if (typeof value === 'boolean' && value === false) {
-      continue;
-    } else if (Array.isArray(value) && value.length === 0) {
-      continue;
-    } else if (!value) {
-      continue;
-    }
-    if (key === 'workdir' && value === '.') {
-      continue;
-    }
-    res[key] = value;
-  }
-  return res;
-}
-
 export async function getArgs(inputs: Inputs, definition: BakeDefinition, toolkit: Toolkit): Promise<Array<string>> {
  // prettier-ignore
  return [
@@ -91,6 +71,12 @@ async function getBakeArgs(inputs: Inputs, definition: BakeDefinition, toolkit:
      args.push('--allow', allow);
    });
  }
+  if (inputs.call) {
+    if (!(await toolkit.buildx.versionSatisfies('>=0.16.0'))) {
+      throw new Error(`Buildx >= 0.16.0 is required to use the call flag.`);
+    }
+    args.push('--call', inputs.call);
+  }
  await Util.asyncForEach(inputs.files, async file => {
    args.push('--file', file);
  });
@@ -103,7 +89,7 @@ async function getBakeArgs(inputs: Inputs, definition: BakeDefinition, toolkit:
  if (await toolkit.buildx.versionSatisfies('>=0.10.0')) {
    if (inputs.provenance) {
      args.push('--provenance', inputs.provenance);
-    } else if ((await toolkit.buildkit.versionSatisfies(inputs.builder, '>=0.11.0')) && !Bake.hasDockerExporter(definition, inputs.load)) {
+    } else if (!noDefaultAttestations() && (await toolkit.buildkit.versionSatisfies(inputs.builder, '>=0.11.0')) && !Bake.hasDockerExporter(definition, inputs.load)) {
      // if provenance not specified and BuildKit version compatible for
      // attestation, set default provenance. Also needs to make sure user
      // doesn't want to explicitly load the image to docker.
@@ -155,3 +141,10 @@ function getSourceInput(name: string): string {
  }
  return source;
 }
+
+function noDefaultAttestations(): boolean {
+  if (process.env.BUILDX_NO_DEFAULT_ATTESTATIONS) {
+    return Util.parseBool(process.env.BUILDX_NO_DEFAULT_ATTESTATIONS);
+  }
+  return false;
+}
--- a/src/main.ts
+++ b/src/main.ts
@@ -26,8 +26,8 @@ actionsToolkit.run(
    const startedTime = new Date();

    const inputs: context.Inputs = await context.getInputs();
+    stateHelper.setSummaryInputs(inputs);
    core.debug(`inputs: ${JSON.stringify(inputs)}`);
-    stateHelper.setInputs(inputs);

    const toolkit = new Toolkit();
    const gitAuthToken = process.env.BUILDX_BAKE_GIT_AUTH_TOKEN ?? inputs['github-token'];
@@ -88,6 +88,8 @@ actionsToolkit.run(
    let builder: BuilderInfo;
    await core.group(`Builder info`, async () => {
      builder = await toolkit.builder.inspect(inputs.builder);
+      stateHelper.setBuilderDriver(builder.driver ?? '');
+      stateHelper.setBuilderEndpoint(builder.nodes?.[0]?.endpoint ?? '');
      core.info(JSON.stringify(builder, null, 2));
    });

@@ -144,8 +146,26 @@ actionsToolkit.run(
      env: buildEnv,
      ignoreReturnCode: true
    }).then(res => {
-      if (res.stderr.length > 0 && res.exitCode != 0) {
-        err = Error(`buildx bake failed with: ${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
+      if (res.exitCode != 0) {
+        if (inputs.call && inputs.call === 'check' && res.stdout.length > 0) {
+          // checks warnings are printed to stdout: https://github.com/docker/buildx/pull/2647
+          // with bake we can have multiple targets being checked so we need to
+          // count the total number of warnings
+          const totalWarnings = [...res.stdout.matchAll(/^Check complete, (\d+) warnings? (?:has|have) been found!/gm)].reduce((sum, m) => sum + parseInt(m[1], 10), 0);
+          if (totalWarnings > 0) {
+            // https://github.com/docker/buildx/blob/1e50e8ddabe108f009b9925e13a321d7c8f99f26/commands/build.go#L797-L803
+            if (totalWarnings === 1) {
+              err = Error(`Check complete, ${totalWarnings} warning has been found!`);
+            } else {
+              err = Error(`Check complete, ${totalWarnings} warnings have been found!`);
+            }
+          } else {
+            // if there are no warnings found, return the first line of stdout
+            err = Error(res.stdout.split('\n')[0]?.trim());
+          }
+        } else if (res.stderr.length > 0) {
+          err = Error(`buildx bake failed with: ${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
+        }
      }
    });

@@ -189,12 +209,12 @@ actionsToolkit.run(
    await core.group(`Check build summary support`, async () => {
      if (!buildSummaryEnabled()) {
        core.info('Build summary disabled');
+      } else if (inputs.call && inputs.call !== 'build') {
+        core.info(`Build summary skipped for ${inputs.call} subrequest`);
      } else if (GitHub.isGHES) {
        core.info('Build summary is not yet supported on GHES');
      } else if (!(await toolkit.buildx.versionSatisfies('>=0.13.0'))) {
        core.info('Build summary requires Buildx >= 0.13.0');
-      } else if (builder && builder.driver === 'cloud') {
-        core.info('Build summary is not yet supported with Docker Build Cloud');
      } else if (refs.length == 0) {
        core.info('Build summary requires at least one build reference');
      } else {
@@ -220,7 +240,8 @@ actionsToolkit.run(

          const buildxHistory = new BuildxHistory();
          const exportRes = await buildxHistory.export({
-            refs: stateHelper.buildRefs
+            refs: stateHelper.buildRefs,
+            useContainer: buildExportLegacy()
          });
          core.info(`Build records written to ${exportRes.dockerbuildFilename} (${Util.formatFileSize(exportRes.dockerbuildSize)})`);

@@ -236,8 +257,10 @@ actionsToolkit.run(
          await GitHub.writeBuildSummary({
            exportRes: exportRes,
            uploadRes: uploadRes,
-            inputs: stateHelper.inputs,
-            bakeDefinition: stateHelper.bakeDefinition
+            inputs: stateHelper.summaryInputs,
+            bakeDefinition: stateHelper.bakeDefinition,
+            driver: stateHelper.builderDriver,
+            endpoint: stateHelper.builderEndpoint
          });
        } catch (e) {
          core.warning(e.message);
@@ -317,3 +340,10 @@ function buildRecordRetentionDays(): number | undefined {
    return res;
  }
 }
+
+function buildExportLegacy(): boolean {
+  if (process.env.DOCKER_BUILD_EXPORT_LEGACY) {
+    return Util.parseBool(process.env.DOCKER_BUILD_EXPORT_LEGACY);
+  }
+  return false;
+}
--- a/src/state-helper.ts
+++ b/src/state-helper.ts
@@ -2,11 +2,15 @@ import * as core from '@actions/core';

 import {BakeDefinition} from '@docker/actions-toolkit/lib/types/buildx/bake';

-import {Inputs, sanitizeInputs} from './context';
+import {Inputs} from './context';

 export const tmpDir = process.env['STATE_tmpDir'] || '';
-export const inputs = process.env['STATE_inputs'] ? JSON.parse(process.env['STATE_inputs']) : undefined;
+
+export const builderDriver = process.env['STATE_builderDriver'] || '';
+export const builderEndpoint = process.env['STATE_builderEndpoint'] || '';
+export const summaryInputs = process.env['STATE_summaryInputs'] ? JSON.parse(process.env['STATE_summaryInputs']) : undefined;
 export const bakeDefinition = process.env['STATE_bakeDefinition'] ? <BakeDefinition>JSON.parse(process.env['STATE_bakeDefinition']) : undefined;
+
 export const buildRefs = process.env['STATE_buildRefs'] ? process.env['STATE_buildRefs'].split(',') : [];
 export const isSummarySupported = !!process.env['STATE_isSummarySupported'];

@@ -14,8 +18,12 @@ export function setTmpDir(tmpDir: string) {
  core.saveState('tmpDir', tmpDir);
 }

-export function setInputs(inputs: Inputs) {
-  core.saveState('inputs', JSON.stringify(sanitizeInputs(inputs)));
+export function setBuilderDriver(builderDriver: string) {
+  core.saveState('builderDriver', builderDriver);
+}
+
+export function setBuilderEndpoint(builderEndpoint: string) {
+  core.saveState('builderEndpoint', builderEndpoint);
 }

 export function setBakeDefinition(bakeDefinition: BakeDefinition) {
@@ -29,3 +37,22 @@ export function setBuildRefs(buildRefs: Array<string>) {
 export function setSummarySupported() {
  core.saveState('isSummarySupported', 'true');
 }
+
+export function setSummaryInputs(inputs: Inputs) {
+  const res = {};
+  for (const key of Object.keys(inputs)) {
+    if (key === 'github-token') {
+      continue;
+    }
+    const value: string | string[] | boolean = inputs[key];
+    if (typeof value === 'boolean' && !value) {
+      continue;
+    } else if (Array.isArray(value) && value.length === 0) {
+      continue;
+    } else if (!value) {
+      continue;
+    }
+    res[key] = value;
+  }
+  core.saveState('summaryInputs', JSON.stringify(res));
+}
--- a/subaction/list-targets/README.md
+++ b/subaction/list-targets/README.md
@@ -1,9 +1,14 @@
+> [!WARNING]
+> `docker/bake-action/subaction/list-targets` is deprecated and will be removed
+> in a future release. Please use [`docker/bake-action/subaction/matrix`](../matrix)
+> instead.
+
 ## About

 This subaction generates a list of Bake targets that can be used in a [GitHub matrix](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstrategymatrix),
 so you can distribute your builds across multiple runners.

-![Screenshot](../../.github/bake-action.png)
+![Screenshot](../../.github/subaction-list-targets.png)

 ___

@@ -55,9 +60,6 @@ jobs:
      matrix:
        target: ${{ fromJson(needs.prepare.outputs.targets) }}
    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
      -
        name: Validate
        uses: docker/bake-action@v6
@@ -79,6 +81,6 @@ jobs:

 The following outputs are available

-| Name       | Type     | Description                |
-|------------|----------|----------------------------|
-| `targets`  | List/CSV | List of extracted targest  |
+| Name       | Type     | Description               |
+|------------|----------|---------------------------|
+| `targets`  | List/CSV | List of extracted targets |
--- a/subaction/list-targets/action.yml
+++ b/subaction/list-targets/action.yml
@@ -26,12 +26,23 @@ runs:
      name: Generate
      id: generate
      uses: actions/github-script@v7
+      env:
+        INPUT_WORKDIR: ${{ inputs.workdir }}
+        INPUT_FILES: ${{ inputs.files }}
+        INPUT_TARGET: ${{ inputs.target }}
      with:
        script: |
-          let def;
-          const files = `${{ inputs.files }}` ? `${{ inputs.files }}`.split(/[\r?\n,]+/).filter(Boolean) : [];
-          const target = `${{ inputs.target }}`;
+          core.warning(`docker/bake-action/subaction/list-targets is deprecated and will be removed in a future release. Please use docker/bake-action/subaction/matrix instead.`);

+          function getInputList(name) {
+            return core.getInput(name) ? core.getInput(name).split(/[\r?\n,]+/).filter(x => x !== '') : [];
+          }
+
+          const workdir = core.getInput('workdir');
+          const files = getInputList('files');
+          const target = core.getInput('target');
+
+          let def = {};
          await core.group(`Validating definition`, async () => {
            let args = ['buildx', 'bake'];
            for (const file of files) {
@@ -45,7 +56,7 @@ runs:
            const res = await exec.getExecOutput('docker', args, {
              ignoreReturnCode: true,
              silent: true,
-              cwd: `${{ inputs.workdir }}`
+              cwd: workdir
            });
            if (res.stderr.length > 0 && res.exitCode != 0) {
              throw new Error(res.stderr);
--- a/subaction/matrix/README.md
+++ b/subaction/matrix/README.md
@@ -0,0 +1,140 @@
+## About
+
+This subaction generates a multi-dimension matrix that can be used in a [GitHub matrix](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstrategymatrix)
+through the [`include` property](https://docs.github.com/en/actions/how-tos/writing-workflows/choosing-what-your-workflow-does/running-variations-of-jobs-in-a-workflow#expanding-or-adding-matrix-configurations)
+so you can distribute your builds across multiple runners.
+
+![Screenshot](../../.github/subaction-matrix.png)
+
+___
+
+* [Usage](#usage)
+* [Customizing](#customizing)
+  * [inputs](#inputs)
+  * [outputs](#outputs)
+
+## Usage
+
+### List targets
+
+```hcl
+# docker-bake.hcl
+group "validate" {
+  targets = ["lint", "doctoc"]
+}
+
+target "lint" {
+  target = "lint"
+}
+
+target "doctoc" {
+  target = "doctoc"
+}
+```
+
+```yaml
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.generate.outputs.matrix }}
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Generate matrix
+        id: generate
+        uses: docker/bake-action/subaction/matrix@v6
+        with:
+          target: validate
+
+  validate:
+    runs-on: ubuntu-latest
+    needs:
+      - prepare
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJson(needs.prepare.outputs.matrix) }}
+    steps:
+      -
+        name: Validate
+        uses: docker/bake-action@v6
+        with:
+          targets: ${{ matrix.target }}
+```
+
+### Platforms split
+
+```hcl
+# docker-bake.hcl
+target "lint" {
+  dockerfile = "./hack/dockerfiles/lint.Dockerfile"
+  output = ["type=cacheonly"]
+  platforms = [
+    "darwin/amd64",
+    "darwin/arm64",
+    "linux/amd64",
+    "linux/arm64",
+    "linux/s390x",
+    "linux/ppc64le",
+    "linux/riscv64",
+    "windows/amd64",
+    "windows/arm64"
+  ]
+}
+```
+
+```yaml
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.generate.outputs.matrix }}
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Generate matrix
+        id: generate
+        uses: docker/bake-action/subaction/matrix@v6
+        with:
+          target: lint
+          fields: platforms
+
+  lint:
+    runs-on: ${{ startsWith(matrix.platforms, 'linux/arm') && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
+    needs:
+      - prepare
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJson(needs.prepare.outputs.matrix) }}
+    steps:
+      -
+        name: Lint
+        uses: docker/bake-action@v6
+        with:
+          targets: ${{ matrix.target }}
+          set: |
+            *.platform=${{ matrix.platforms }}
+```
+
+## Customizing
+
+### inputs
+
+| Name      | Type     | Description                                                                                    |
+|-----------|----------|------------------------------------------------------------------------------------------------|
+| `workdir` | String   | Working directory to use (defaults to `.`)                                                     |
+| `files`   | List/CSV | List of [bake definition files](https://docs.docker.com/build/customize/bake/file-definition/) |
+| `target`  | String   | The target to use within the bake file                                                         |
+| `fields`  | String   | List of extra fields to include in the matrix                                                  |
+
+### outputs
+
+| Name     | Type | Description          |
+|----------|------|----------------------|
+| `matrix` | JSON | Matrix configuration |
--- a/subaction/matrix/action.yml
+++ b/subaction/matrix/action.yml
@@ -0,0 +1,101 @@
+# https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions
+name: 'Matrix'
+description: 'Generate a matrix from a Bake definition to help distributing builds in your workflow'
+
+inputs:
+  workdir:
+    description: Working directory
+    default: '.'
+    required: false
+  files:
+    description: List of Bake files
+    required: false
+  target:
+    description: Bake target
+    required: false
+  fields:
+    description: List of extra fields to include in the matrix
+    required: false
+
+outputs:
+  matrix:
+    description: Matrix configuration
+    value: ${{ steps.generate.outputs.includes }}
+
+runs:
+  using: composite
+  steps:
+    -
+      name: Generate
+      id: generate
+      uses: actions/github-script@v7
+      env:
+        INPUT_WORKDIR: ${{ inputs.workdir }}
+        INPUT_FILES: ${{ inputs.files }}
+        INPUT_TARGET: ${{ inputs.target }}
+        INPUT_FIELDS: ${{ inputs.fields }}
+      with:
+        script: |
+          function getInputList(name) {
+            return core.getInput(name) ? core.getInput(name).split(/[\r?\n,]+/).filter(x => x !== '') : [];
+          }
+
+          const workdir = core.getInput('workdir');
+          const files = getInputList('files');
+          const target = core.getInput('target');
+          const fields = getInputList('fields');
+
+          let def = {};
+          await core.group(`Parsing definition`, async () => {
+            let args = ['buildx', 'bake'];
+            for (const file of files) {
+              args.push('--file', file);
+            }
+            if (target) {
+              args.push(target);
+            }
+            args.push('--print');
+            const res = await exec.getExecOutput('docker', args, {
+              ignoreReturnCode: true,
+              silent: true,
+              cwd: workdir
+            });
+            if (res.stderr.length > 0 && res.exitCode != 0) {
+              throw new Error(res.stderr);
+            }
+            def = JSON.parse(res.stdout.trim());
+            core.info(JSON.stringify(def, null, 2));
+          });
+
+          await core.group(`Generating matrix`, async () => {
+            const result = [];
+            for (const targetName of Object.keys(def.target)) {
+              const target = def.target[targetName];
+              const entry = { target: targetName };
+              if (fields.length === 0) {
+                result.push({ ...entry });
+                continue;
+              }
+              let fieldFound = false;
+              Object.keys(target).forEach(field => {
+                if (fields.includes(field)) {
+                  fieldFound = true;
+                  const value = target[field];
+                  if (Array.isArray(value)) {
+                    value.forEach((v) => {
+                      entry[field] = v;
+                      result.push({ ...entry });
+                    });
+                  } else {
+                    entry[field] = value;
+                    result.push({ ...entry });
+                  }
+                }
+              });
+              if (!fieldFound) {
+                result.push({ ...entry });
+              }
+            }
+            core.info(JSON.stringify(result, null, 2));
+            core.setOutput('includes', JSON.stringify(result));
+          });
--- a/test/group-with-platform/docker-bake.hcl
+++ b/test/group-with-platform/docker-bake.hcl
@@ -0,0 +1,36 @@
+group "validate" {
+  targets = ["lint", "lint-gopls", "validate-vendor", "validate-docs"]
+}
+
+target "lint" {
+  dockerfile = "./hack/dockerfiles/lint.Dockerfile"
+  output = ["type=cacheonly"]
+  platforms = [
+    "darwin/amd64",
+    "darwin/arm64",
+    "linux/amd64",
+    "linux/arm64",
+    "linux/s390x",
+    "linux/ppc64le",
+    "linux/riscv64",
+    "windows/amd64",
+    "windows/arm64"
+  ]
+}
+
+target "lint-gopls" {
+  inherits = ["lint"]
+  target = "gopls-analyze"
+}
+
+target "validate-vendor" {
+  dockerfile = "./hack/dockerfiles/vendor.Dockerfile"
+  target = "validate"
+  output = ["type=cacheonly"]
+}
+
+target "validate-docs" {
+  dockerfile = "./hack/dockerfiles/docs.Dockerfile"
+  target = "validate"
+  output = ["type=cacheonly"]
+}
--- a/yarn.lock
+++ b/yarn.lock
Author	SHA1	Message	Date
CrazyMax	41c10f2beb	Merge pull request #350 from docker/dependabot/github_actions/actions/github-script-8 chore(deps): Bump actions/github-script from 7 to 8	2025-09-13 13:12:26 +02:00
dependabot[bot]	5b9bf92d49	chore(deps): Bump actions/github-script from 7 to 8 Bumps [actions/github-script](https://github.com/actions/github-script) from 7 to 8. - [Release notes](https://github.com/actions/github-script/releases) - [Commits](https://github.com/actions/github-script/compare/v7...v8) --- updated-dependencies: - dependency-name: actions/github-script dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2025-09-04 23:01:25 +00:00
CrazyMax	3acf805d94	Merge pull request #345 from crazy-max/update-yarn update yarn to 4.9.2	2025-08-20 17:02:25 +02:00
CrazyMax	f6376ff6a4	update yarn to 4.9.2 Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-20 16:56:24 +02:00
CrazyMax	60b3af61bc	Merge pull request #344 from crazy-max/update-dev update dev dependencies	2025-08-20 16:54:19 +02:00
CrazyMax	f08ef55f78	chore: update generated content Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-20 16:51:55 +02:00
CrazyMax	c22b3482ed	update dev dependencies Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-20 16:51:03 +02:00
CrazyMax	40bffc195e	Merge pull request #342 from docker/dependabot/npm_and_yarn/docker/actions-toolkit-0.63.0 chore(deps): Bump @docker/actions-toolkit from 0.62.1 to 0.63.0	2025-08-20 16:49:03 +02:00
CrazyMax	d7a0b5eb51	chore: update generated content Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-20 16:46:24 +02:00
dependabot[bot]	3965f4baf4	chore(deps): Bump @docker/actions-toolkit from 0.62.1 to 0.63.0 Bumps [@docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.62.1 to 0.63.0. - [Release notes](https://github.com/docker/actions-toolkit/releases) - [Commits](https://github.com/docker/actions-toolkit/compare/v0.62.1...v0.63.0) --- updated-dependencies: - dependency-name: "@docker/actions-toolkit" dependency-version: 0.63.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2025-08-20 14:43:32 +00:00
CrazyMax	3d864c34f9	Merge pull request #341 from docker/dependabot/npm_and_yarn/tmp-0.2.4 chore(deps): Bump tmp from 0.2.3 to 0.2.4	2025-08-20 16:41:23 +02:00
CrazyMax	3589b0c183	chore: update generated content Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-20 16:39:06 +02:00
dependabot[bot]	2215fae6ab	chore(deps): Bump tmp from 0.2.3 to 0.2.4 Bumps [tmp](https://github.com/raszi/node-tmp) from 0.2.3 to 0.2.4. - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](https://github.com/raszi/node-tmp/compare/v0.2.3...v0.2.4) --- updated-dependencies: - dependency-name: tmp dependency-version: 0.2.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2025-08-20 14:37:49 +00:00
CrazyMax	d0cb9774dc	Merge pull request #340 from docker/dependabot/npm_and_yarn/undici-5.29.0 chore(deps): Bump undici from 5.28.4 to 5.29.0	2025-08-20 16:35:21 +02:00
CrazyMax	a6c0a91e79	chore: update generated content Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-20 16:31:47 +02:00
dependabot[bot]	74cb41d332	chore(deps): Bump undici from 5.28.4 to 5.29.0 Bumps [undici](https://github.com/nodejs/undici) from 5.28.4 to 5.29.0. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v5.28.4...v5.29.0) --- updated-dependencies: - dependency-name: undici dependency-version: 5.29.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2025-08-20 14:29:38 +00:00
CrazyMax	8f035c08cd	Merge pull request #339 from docker/dependabot/npm_and_yarn/brace-expansion-1.1.12 chore(deps): Bump brace-expansion from 1.1.11 to 1.1.12	2025-08-20 16:27:16 +02:00
CrazyMax	a4c28defc8	chore: update generated content Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-20 16:25:20 +02:00
dependabot[bot]	d260a27f75	chore(deps): Bump brace-expansion from 1.1.11 to 1.1.12 Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.11 to 1.1.12. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/1.1.11...v1.1.12) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.12 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2025-08-20 14:23:25 +00:00
CrazyMax	5efdf4de8d	Merge pull request #338 from crazy-max/call-input call input to set method for evaluating build	2025-08-20 16:19:54 +02:00
Tõnis Tiigi	1a42865db7	Merge pull request #204 from crazy-max/subaction-matrix matrix subaction	2025-08-20 12:39:21 +03:00
CrazyMax	ba406cd72e	subaction: check expected output Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-14 10:14:36 +02:00
CrazyMax	1d0c0ffa52	list-targets: deprecation notice Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-14 10:14:36 +02:00
CrazyMax	68cf998b48	matrix subaction Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-14 10:14:36 +02:00
CrazyMax	7a78e75fa4	chore: update generated content Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-14 09:50:47 +02:00
CrazyMax	24d8c3471c	call input to set method for evaluating build Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-14 09:48:36 +02:00
CrazyMax	6de75d5ad2	Merge pull request #343 from docker/dependabot/github_actions/actions/checkout-5 chore(deps): Bump actions/checkout from 4 to 5	2025-08-14 09:41:42 +02:00
dependabot[bot]	72003b9fac	chore(deps): Bump actions/checkout from 4 to 5 Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v5) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2025-08-12 09:45:44 +00:00
CrazyMax	a1257e6518	Merge pull request #334 from docker/dependabot/npm_and_yarn/form-data-2.5.5 chore(deps): Bump form-data from 2.5.1 to 2.5.5	2025-08-05 15:17:20 +02:00
CrazyMax	846dea0f3a	Merge pull request #335 from meator/patch-1 README.md: fix link	2025-07-25 12:25:38 +02:00
meator	1367d98caa	README.md: fix link The old link pointed to a section which no longer exists. Signed-off-by: meator <meator.dev@gmail.com>	2025-07-23 17:33:43 +02:00
dependabot[bot]	88f3e5553b	chore(deps): Bump form-data from 2.5.1 to 2.5.5 Bumps [form-data](https://github.com/form-data/form-data) from 2.5.1 to 2.5.5. - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/v2.5.5/CHANGELOG.md) - [Commits](https://github.com/form-data/form-data/compare/v2.5.1...v2.5.5) --- updated-dependencies: - dependency-name: form-data dependency-version: 2.5.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2025-07-21 23:22:07 +00:00
CrazyMax	d576212e5b	Merge pull request #332 from crazy-max/subaction-list-targets-enhanced list-targets: use toolkit to sanitize inputs	2025-07-04 17:11:25 +02:00
CrazyMax	d4a3c3cc87	list-targets: use toolkit to sanitize inputs Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-07-04 16:40:51 +02:00
CrazyMax	37816e7475	Merge pull request #331 from docker/dependabot/npm_and_yarn/docker/actions-toolkit-0.62.1 chore(deps): Bump @docker/actions-toolkit from 0.61.0 to 0.62.1	2025-05-27 18:32:17 +02:00
CrazyMax	f5304128f3	chore: update generated content Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-05-27 18:25:31 +02:00
CrazyMax	4318518141	set builder driver and endpoint attributes for dbc summary support Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-05-27 18:24:24 +02:00
CrazyMax	0dc934281a	move summary inputs sanitization to state helper Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-05-27 18:24:24 +02:00
dependabot[bot]	64a5bce7a2	chore(deps): Bump @docker/actions-toolkit from 0.61.0 to 0.62.1 Bumps [@docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.61.0 to 0.62.1. - [Release notes](https://github.com/docker/actions-toolkit/releases) - [Commits](https://github.com/docker/actions-toolkit/compare/v0.61.0...v0.62.1) --- updated-dependencies: - dependency-name: "@docker/actions-toolkit" dependency-version: 0.62.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2025-05-27 16:20:50 +00:00
CrazyMax	212c367396	Merge pull request #325 from crazy-max/history-export-cmd Bump @docker/actions-toolkit from 0.59.0 to 0.61.0	2025-05-15 10:18:26 +02:00
CrazyMax	d1ecc3a41e	chore: update generated content Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-05-12 14:21:59 +02:00
CrazyMax	ae6e8fe892	DOCKER_BUILD_EXPORT_LEGACY env var to opt-in for legacy export Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-05-12 14:20:38 +02:00
CrazyMax	57dcb4dec4	Bump @docker/actions-toolkit from 0.59.0 to 0.61.0 Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-05-12 14:20:37 +02:00
CrazyMax	76f9fa3a75	Merge pull request #316 from crazy-max/fix-no-default-attest handle no default attestations env var	2025-04-23 18:38:03 +02:00
CrazyMax	1c2b73661c	Merge pull request #326 from crazy-max/pr-assign-author pr-assign-author workflow	2025-04-23 16:09:39 +02:00
CrazyMax	c38fbc0209	pr-assign-author workflow Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-04-23 14:14:01 +02:00
CrazyMax	9d4c4c70ed	Merge pull request #323 from crazy-max/fix-codecov ci: fix missing source for codecov	2025-04-22 14:28:02 +02:00
CrazyMax	ab9ee171b4	ci: fix missing source for codecov Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-04-22 14:24:40 +02:00
CrazyMax	f252d74606	chore: update generated content Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-04-09 19:00:25 +02:00
CrazyMax	656e858067	handle no default attestations env var Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-04-09 18:59:04 +02:00
CrazyMax	fdcf61eb1a	Merge pull request #319 from docker/dependabot/npm_and_yarn/docker/actions-toolkit-0.59.0 chore(deps): Bump @docker/actions-toolkit from 0.56.0 to 0.59.0	2025-04-08 17:51:41 +02:00
CrazyMax	a17047c36c	chore: update generated content Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-04-08 17:49:33 +02:00
dependabot[bot]	1b9d00da59	chore(deps): Bump @docker/actions-toolkit from 0.56.0 to 0.59.0 Bumps [@docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.56.0 to 0.59.0. - [Release notes](https://github.com/docker/actions-toolkit/releases) - [Commits](https://github.com/docker/actions-toolkit/compare/v0.56.0...v0.59.0) --- updated-dependencies: - dependency-name: "@docker/actions-toolkit" dependency-version: 0.59.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2025-04-08 15:45:05 +00:00
CrazyMax	8f9e95c9aa	Merge pull request #308 from crazy-max/note-download-artifact note about usage of summary feature with download-artifact action	2025-03-10 16:15:43 +01:00
CrazyMax	f7a0604619	note about usage of summary feature with download-artifact action Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-03-10 11:18:25 +01:00