Merge pull request #360 from docker/dependabot/npm_and_yarn/docker/actions-toolkit-0.68.0

chore(deps): Bump @docker/actions-toolkit from 0.63.0 to 0.68.0
chore: update generated content
2025-12-06 07:48:05 +08:00 · 2025-11-27 12:30:41 +01:00 · 2025-11-27 12:13:33 +01:00 · 2025-11-27 10:31:45 +00:00 · 2025-11-27 09:56:13 +01:00 · 2025-11-27 09:56:02 +01:00
29 changed files with 3665 additions and 6809 deletions
--- a/.github/subaction-list-targets.png
+++ b/.github/subaction-list-targets.png
--- a/.github/subaction-matrix.png
+++ b/.github/subaction-matrix.png
--- a/.github/workflows/ci-subaction.yml
+++ b/.github/workflows/ci-subaction.yml
@@ -25,75 +25,112 @@ on:
      - 'test/**'

 jobs:
-  list-targets-group:
+  list-targets:
    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          -
+            testdir: group
+            expected: >
+              ["t1","t2"]
+          -
+            testdir: group-matrix
+            target: validate
+            expected: >
+              ["lint-default","lint-labs","lint-nydus","lint-proto","lint-yaml","validate-doctoc","validate-vendor"]
+          -
+            testdir: multi-files
+            files: |
+              docker-bake.json
+              docker-bake.hcl
+            expected: >
+              ["v1-tag","v2-tag"]
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Matrix gen
        id: gen
        uses: ./subaction/list-targets
        with:
-          workdir: ./test/group
+          workdir: ./test/${{ matrix.testdir }}
+          files: ${{ matrix.files }}
+          target: ${{ matrix.target }}
      -
-        name: Check targets
-        uses: actions/github-script@v7
+        name: Check output
+        uses: actions/github-script@v8
+        env:
+          INPUT_TARGETS: ${{ steps.gen.outputs.targets }}
+          INPUT_EXPECTED: ${{ matrix.expected }}
        with:
          script: |
-            const targets = `${{ steps.gen.outputs.targets }}`;
-            if (!targets) {
-              core.setFailed('No targets generated');
+            const targets = JSON.stringify(JSON.parse(core.getInput('targets')));
+            const expected = JSON.stringify(JSON.parse(core.getInput('expected')));
+            if (targets !== expected) {
+              throw new Error(`Targets do not match expected values: ${targets} != ${expected}`);
+            } else {
+              core.info(`✅`);
            }
-            core.info(`targets=${targets}`);

-  list-targets-group-matrix:
+  matrix:
    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          -
+            testdir: group
+            expected: >
+              [{"target":"t1"},{"target":"t2"}]
+          -
+            testdir: group-matrix
+            target: validate
+            expected: >
+              [{"target":"lint-default"},{"target":"lint-labs"},{"target":"lint-nydus"},{"target":"lint-proto"},{"target":"lint-yaml"},{"target":"validate-doctoc"},{"target":"validate-vendor"}]
+          -
+            testdir: group-with-platform
+            target: validate
+            expected: >
+              [{"target":"lint"},{"target":"lint-gopls"},{"target":"validate-docs"},{"target":"validate-vendor"}]
+          -
+            testdir: group-with-platform
+            target: validate
+            fields: platforms
+            expected: >
+              [{"target":"lint","platforms":"darwin/amd64"},{"target":"lint","platforms":"darwin/arm64"},{"target":"lint","platforms":"linux/amd64"},{"target":"lint","platforms":"linux/arm64"},{"target":"lint","platforms":"linux/s390x"},{"target":"lint","platforms":"linux/ppc64le"},{"target":"lint","platforms":"linux/riscv64"},{"target":"lint","platforms":"windows/amd64"},{"target":"lint","platforms":"windows/arm64"},{"target":"lint-gopls","platforms":"darwin/amd64"},{"target":"lint-gopls","platforms":"darwin/arm64"},{"target":"lint-gopls","platforms":"linux/amd64"},{"target":"lint-gopls","platforms":"linux/arm64"},{"target":"lint-gopls","platforms":"linux/s390x"},{"target":"lint-gopls","platforms":"linux/ppc64le"},{"target":"lint-gopls","platforms":"linux/riscv64"},{"target":"lint-gopls","platforms":"windows/amd64"},{"target":"lint-gopls","platforms":"windows/arm64"},{"target":"validate-docs"},{"target":"validate-vendor"}]
+          -
+            testdir: group-with-platform
+            target: validate
+            fields: platforms,dockerfile
+            expected: >
+               [{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile"},{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"darwin/amd64"},{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"darwin/arm64"},{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/amd64"},{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/arm64"},{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/s390x"},{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/ppc64le"},{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/riscv64"},{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"windows/amd64"},{"target":"lint","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"windows/arm64"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"darwin/amd64"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"darwin/arm64"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/amd64"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/arm64"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/s390x"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/ppc64le"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"linux/riscv64"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"windows/amd64"},{"target":"lint-gopls","dockerfile":"./hack/dockerfiles/lint.Dockerfile","platforms":"windows/arm64"},{"target":"validate-docs","dockerfile":"./hack/dockerfiles/docs.Dockerfile"},{"target":"validate-vendor","dockerfile":"./hack/dockerfiles/vendor.Dockerfile"}]
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Matrix gen
        id: gen
-        uses: ./subaction/list-targets
+        uses: ./subaction/matrix
        with:
-          workdir: ./test/group-matrix
-          target: validate
+          workdir: ./test/${{ matrix.testdir }}
+          target: ${{ matrix.target }}
+          fields: ${{ matrix.fields }}
      -
-        name: Check targets
-        uses: actions/github-script@v7
+        name: Check output
+        uses: actions/github-script@v8
+        env:
+          INPUT_MATRIX: ${{ steps.gen.outputs.matrix }}
+          INPUT_EXPECTED: ${{ matrix.expected }}
        with:
          script: |
-            const targets = `${{ steps.gen.outputs.targets }}`;
-            if (!targets) {
-              core.setFailed('No targets generated');
+            const matrix = JSON.stringify(JSON.parse(core.getInput('matrix')));
+            const expected = JSON.stringify(JSON.parse(core.getInput('expected')));
+            if (matrix !== expected) {
+              throw new Error(`Matrix do not match expected values: ${matrix} != ${expected}`);
+            } else {
+              core.info(`✅`);
            }
-            core.info(`targets=${targets}`);
-
-  list-targets-multi-files:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-      -
-        name: Matrix gen
-        id: gen
-        uses: ./subaction/list-targets
-        with:
-          workdir: ./test/multi-files
-          files: |
-            docker-bake.json
-            docker-bake.hcl
-      -
-        name: Check targets
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const targets = `${{ steps.gen.outputs.targets }}`;
-            if (!targets) {
-              core.setFailed('No targets generated');
-            }
-            core.info(`targets=${targets}`);
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -52,7 +52,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v3
@@ -82,7 +82,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Build
        continue-on-error: true
@@ -99,7 +99,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Stop docker
        run: |
@@ -116,7 +116,6 @@ jobs:
      -
        name: Check
        run: |
-          echo "${{ toJson(steps.bake) }}"
          if [ "${{ steps.bake.outcome }}" != "failure" ] || [ "${{ steps.bake.conclusion }}" != "success" ]; then
            echo "::error::Should have failed"
            exit 1
@@ -127,7 +126,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Uninstall docker cli
        run: |
@@ -156,7 +155,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Build
        uses: ./
@@ -178,7 +177,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -220,7 +219,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -275,7 +274,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Build
        uses: ./
@@ -297,7 +296,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -322,7 +321,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set malformed docker config
        run: |
@@ -351,7 +350,7 @@ jobs:
          curl --retry 5 --retry-all-errors --retry-delay 0 --connect-timeout 5 --proxy http://127.0.0.1:3128 -v --insecure --head https://www.google.com
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set proxy config
        run: |
@@ -390,7 +389,7 @@ jobs:
          curl --retry 5 --retry-all-errors --retry-delay 0 --connect-timeout 5 --proxy http://127.0.0.1:3128 -v --insecure --head https://www.google.com
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -415,7 +414,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -432,7 +431,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -461,7 +460,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -505,7 +504,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -538,7 +537,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -561,7 +560,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -585,7 +584,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -606,7 +605,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -635,7 +634,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -664,7 +663,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -693,7 +692,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -715,7 +714,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -747,7 +746,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -769,7 +768,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Build
        uses: ./
@@ -779,3 +778,112 @@ jobs:
            ./test/config.hcl
        env:
          BUILDX_NO_DEFAULT_ATTESTATIONS: 1
+
+  call-check:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
+          driver-opts: |
+            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
+      -
+        name: Build
+        id: bake
+        continue-on-error: true
+        uses: ./
+        with:
+          workdir: ./test
+          source: .
+          files: |
+            ./lint.hcl
+          call: check
+          targets: lint
+      -
+        name: Check
+        run: |
+          if [ "${{ steps.bake.outcome }}" != "failure" ] || [ "${{ steps.bake.conclusion }}" != "success" ]; then
+            echo "::error::Should have failed"
+            exit 1
+          fi
+
+  call-check-multi:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
+          driver-opts: |
+            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
+      -
+        name: Build
+        id: bake
+        continue-on-error: true
+        uses: ./
+        with:
+          workdir: ./test
+          source: .
+          files: |
+            ./lint.hcl
+          call: check
+      -
+        name: Check
+        run: |
+          if [ "${{ steps.bake.outcome }}" != "failure" ] || [ "${{ steps.bake.conclusion }}" != "success" ]; then
+            echo "::error::Should have failed"
+            exit 1
+          fi
+
+  call-check-nowarning:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
+          driver-opts: |
+            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
+      -
+        name: Build
+        id: bake
+        continue-on-error: true
+        uses: ./
+        with:
+          source: .
+          files: |
+            ./test/config.hcl
+          call: check
+
+  attest-override:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
+          driver-opts: |
+            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
+      -
+        name: Build and push
+        uses: ./
+        with:
+          workdir: ./test/attest
+          source: .
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -15,7 +15,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Publish
        uses: actions/publish-immutable-action@v0.0.4
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -23,7 +23,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: Test
        uses: docker/bake-action@v6
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -19,7 +19,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      -
        name: List targets
        id: generate
--- a/.yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
+++ b/.yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
--- a/.yarnrc.yml
+++ b/.yarnrc.yml
@@ -1,3 +1,9 @@
+# https://yarnpkg.com/configuration/yarnrc
+
+compressionLevel: mixed
+enableGlobalCache: false
+enableHardenedMode: true
+
 logFilters:
  - code: YN0013
    level: discard
@@ -5,9 +11,7 @@ logFilters:
    level: discard
  - code: YN0076
    level: discard
+  - code: YN0086
+    level: discard

 nodeLinker: node-modules
-
-plugins:
-  - path: .yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
-    spec: "@yarnpkg/plugin-interactive-tools"
--- a/README.md
+++ b/README.md
@@ -22,7 +22,7 @@ ___
  * [outputs](#outputs)
  * [environment variables](#environment-variables)
 * [Subactions](#subactions)
-  * [`list-targets`](subaction/list-targets)
+  * [`matrix`](subaction/matrix)
 * [Contributing](#contributing)

 ## Usage
@@ -200,11 +200,11 @@ The following inputs can be used as `step.with` keys
 | Name           | Type        | Description                                                                                                                                                        |
 |----------------|-------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `builder`      | String      | Builder instance (see [setup-buildx](https://github.com/docker/setup-buildx-action) action)                                                                        |
-| `source`       | String      | Context to build from. Can be either local (`.`) or a [remote bake definition](https://docs.docker.com/build/customize/bake/file-definition/#remote-definition)    |
-| `allow`        | List/CSV    | Allow build to access specified resources (e.g., `network.host`)                                                                                                   |
-| `files`        | List/CSV    | List of [bake definition files](https://docs.docker.com/build/customize/bake/file-definition/)                                                                     |
 | `workdir`      | String      | Working directory of execution                                                                                                                                     |
-| `targets`      | List/CSV    | List of bake targets (`default` target used if empty)                                                                                                              |
+| `source`       | String      | Context to build from. Can be either local (`.`) or a [remote bake definition](https://docs.docker.com/build/bake/remote-definition/)                              |
+| `allow`        | List/CSV    | Allow build to access specified resources (e.g., `network.host`)                                                                                                   |
+| `call`         | String      | Set method for evaluating build (e.g., check)                                                                                                                      |
+| `files`        | List/CSV    | List of [bake definition files](https://docs.docker.com/build/customize/bake/file-definition/)                                                                     |
 | `no-cache`     | Bool        | Do not use cache when building the image (default `false`)                                                                                                         |
 | `pull`         | Bool        | Always attempt to pull a newer version of the image (default `false`)                                                                                              |
 | `load`         | Bool        | Load is a shorthand for `--set=*.output=type=docker` (default `false`)                                                                                             |
@@ -212,6 +212,7 @@ The following inputs can be used as `step.with` keys
 | `push`         | Bool        | Push is a shorthand for `--set=*.output=type=registry` (default `false`)                                                                                           |
 | `sbom`         | Bool/String | [SBOM](https://docs.docker.com/build/attestations/sbom/) is a shorthand for `--set=*.attest=type=sbom`                                                             |
 | `set`          | List        | List of [targets values to override](https://docs.docker.com/engine/reference/commandline/buildx_bake/#set) (e.g., `targetpattern.key=value`)                      |
+| `targets`      | List/CSV    | List of bake targets (`default` target used if empty)                                                                                                              |
 | `github-token` | String      | API token used to authenticate to a Git repository for [remote definitions](https://docs.docker.com/build/bake/remote-definition/) (default `${{ github.token }}`) |

 ### outputs
@@ -234,7 +235,7 @@ The following outputs are available

 ## Subactions

-* [`list-targets`](subaction/list-targets)
+* [`matrix`](subaction/matrix)

 ## Contributing

--- a/tests/context.test.ts
+++ b/tests/context.test.ts
@@ -218,7 +218,9 @@ describe('getArgs', () => {
      [
        'bake',
        '--metadata-file', metadataJson,
-        "--provenance", `mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--set', `lint.attest=type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--set', `validate-docs.attest=type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--set', `validate-vendor.attest=type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
      ],
      undefined
    ],
@@ -311,7 +313,9 @@ describe('getArgs', () => {
        '--set', '*.platform=linux/amd64,linux/ppc64le,linux/s390x',
        '--set', `*.output=type=image,"name=moby/buildkit:v0.11.0,moby/buildkit:latest",push=true`,
        '--metadata-file', metadataJson,
-        '--provenance', `mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--set', `lint.attest=type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--set', `validate-docs.attest=type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--set', `validate-vendor.attest=type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
        'image-all'
      ],
      undefined
@@ -332,7 +336,9 @@ describe('getArgs', () => {
        'bake',
        '--set', `*.labels.foo=bar=#baz`,
        '--metadata-file', metadataJson,
-        '--provenance', `mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--set', `lint.attest=type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--set', `validate-docs.attest=type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--set', `validate-vendor.attest=type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
        'image-all'
      ],
      undefined
@@ -352,7 +358,9 @@ describe('getArgs', () => {
        'https://github.com/docker/build-push-action.git#refs/heads/master',
        '--file', './foo.hcl',
        '--metadata-file', metadataJson,
-        '--provenance', `mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--set', `lint.attest=type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--set', `validate-docs.attest=type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--set', `validate-vendor.attest=type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`
      ],
      undefined
    ],
@@ -371,7 +379,9 @@ describe('getArgs', () => {
        'bake',
        '--allow', 'network.host',
        '--metadata-file', metadataJson,
-        "--provenance", `mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`
+        '--set', `lint.attest=type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--set', `validate-docs.attest=type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--set', `validate-vendor.attest=type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`
      ],
      undefined
    ],
@@ -391,7 +401,9 @@ describe('getArgs', () => {
        'https://github.com/docker/build-push-action.git#refs/heads/master:subdir',
        '--file', './foo.hcl',
        '--metadata-file', metadataJson,
-        '--provenance', `mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--set', `lint.attest=type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--set', `validate-docs.attest=type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--set', `validate-vendor.attest=type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`
      ],
      undefined
    ],
--- a/action.yml
+++ b/action.yml
@@ -10,22 +10,22 @@ inputs:
  builder:
    description: "Builder instance"
    required: false
+  workdir:
+    description: "Working directory of bake execution"
+    required: false
+    default: '.'
  source:
    description: "Context to build from. Can be either local or a remote bake definition"
    required: false
  allow:
    description: "Allow build to access specified resources (e.g., network.host)"
    required: false
+  call:
+    description: "Set method for evaluating build (e.g., check)"
+    required: false
  files:
    description: "List of bake definition files"
    required: false
-  workdir:
-    description: "Working directory of bake execution"
-    required: false
-    default: '.'
-  targets:
-    description: "List of bake targets"
-    required: false
  no-cache:
    description: "Do not use cache when building the image"
    required: false
@@ -51,6 +51,9 @@ inputs:
  set:
    description: "List of targets values to override (eg. targetpattern.key=value)"
    required: false
+  targets:
+    description: "List of bake targets"
+    required: false
  github-token:
    description: "API token used to authenticate to a Git repository for remote definitions"
    default: ${{ github.token }}
--- a/dist/606.index.js
+++ b/dist/606.index.js
@@ -0,0 +1,302 @@
+"use strict";
+exports.id = 606;
+exports.ids = [606];
+exports.modules = {
+
+/***/ 606:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   "default": () => (/* binding */ pMap)
+/* harmony export */ });
+/* unused harmony exports pMapIterable, pMapSkip */
+async function pMap(
+	iterable,
+	mapper,
+	{
+		concurrency = Number.POSITIVE_INFINITY,
+		stopOnError = true,
+		signal,
+	} = {},
+) {
+	return new Promise((resolve_, reject_) => {
+		if (iterable[Symbol.iterator] === undefined && iterable[Symbol.asyncIterator] === undefined) {
+			throw new TypeError(`Expected \`input\` to be either an \`Iterable\` or \`AsyncIterable\`, got (${typeof iterable})`);
+		}
+
+		if (typeof mapper !== 'function') {
+			throw new TypeError('Mapper function is required');
+		}
+
+		if (!((Number.isSafeInteger(concurrency) && concurrency >= 1) || concurrency === Number.POSITIVE_INFINITY)) {
+			throw new TypeError(`Expected \`concurrency\` to be an integer from 1 and up or \`Infinity\`, got \`${concurrency}\` (${typeof concurrency})`);
+		}
+
+		const result = [];
+		const errors = [];
+		const skippedIndexesMap = new Map();
+		let isRejected = false;
+		let isResolved = false;
+		let isIterableDone = false;
+		let resolvingCount = 0;
+		let currentIndex = 0;
+		const iterator = iterable[Symbol.iterator] === undefined ? iterable[Symbol.asyncIterator]() : iterable[Symbol.iterator]();
+
+		const signalListener = () => {
+			reject(signal.reason);
+		};
+
+		const cleanup = () => {
+			signal?.removeEventListener('abort', signalListener);
+		};
+
+		const resolve = value => {
+			resolve_(value);
+			cleanup();
+		};
+
+		const reject = reason => {
+			isRejected = true;
+			isResolved = true;
+			reject_(reason);
+			cleanup();
+		};
+
+		if (signal) {
+			if (signal.aborted) {
+				reject(signal.reason);
+			}
+
+			signal.addEventListener('abort', signalListener, {once: true});
+		}
+
+		const next = async () => {
+			if (isResolved) {
+				return;
+			}
+
+			const nextItem = await iterator.next();
+
+			const index = currentIndex;
+			currentIndex++;
+
+			// Note: `iterator.next()` can be called many times in parallel.
+			// This can cause multiple calls to this `next()` function to
+			// receive a `nextItem` with `done === true`.
+			// The shutdown logic that rejects/resolves must be protected
+			// so it runs only one time as the `skippedIndex` logic is
+			// non-idempotent.
+			if (nextItem.done) {
+				isIterableDone = true;
+
+				if (resolvingCount === 0 && !isResolved) {
+					if (!stopOnError && errors.length > 0) {
+						reject(new AggregateError(errors)); // eslint-disable-line unicorn/error-message
+						return;
+					}
+
+					isResolved = true;
+
+					if (skippedIndexesMap.size === 0) {
+						resolve(result);
+						return;
+					}
+
+					const pureResult = [];
+
+					// Support multiple `pMapSkip`'s.
+					for (const [index, value] of result.entries()) {
+						if (skippedIndexesMap.get(index) === pMapSkip) {
+							continue;
+						}
+
+						pureResult.push(value);
+					}
+
+					resolve(pureResult);
+				}
+
+				return;
+			}
+
+			resolvingCount++;
+
+			// Intentionally detached
+			(async () => {
+				try {
+					const element = await nextItem.value;
+
+					if (isResolved) {
+						return;
+					}
+
+					const value = await mapper(element, index);
+
+					// Use Map to stage the index of the element.
+					if (value === pMapSkip) {
+						skippedIndexesMap.set(index, value);
+					}
+
+					result[index] = value;
+
+					resolvingCount--;
+					await next();
+				} catch (error) {
+					if (stopOnError) {
+						reject(error);
+					} else {
+						errors.push(error);
+						resolvingCount--;
+
+						// In that case we can't really continue regardless of `stopOnError` state
+						// since an iterable is likely to continue throwing after it throws once.
+						// If we continue calling `next()` indefinitely we will likely end up
+						// in an infinite loop of failed iteration.
+						try {
+							await next();
+						} catch (error) {
+							reject(error);
+						}
+					}
+				}
+			})();
+		};
+
+		// Create the concurrent runners in a detached (non-awaited)
+		// promise. We need this so we can await the `next()` calls
+		// to stop creating runners before hitting the concurrency limit
+		// if the iterable has already been marked as done.
+		// NOTE: We *must* do this for async iterators otherwise we'll spin up
+		// infinite `next()` calls by default and never start the event loop.
+		(async () => {
+			for (let index = 0; index < concurrency; index++) {
+				try {
+					// eslint-disable-next-line no-await-in-loop
+					await next();
+				} catch (error) {
+					reject(error);
+					break;
+				}
+
+				if (isIterableDone || isRejected) {
+					break;
+				}
+			}
+		})();
+	});
+}
+
+function pMapIterable(
+	iterable,
+	mapper,
+	{
+		concurrency = Number.POSITIVE_INFINITY,
+		backpressure = concurrency,
+	} = {},
+) {
+	if (iterable[Symbol.iterator] === undefined && iterable[Symbol.asyncIterator] === undefined) {
+		throw new TypeError(`Expected \`input\` to be either an \`Iterable\` or \`AsyncIterable\`, got (${typeof iterable})`);
+	}
+
+	if (typeof mapper !== 'function') {
+		throw new TypeError('Mapper function is required');
+	}
+
+	if (!((Number.isSafeInteger(concurrency) && concurrency >= 1) || concurrency === Number.POSITIVE_INFINITY)) {
+		throw new TypeError(`Expected \`concurrency\` to be an integer from 1 and up or \`Infinity\`, got \`${concurrency}\` (${typeof concurrency})`);
+	}
+
+	if (!((Number.isSafeInteger(backpressure) && backpressure >= concurrency) || backpressure === Number.POSITIVE_INFINITY)) {
+		throw new TypeError(`Expected \`backpressure\` to be an integer from \`concurrency\` (${concurrency}) and up or \`Infinity\`, got \`${backpressure}\` (${typeof backpressure})`);
+	}
+
+	return {
+		async * [Symbol.asyncIterator]() {
+			const iterator = iterable[Symbol.asyncIterator] === undefined ? iterable[Symbol.iterator]() : iterable[Symbol.asyncIterator]();
+
+			const promises = [];
+			let pendingPromisesCount = 0;
+			let isDone = false;
+			let index = 0;
+
+			function trySpawn() {
+				if (isDone || !(pendingPromisesCount < concurrency && promises.length < backpressure)) {
+					return;
+				}
+
+				pendingPromisesCount++;
+
+				const promise = (async () => {
+					const {done, value} = await iterator.next();
+
+					if (done) {
+						pendingPromisesCount--;
+						return {done: true};
+					}
+
+					// Spawn if still below concurrency and backpressure limit
+					trySpawn();
+
+					try {
+						const returnValue = await mapper(await value, index++);
+
+						pendingPromisesCount--;
+
+						if (returnValue === pMapSkip) {
+							const index = promises.indexOf(promise);
+
+							if (index > 0) {
+								promises.splice(index, 1);
+							}
+						}
+
+						// Spawn if still below backpressure limit and just dropped below concurrency limit
+						trySpawn();
+
+						return {done: false, value: returnValue};
+					} catch (error) {
+						pendingPromisesCount--;
+						isDone = true;
+						return {error};
+					}
+				})();
+
+				promises.push(promise);
+			}
+
+			trySpawn();
+
+			while (promises.length > 0) {
+				const {error, done, value} = await promises[0]; // eslint-disable-line no-await-in-loop
+
+				promises.shift();
+
+				if (error) {
+					throw error;
+				}
+
+				if (done) {
+					return;
+				}
+
+				// Spawn if just dropped below backpressure limit and below the concurrency limit
+				trySpawn();
+
+				if (value === pMapSkip) {
+					continue;
+				}
+
+				yield value;
+			}
+		},
+	};
+}
+
+const pMapSkip = Symbol('skip');
+
+
+/***/ })
+
+};
+;
+//# sourceMappingURL=606.index.js.map
--- a/dist/606.index.js.map
+++ b/dist/606.index.js.map
--- a/dist/index.js
+++ b/dist/index.js
--- a/dist/index.js.map
+++ b/dist/index.js.map
--- a/dist/licenses.txt
+++ b/dist/licenses.txt
--- a/dist/sourcemap-register.js
+++ b/dist/sourcemap-register.js
--- a/package.json
+++ b/package.json
@@ -24,25 +24,25 @@
  ],
  "author": "Docker Inc.",
  "license": "Apache-2.0",
-  "packageManager": "yarn@3.6.3",
+  "packageManager": "yarn@4.9.2",
  "dependencies": {
    "@actions/core": "^1.11.1",
-    "@docker/actions-toolkit": "^0.62.1",
+    "@docker/actions-toolkit": "^0.68.0",
    "handlebars": "^4.7.8"
  },
  "devDependencies": {
-    "@types/node": "^20.12.12",
-    "@typescript-eslint/eslint-plugin": "^7.9.0",
-    "@typescript-eslint/parser": "^7.9.0",
-    "@vercel/ncc": "^0.38.1",
-    "eslint": "^8.57.0",
-    "eslint-config-prettier": "^9.1.0",
-    "eslint-plugin-jest": "^28.5.0",
-    "eslint-plugin-prettier": "^5.1.3",
+    "@types/node": "^20.19.9",
+    "@typescript-eslint/eslint-plugin": "^7.18.0",
+    "@typescript-eslint/parser": "^7.18.0",
+    "@vercel/ncc": "^0.38.3",
+    "eslint": "^8.57.1",
+    "eslint-config-prettier": "^9.1.2",
+    "eslint-plugin-jest": "^28.14.0",
+    "eslint-plugin-prettier": "^5.5.4",
    "jest": "^29.7.0",
-    "prettier": "^3.2.5",
-    "ts-jest": "^29.1.2",
+    "prettier": "^3.6.2",
+    "ts-jest": "^29.4.1",
    "ts-node": "^10.9.2",
-    "typescript": "^5.4.5"
+    "typescript": "^5.9.2"
  }
 }
--- a/src/context.ts
+++ b/src/context.ts
@@ -11,11 +11,12 @@ import {Util} from '@docker/actions-toolkit/lib/util';
 import {BakeDefinition} from '@docker/actions-toolkit/lib/types/buildx/bake';

 export interface Inputs {
-  allow: string[];
  builder: string;
-  files: string[];
  workdir: string;
-  targets: string[];
+  source: string;
+  allow: string[];
+  call: string;
+  files: string[];
  'no-cache': boolean;
  pull: boolean;
  load: boolean;
@@ -23,17 +24,18 @@ export interface Inputs {
  push: boolean;
  sbom: string;
  set: string[];
-  source: string;
+  targets: string[];
  'github-token': string;
 }

 export async function getInputs(): Promise<Inputs> {
  return {
-    allow: Util.getInputList('allow'),
    builder: core.getInput('builder'),
-    files: Util.getInputList('files'),
    workdir: core.getInput('workdir') || '.',
-    targets: Util.getInputList('targets'),
+    source: getSourceInput('source'),
+    allow: Util.getInputList('allow'),
+    call: core.getInput('call'),
+    files: Util.getInputList('files'),
    'no-cache': core.getBooleanInput('no-cache'),
    pull: core.getBooleanInput('pull'),
    load: core.getBooleanInput('load'),
@@ -41,7 +43,7 @@ export async function getInputs(): Promise<Inputs> {
    push: core.getBooleanInput('push'),
    sbom: core.getInput('sbom'),
    set: Util.getInputList('set', {ignoreComma: true, quote: false}),
-    source: getSourceInput('source'),
+    targets: Util.getInputList('targets'),
    'github-token': core.getInput('github-token')
  };
 }
@@ -69,6 +71,12 @@ async function getBakeArgs(inputs: Inputs, definition: BakeDefinition, toolkit:
      args.push('--allow', allow);
    });
  }
+  if (inputs.call) {
+    if (!(await toolkit.buildx.versionSatisfies('>=0.16.0'))) {
+      throw new Error(`Buildx >= 0.16.0 is required to use the call flag.`);
+    }
+    args.push('--call', inputs.call);
+  }
  await Util.asyncForEach(inputs.files, async file => {
    args.push('--file', file);
  });
@@ -82,16 +90,22 @@ async function getBakeArgs(inputs: Inputs, definition: BakeDefinition, toolkit:
    if (inputs.provenance) {
      args.push('--provenance', inputs.provenance);
    } else if (!noDefaultAttestations() && (await toolkit.buildkit.versionSatisfies(inputs.builder, '>=0.11.0')) && !Bake.hasDockerExporter(definition, inputs.load)) {
-      // if provenance not specified and BuildKit version compatible for
+      // check if provenance attestation is already specified in the bake
+      // definition and if not specified and BuildKit version compatible for
      // attestation, set default provenance. Also needs to make sure user
      // doesn't want to explicitly load the image to docker.
-      if (GitHub.context.payload.repository?.private ?? false) {
-        // if this is a private repository, we set the default provenance
-        // attributes being set in buildx: https://github.com/docker/buildx/blob/fb27e3f919dcbf614d7126b10c2bc2d0b1927eb6/build/build.go#L603
-        args.push('--provenance', Build.resolveProvenanceAttrs(`mode=min,inline-only=true`));
-      } else {
-        // for a public repository, we set max provenance mode.
-        args.push('--provenance', Build.resolveProvenanceAttrs(`mode=max`));
+      for (const targetName in definition.target) {
+        const target = definition.target[targetName];
+        if (!Array.isArray(target.attest) || !target.attest.some(attest => attest?.type === 'provenance')) {
+          if (GitHub.context.payload.repository?.private ?? false) {
+            // if this is a private repository, we set the default provenance
+            // attributes being set in buildx: https://github.com/docker/buildx/blob/fb27e3f919dcbf614d7126b10c2bc2d0b1927eb6/build/build.go#L603
+            args.push('--set', `${targetName}.attest=type=provenance,${Build.resolveProvenanceAttrs(`mode=min,inline-only=true`)}`);
+          } else {
+            // for a public repository, we set max provenance mode.
+            args.push('--set', `${targetName}.attest=type=provenance,${Build.resolveProvenanceAttrs(`mode=max`)}`);
+          }
+        }
      }
    }
    if (inputs.sbom) {
--- a/src/main.ts
+++ b/src/main.ts
@@ -146,8 +146,26 @@ actionsToolkit.run(
      env: buildEnv,
      ignoreReturnCode: true
    }).then(res => {
-      if (res.stderr.length > 0 && res.exitCode != 0) {
-        err = Error(`buildx bake failed with: ${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
+      if (res.exitCode != 0) {
+        if (inputs.call && inputs.call === 'check' && res.stdout.length > 0) {
+          // checks warnings are printed to stdout: https://github.com/docker/buildx/pull/2647
+          // with bake we can have multiple targets being checked so we need to
+          // count the total number of warnings
+          const totalWarnings = [...res.stdout.matchAll(/^Check complete, (\d+) warnings? (?:has|have) been found!/gm)].reduce((sum, m) => sum + parseInt(m[1], 10), 0);
+          if (totalWarnings > 0) {
+            // https://github.com/docker/buildx/blob/1e50e8ddabe108f009b9925e13a321d7c8f99f26/commands/build.go#L797-L803
+            if (totalWarnings === 1) {
+              err = Error(`Check complete, ${totalWarnings} warning has been found!`);
+            } else {
+              err = Error(`Check complete, ${totalWarnings} warnings have been found!`);
+            }
+          } else {
+            // if there are no warnings found, return the first line of stdout
+            err = Error(res.stdout.split('\n')[0]?.trim());
+          }
+        } else if (res.stderr.length > 0) {
+          err = Error(`buildx bake failed with: ${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
+        }
      }
    });

@@ -191,6 +209,8 @@ actionsToolkit.run(
    await core.group(`Check build summary support`, async () => {
      if (!buildSummaryEnabled()) {
        core.info('Build summary disabled');
+      } else if (inputs.call && inputs.call !== 'build') {
+        core.info(`Build summary skipped for ${inputs.call} subrequest`);
      } else if (GitHub.isGHES) {
        core.info('Build summary is not yet supported on GHES');
      } else if (!(await toolkit.buildx.versionSatisfies('>=0.13.0'))) {
--- a/subaction/list-targets/README.md
+++ b/subaction/list-targets/README.md
@@ -1,9 +1,14 @@
+> [!WARNING]
+> `docker/bake-action/subaction/list-targets` is deprecated and will be removed
+> in a future release. Please use [`docker/bake-action/subaction/matrix`](../matrix)
+> instead.
+
 ## About

 This subaction generates a list of Bake targets that can be used in a [GitHub matrix](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstrategymatrix),
 so you can distribute your builds across multiple runners.

-![Screenshot](../../.github/bake-action.png)
+![Screenshot](../../.github/subaction-list-targets.png)

 ___

@@ -55,9 +60,6 @@ jobs:
      matrix:
        target: ${{ fromJson(needs.prepare.outputs.targets) }}
    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
      -
        name: Validate
        uses: docker/bake-action@v6
@@ -79,6 +81,6 @@ jobs:

 The following outputs are available

-| Name       | Type     | Description                |
-|------------|----------|----------------------------|
-| `targets`  | List/CSV | List of extracted targest  |
+| Name       | Type     | Description               |
+|------------|----------|---------------------------|
+| `targets`  | List/CSV | List of extracted targets |
--- a/subaction/list-targets/action.yml
+++ b/subaction/list-targets/action.yml
@@ -26,12 +26,23 @@ runs:
      name: Generate
      id: generate
      uses: actions/github-script@v7
+      env:
+        INPUT_WORKDIR: ${{ inputs.workdir }}
+        INPUT_FILES: ${{ inputs.files }}
+        INPUT_TARGET: ${{ inputs.target }}
      with:
        script: |
-          let def;
-          const files = `${{ inputs.files }}` ? `${{ inputs.files }}`.split(/[\r?\n,]+/).filter(Boolean) : [];
-          const target = `${{ inputs.target }}`;
+          core.warning(`docker/bake-action/subaction/list-targets is deprecated and will be removed in a future release. Please use docker/bake-action/subaction/matrix instead.`);

+          function getInputList(name) {
+            return core.getInput(name) ? core.getInput(name).split(/[\r?\n,]+/).filter(x => x !== '') : [];
+          }
+
+          const workdir = core.getInput('workdir');
+          const files = getInputList('files');
+          const target = core.getInput('target');
+
+          let def = {};
          await core.group(`Validating definition`, async () => {
            let args = ['buildx', 'bake'];
            for (const file of files) {
@@ -45,7 +56,7 @@ runs:
            const res = await exec.getExecOutput('docker', args, {
              ignoreReturnCode: true,
              silent: true,
-              cwd: `${{ inputs.workdir }}`
+              cwd: workdir
            });
            if (res.stderr.length > 0 && res.exitCode != 0) {
              throw new Error(res.stderr);
--- a/subaction/matrix/README.md
+++ b/subaction/matrix/README.md
@@ -0,0 +1,140 @@
+## About
+
+This subaction generates a multi-dimension matrix that can be used in a [GitHub matrix](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstrategymatrix)
+through the [`include` property](https://docs.github.com/en/actions/how-tos/writing-workflows/choosing-what-your-workflow-does/running-variations-of-jobs-in-a-workflow#expanding-or-adding-matrix-configurations)
+so you can distribute your builds across multiple runners.
+
+![Screenshot](../../.github/subaction-matrix.png)
+
+___
+
+* [Usage](#usage)
+* [Customizing](#customizing)
+  * [inputs](#inputs)
+  * [outputs](#outputs)
+
+## Usage
+
+### List targets
+
+```hcl
+# docker-bake.hcl
+group "validate" {
+  targets = ["lint", "doctoc"]
+}
+
+target "lint" {
+  target = "lint"
+}
+
+target "doctoc" {
+  target = "doctoc"
+}
+```
+
+```yaml
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.generate.outputs.matrix }}
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Generate matrix
+        id: generate
+        uses: docker/bake-action/subaction/matrix@v6
+        with:
+          target: validate
+
+  validate:
+    runs-on: ubuntu-latest
+    needs:
+      - prepare
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJson(needs.prepare.outputs.matrix) }}
+    steps:
+      -
+        name: Validate
+        uses: docker/bake-action@v6
+        with:
+          targets: ${{ matrix.target }}
+```
+
+### Platforms split
+
+```hcl
+# docker-bake.hcl
+target "lint" {
+  dockerfile = "./hack/dockerfiles/lint.Dockerfile"
+  output = ["type=cacheonly"]
+  platforms = [
+    "darwin/amd64",
+    "darwin/arm64",
+    "linux/amd64",
+    "linux/arm64",
+    "linux/s390x",
+    "linux/ppc64le",
+    "linux/riscv64",
+    "windows/amd64",
+    "windows/arm64"
+  ]
+}
+```
+
+```yaml
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.generate.outputs.matrix }}
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Generate matrix
+        id: generate
+        uses: docker/bake-action/subaction/matrix@v6
+        with:
+          target: lint
+          fields: platforms
+
+  lint:
+    runs-on: ${{ startsWith(matrix.platforms, 'linux/arm') && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
+    needs:
+      - prepare
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJson(needs.prepare.outputs.matrix) }}
+    steps:
+      -
+        name: Lint
+        uses: docker/bake-action@v6
+        with:
+          targets: ${{ matrix.target }}
+          set: |
+            *.platform=${{ matrix.platforms }}
+```
+
+## Customizing
+
+### inputs
+
+| Name      | Type     | Description                                                                                    |
+|-----------|----------|------------------------------------------------------------------------------------------------|
+| `workdir` | String   | Working directory to use (defaults to `.`)                                                     |
+| `files`   | List/CSV | List of [bake definition files](https://docs.docker.com/build/customize/bake/file-definition/) |
+| `target`  | String   | The target to use within the bake file                                                         |
+| `fields`  | String   | List of extra fields to include in the matrix                                                  |
+
+### outputs
+
+| Name     | Type | Description          |
+|----------|------|----------------------|
+| `matrix` | JSON | Matrix configuration |
--- a/subaction/matrix/action.yml
+++ b/subaction/matrix/action.yml
@@ -0,0 +1,101 @@
+# https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions
+name: 'Matrix'
+description: 'Generate a matrix from a Bake definition to help distributing builds in your workflow'
+
+inputs:
+  workdir:
+    description: Working directory
+    default: '.'
+    required: false
+  files:
+    description: List of Bake files
+    required: false
+  target:
+    description: Bake target
+    required: false
+  fields:
+    description: List of extra fields to include in the matrix
+    required: false
+
+outputs:
+  matrix:
+    description: Matrix configuration
+    value: ${{ steps.generate.outputs.includes }}
+
+runs:
+  using: composite
+  steps:
+    -
+      name: Generate
+      id: generate
+      uses: actions/github-script@v7
+      env:
+        INPUT_WORKDIR: ${{ inputs.workdir }}
+        INPUT_FILES: ${{ inputs.files }}
+        INPUT_TARGET: ${{ inputs.target }}
+        INPUT_FIELDS: ${{ inputs.fields }}
+      with:
+        script: |
+          function getInputList(name) {
+            return core.getInput(name) ? core.getInput(name).split(/[\r?\n,]+/).filter(x => x !== '') : [];
+          }
+
+          const workdir = core.getInput('workdir');
+          const files = getInputList('files');
+          const target = core.getInput('target');
+          const fields = getInputList('fields');
+
+          let def = {};
+          await core.group(`Parsing definition`, async () => {
+            let args = ['buildx', 'bake'];
+            for (const file of files) {
+              args.push('--file', file);
+            }
+            if (target) {
+              args.push(target);
+            }
+            args.push('--print');
+            const res = await exec.getExecOutput('docker', args, {
+              ignoreReturnCode: true,
+              silent: true,
+              cwd: workdir
+            });
+            if (res.stderr.length > 0 && res.exitCode != 0) {
+              throw new Error(res.stderr);
+            }
+            def = JSON.parse(res.stdout.trim());
+            core.info(JSON.stringify(def, null, 2));
+          });
+
+          await core.group(`Generating matrix`, async () => {
+            const result = [];
+            for (const targetName of Object.keys(def.target)) {
+              const target = def.target[targetName];
+              const entry = { target: targetName };
+              if (fields.length === 0) {
+                result.push({ ...entry });
+                continue;
+              }
+              let fieldFound = false;
+              Object.keys(target).forEach(field => {
+                if (fields.includes(field)) {
+                  fieldFound = true;
+                  const value = target[field];
+                  if (Array.isArray(value)) {
+                    value.forEach((v) => {
+                      entry[field] = v;
+                      result.push({ ...entry });
+                    });
+                  } else {
+                    entry[field] = value;
+                    result.push({ ...entry });
+                  }
+                }
+              });
+              if (!fieldFound) {
+                result.push({ ...entry });
+              }
+            }
+            core.info(JSON.stringify(result, null, 2));
+            core.setOutput('includes', JSON.stringify(result));
+          });
--- a/test/attest/Dockerfile
+++ b/test/attest/Dockerfile
@@ -0,0 +1,10 @@
+# syntax=docker/dockerfile:1
+
+FROM busybox AS t1
+RUN echo "Hello t1"
+
+FROM busybox AS t2
+RUN echo "Hello t2"
+
+FROM busybox AS t3
+RUN echo "Hello t3"
--- a/test/attest/docker-bake.hcl
+++ b/test/attest/docker-bake.hcl
@@ -0,0 +1,17 @@
+group "default" {
+  targets = ["t1", "t2", "t3"]
+}
+
+target "t1" {
+  target = "t1"
+}
+
+target "t2" {
+  target = "t2"
+  attest = ["type=provenance,mode=min"]
+}
+
+target "t3" {
+  target = "t3"
+  attest = ["type=sbom"]
+}
--- a/test/group-with-platform/docker-bake.hcl
+++ b/test/group-with-platform/docker-bake.hcl
@@ -0,0 +1,36 @@
+group "validate" {
+  targets = ["lint", "lint-gopls", "validate-vendor", "validate-docs"]
+}
+
+target "lint" {
+  dockerfile = "./hack/dockerfiles/lint.Dockerfile"
+  output = ["type=cacheonly"]
+  platforms = [
+    "darwin/amd64",
+    "darwin/arm64",
+    "linux/amd64",
+    "linux/arm64",
+    "linux/s390x",
+    "linux/ppc64le",
+    "linux/riscv64",
+    "windows/amd64",
+    "windows/arm64"
+  ]
+}
+
+target "lint-gopls" {
+  inherits = ["lint"]
+  target = "gopls-analyze"
+}
+
+target "validate-vendor" {
+  dockerfile = "./hack/dockerfiles/vendor.Dockerfile"
+  target = "validate"
+  output = ["type=cacheonly"]
+}
+
+target "validate-docs" {
+  dockerfile = "./hack/dockerfiles/docs.Dockerfile"
+  target = "validate"
+  output = ["type=cacheonly"]
+}
--- a/yarn.lock
+++ b/yarn.lock
Author	SHA1	Message	Date
CrazyMax	5be5f02ff8	Merge pull request #360 from docker/dependabot/npm_and_yarn/docker/actions-toolkit-0.68.0 chore(deps): Bump @docker/actions-toolkit from 0.63.0 to 0.68.0	2025-11-27 12:30:41 +01:00
CrazyMax	4f25520e7a	chore: update generated content Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-11-27 12:13:33 +01:00
dependabot[bot]	eeacb3deff	chore(deps): Bump @docker/actions-toolkit from 0.63.0 to 0.68.0 Bumps [@docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.63.0 to 0.68.0. - [Release notes](https://github.com/docker/actions-toolkit/releases) - [Commits](https://github.com/docker/actions-toolkit/compare/v0.63.0...v0.68.0) --- updated-dependencies: - dependency-name: "@docker/actions-toolkit" dependency-version: 0.68.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2025-11-27 10:31:45 +00:00
CrazyMax	cce027f633	Merge pull request #358 from docker/dependabot/github_actions/actions/checkout-6 chore(deps): Bump actions/checkout from 5 to 6	2025-11-27 09:56:13 +01:00
CrazyMax	53ce91f18b	Merge pull request #357 from docker/dependabot/npm_and_yarn/js-yaml-3.14.2 chore(deps): Bump js-yaml from 3.14.1 to 3.14.2	2025-11-27 09:56:02 +01:00
dependabot[bot]	6b8437d2b5	chore(deps): Bump actions/checkout from 5 to 6 Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v5...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2025-11-27 08:54:22 +00:00
CrazyMax	d14785b0cb	Merge pull request #359 from crazy-max/check-attest-definition check provenance attestation set in bake definition before overriding	2025-11-27 09:53:25 +01:00
CrazyMax	597dc07998	chore: update generated content Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-11-26 12:30:19 +01:00
CrazyMax	8ba51ac4ee	check provenance attestation set in bake definition before overriding Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-11-26 12:30:19 +01:00
dependabot[bot]	23c049fba9	chore(deps): Bump js-yaml from 3.14.1 to 3.14.2 Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 3.14.1 to 3.14.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/3.14.1...3.14.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 3.14.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2025-11-17 20:01:35 +00:00
CrazyMax	41c10f2beb	Merge pull request #350 from docker/dependabot/github_actions/actions/github-script-8 chore(deps): Bump actions/github-script from 7 to 8	2025-09-13 13:12:26 +02:00
dependabot[bot]	5b9bf92d49	chore(deps): Bump actions/github-script from 7 to 8 Bumps [actions/github-script](https://github.com/actions/github-script) from 7 to 8. - [Release notes](https://github.com/actions/github-script/releases) - [Commits](https://github.com/actions/github-script/compare/v7...v8) --- updated-dependencies: - dependency-name: actions/github-script dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2025-09-04 23:01:25 +00:00
CrazyMax	3acf805d94	Merge pull request #345 from crazy-max/update-yarn update yarn to 4.9.2	2025-08-20 17:02:25 +02:00
CrazyMax	f6376ff6a4	update yarn to 4.9.2 Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-20 16:56:24 +02:00
CrazyMax	60b3af61bc	Merge pull request #344 from crazy-max/update-dev update dev dependencies	2025-08-20 16:54:19 +02:00
CrazyMax	f08ef55f78	chore: update generated content Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-20 16:51:55 +02:00
CrazyMax	c22b3482ed	update dev dependencies Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-20 16:51:03 +02:00
CrazyMax	40bffc195e	Merge pull request #342 from docker/dependabot/npm_and_yarn/docker/actions-toolkit-0.63.0 chore(deps): Bump @docker/actions-toolkit from 0.62.1 to 0.63.0	2025-08-20 16:49:03 +02:00
CrazyMax	d7a0b5eb51	chore: update generated content Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-20 16:46:24 +02:00
dependabot[bot]	3965f4baf4	chore(deps): Bump @docker/actions-toolkit from 0.62.1 to 0.63.0 Bumps [@docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.62.1 to 0.63.0. - [Release notes](https://github.com/docker/actions-toolkit/releases) - [Commits](https://github.com/docker/actions-toolkit/compare/v0.62.1...v0.63.0) --- updated-dependencies: - dependency-name: "@docker/actions-toolkit" dependency-version: 0.63.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2025-08-20 14:43:32 +00:00
CrazyMax	3d864c34f9	Merge pull request #341 from docker/dependabot/npm_and_yarn/tmp-0.2.4 chore(deps): Bump tmp from 0.2.3 to 0.2.4	2025-08-20 16:41:23 +02:00
CrazyMax	3589b0c183	chore: update generated content Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-20 16:39:06 +02:00
dependabot[bot]	2215fae6ab	chore(deps): Bump tmp from 0.2.3 to 0.2.4 Bumps [tmp](https://github.com/raszi/node-tmp) from 0.2.3 to 0.2.4. - [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md) - [Commits](https://github.com/raszi/node-tmp/compare/v0.2.3...v0.2.4) --- updated-dependencies: - dependency-name: tmp dependency-version: 0.2.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2025-08-20 14:37:49 +00:00
CrazyMax	d0cb9774dc	Merge pull request #340 from docker/dependabot/npm_and_yarn/undici-5.29.0 chore(deps): Bump undici from 5.28.4 to 5.29.0	2025-08-20 16:35:21 +02:00
CrazyMax	a6c0a91e79	chore: update generated content Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-20 16:31:47 +02:00
dependabot[bot]	74cb41d332	chore(deps): Bump undici from 5.28.4 to 5.29.0 Bumps [undici](https://github.com/nodejs/undici) from 5.28.4 to 5.29.0. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](https://github.com/nodejs/undici/compare/v5.28.4...v5.29.0) --- updated-dependencies: - dependency-name: undici dependency-version: 5.29.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2025-08-20 14:29:38 +00:00
CrazyMax	8f035c08cd	Merge pull request #339 from docker/dependabot/npm_and_yarn/brace-expansion-1.1.12 chore(deps): Bump brace-expansion from 1.1.11 to 1.1.12	2025-08-20 16:27:16 +02:00
CrazyMax	a4c28defc8	chore: update generated content Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-20 16:25:20 +02:00
dependabot[bot]	d260a27f75	chore(deps): Bump brace-expansion from 1.1.11 to 1.1.12 Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.11 to 1.1.12. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/1.1.11...v1.1.12) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.12 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2025-08-20 14:23:25 +00:00
CrazyMax	5efdf4de8d	Merge pull request #338 from crazy-max/call-input call input to set method for evaluating build	2025-08-20 16:19:54 +02:00
Tõnis Tiigi	1a42865db7	Merge pull request #204 from crazy-max/subaction-matrix matrix subaction	2025-08-20 12:39:21 +03:00
CrazyMax	ba406cd72e	subaction: check expected output Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-14 10:14:36 +02:00
CrazyMax	1d0c0ffa52	list-targets: deprecation notice Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-14 10:14:36 +02:00
CrazyMax	68cf998b48	matrix subaction Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-14 10:14:36 +02:00
CrazyMax	7a78e75fa4	chore: update generated content Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-14 09:50:47 +02:00
CrazyMax	24d8c3471c	call input to set method for evaluating build Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-08-14 09:48:36 +02:00
CrazyMax	6de75d5ad2	Merge pull request #343 from docker/dependabot/github_actions/actions/checkout-5 chore(deps): Bump actions/checkout from 4 to 5	2025-08-14 09:41:42 +02:00
dependabot[bot]	72003b9fac	chore(deps): Bump actions/checkout from 4 to 5 Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v5) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2025-08-12 09:45:44 +00:00
CrazyMax	a1257e6518	Merge pull request #334 from docker/dependabot/npm_and_yarn/form-data-2.5.5 chore(deps): Bump form-data from 2.5.1 to 2.5.5	2025-08-05 15:17:20 +02:00
CrazyMax	846dea0f3a	Merge pull request #335 from meator/patch-1 README.md: fix link	2025-07-25 12:25:38 +02:00
meator	1367d98caa	README.md: fix link The old link pointed to a section which no longer exists. Signed-off-by: meator <meator.dev@gmail.com>	2025-07-23 17:33:43 +02:00
dependabot[bot]	88f3e5553b	chore(deps): Bump form-data from 2.5.1 to 2.5.5 Bumps [form-data](https://github.com/form-data/form-data) from 2.5.1 to 2.5.5. - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/v2.5.5/CHANGELOG.md) - [Commits](https://github.com/form-data/form-data/compare/v2.5.1...v2.5.5) --- updated-dependencies: - dependency-name: form-data dependency-version: 2.5.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2025-07-21 23:22:07 +00:00
CrazyMax	d576212e5b	Merge pull request #332 from crazy-max/subaction-list-targets-enhanced list-targets: use toolkit to sanitize inputs	2025-07-04 17:11:25 +02:00
CrazyMax	d4a3c3cc87	list-targets: use toolkit to sanitize inputs Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>	2025-07-04 16:40:51 +02:00