bake.yml

name: bake

on:
  workflow_call:
    inputs:
      runner:
        type: string
        description: "GitHub-hosted Linux runner label or platform mapping to build on"
        required: false
        default: |
          default=ubuntu-26.04
          linux/arm=ubuntu-26.04-arm
          linux/arm64=ubuntu-26.04-arm
      distribute:
        type: boolean
        description: "Whether to distribute the build across multiple runners (one platform per runner)"
        required: false
        default: true
      fail-fast:
        type: boolean
        description: "Whether to cancel all in-progress and queued jobs in the matrix if any job fails"
        required: false
        default: false
      job-name-prefix:
        type: string
        description: "Prefix to include in reusable workflow job matrix names in the GitHub Actions UI"
        required: false
      setup-qemu:
        type: boolean
        description: "Runs the setup-qemu-action step to install QEMU static binaries"
        required: false
        default: false
      artifact-name:
        type: string
        description: "Name of the uploaded GitHub artifact (for local output)"
        required: false
        default: 'docker-github-builder-assets'
      artifact-upload:
        type: boolean
        description: "Upload build output GitHub artifact (for local output)"
        required: false
        default: false
      artifact-retention-days:
        type: number
        description: "Duration after which artifact will expire in days. 0 means using default retention."
        required: false
        default: 0
      cache:
        type: boolean
        description: "Enable cache to GitHub Actions cache backend"
        required: false
        default: false
      cache-scope:
        type: string
        description: "Which scope cache object belongs to if cache enabled (defaults to target name)"
        required: false
      cache-mode:
        type: string
        description: "Cache layers to export if cache enabled (min or max)"
        required: false
        default: 'min'
      context:
        type: string
        description: "Context to build from in the Git working tree"
        required: false
        default: .
      files:
        type: string
        description: "List of bake definition files"
        required: false
      output:
        type: string
        description: "Build output destination (one of image or local). Unlike the build-push-action, it only accepts image or local. The reusable workflow takes care of setting the outputs attribute"
        required: true
      push:
        type: boolean
        description: "Push image to the registry (for image output)"
        required: false
        default: false
      registry-login:
        type: string
        description: "Login to registry before build (one of auto, true or false). Auto enables login only when output is image and push is true"
        required: false
        default: auto
      sbom:
        type: boolean
        description: "Generate SBOM attestation for the build"
        required: false
        default: false
      set:
        type: string
        description: "List of targets values to override (eg. targetpattern.key=value)"
        required: false
      sign:
        type: string
        description: "Sign attestation manifest for image output or artifacts for local output, can be one of auto, true or false. The auto mode will enable signing if push is enabled for pushing the image or if artifact-upload is enabled for uploading the local build output as GitHub Artifact"
        required: false
        default: auto
      target:
        type: string
        description: "Bake target to build"
        required: false
        default: default
      vars:
        type: string
        description: "Variables to set in the Bake definition as list of key-value pair"
        required: false
      registry-identities:
        type: string
        description: "Keyless registry identity configuration as YAML objects"
        required: false
      # docker/metadata-action
      set-meta-annotations:
        type: boolean
        description: "Append OCI Image Format Specification annotations generated by docker/metadata-action"
        required: false
        default: false
      set-meta-labels:
        type: boolean
        description: "Append OCI Image Format Specification labels generated by docker/metadata-action"
        required: false
        default: false
      meta-images:
        type: string
        description: "List of images to use as base name for tags (required for image output)"
        required: false
      meta-tags:
        type: string
        description: "List of tags as key-value pair attributes"
        required: false
      meta-flavor:
        type: string
        description: "Flavor defines a global behavior for meta-tags"
        required: false
      meta-labels:
        type: string
        description: "List of custom labels"
        required: false
      meta-annotations:
        type: string
        description: "List of custom annotations"
        required: false
      meta-bake-target:
        type: string
        description: "Bake target name for metadata (defaults to docker-metadata-action)"
        required: false
      # buildkit config
      buildkit-proxy-network:
        type: boolean
        description: "Enable BuildKit proxy network mode"
        required: false
        default: false
    secrets:
      registry-auths:
        description: "Raw authentication to registries, defined as YAML objects"
        required: false
      build-secrets:
        description: "YAML object mapping BuildKit secret IDs to values, with optional nested target mappings"
        required: false
      github-token:
        description: "GitHub Token used to authenticate against the repository for Git context"
        required: false
    outputs:
      meta-json:
        description: "Metadata JSON output (for image output)"
        value: ${{ jobs.finalize.outputs.meta-json }}
      cosign-version:
        description: "Cosign version used for verification"
        value: ${{ jobs.finalize.outputs.cosign-version }}
      cosign-verify-commands:
        description: "Cosign verify commands"
        value: ${{ jobs.finalize.outputs.cosign-verify-commands }}
      artifact-name:
        description: "Name of the uploaded artifact (for local output)"
        value: ${{ jobs.finalize.outputs.artifact-name }}
      digest:
        description: "Digest of the image pushed or artifact uploaded"
        value: ${{ jobs.finalize.outputs.digest }}
      output-type:
        description: "Build output type"
        value: ${{ jobs.finalize.outputs.output-type }}
      signed:
        description: "Whether attestations manifests or artifacts were signed"
        value: ${{ jobs.finalize.outputs.signed }}

env:
  BUILDX_VERSION: "v0.38.2"
  BUILDKIT_IMAGE: "moby/buildkit:v0.34.2"
  SBOM_IMAGE: "docker/buildkit-syft-scanner:1.12.1"
  BINFMT_IMAGE: "tonistiigi/binfmt:qemu-v10.2.3-68"
  RUNTIME_MODULE: "@docker/github-builder-runtime@0.109.0"
  RUNTIME_INSTALL_ARGS: |
    --loglevel=error
    --no-save
    --package-lock=false
    --ignore-scripts
    --omit=dev
    --prefer-offline
    --fund=false
    --audit=false
  COSIGN_VERSION: "v3.1.4"
  LOCAL_EXPORT_DIR: "/tmp/buildx-output"
  MATRIX_SIZE_LIMIT: "20"
  BUILDX_METADATA_PROVENANCE: "false"
  BUILDX_SEND_GIT_QUERY_AS_INPUT: "true"
  NPM_CONFIG_FETCH_RETRIES: "5"

jobs:
  registry-identities:
    uses: ./.github/workflows/setup-registry-identities.yml
    with:
      registry-login: ${{ inputs.registry-login == 'true' || (inputs.registry-login == 'auto' && inputs.push && inputs.output == 'image') }}
      registry-identities: ${{ inputs.registry-identities }}

  prepare:
    runs-on: ubuntu-26.04
    strategy:
      matrix:
        include:
          - name: ${{ inputs.job-name-prefix }}
    outputs:
      includes: ${{ steps.set.outputs.includes }}
      metaImages: ${{ steps.set.outputs.metaImages }}
      sign: ${{ steps.set.outputs.sign }}
      privateRepo: ${{ steps.set.outputs.privateRepo }}
      targets: ${{ steps.set.outputs.targets }}
      ghaCacheSign: ${{ steps.set.outputs.ghaCacheSign }}
      proxyNetwork: ${{ steps.set.outputs.proxyNetwork }}
      registryLogin: ${{ steps.set.outputs.registryLogin }}
    steps:
      -
        name: Install dependencies
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_RUNTIME-MODULE: ${{ env.RUNTIME_MODULE }}
          INPUT_RUNTIME-INSTALL-ARGS: ${{ env.RUNTIME_INSTALL_ARGS }}
        with:
          script: |
            const npmArgs = ['install', ...core.getMultilineInput('runtime-install-args'), core.getInput('runtime-module')];
            const maxAttempts = 3;
            for (let attempt = 1; attempt <= maxAttempts; attempt++) {
              const exitCode = await exec.exec('npm', npmArgs, {ignoreReturnCode: true});
              if (exitCode === 0) {
                return;
              }
              if (attempt === maxAttempts) {
                core.setFailed(`npm install failed after ${maxAttempts} attempts`);
                return;
              }
              const retryDelayMs = attempt * 50;
              core.info(`npm install failed with exit code ${exitCode}; retrying in ${retryDelayMs}ms`);
              await new Promise(resolve => setTimeout(resolve, retryDelayMs));
            }
      -
        name: Install Cosign
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_COSIGN-VERSION: ${{ env.COSIGN_VERSION }}
        with:
          script: |
            const { Cosign } = require('@docker/github-builder-runtime/lib/cosign/cosign');
            const { Install } = require('@docker/github-builder-runtime/lib/cosign/install');

            const inpCosignVersion = core.getInput('cosign-version');

            const cosignInstall = new Install();
            const cosignBinPath = await cosignInstall.download({
              version: core.getInput('cosign-version'),
              ghaNoCache: true,
              skipState: true,
              verifySignature: true
            });
            const cosignPath = await cosignInstall.install(cosignBinPath);

            const cosign = new Cosign();
            await cosign.printVersion();
      -
        name: Check dependencies signatures
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_IMAGES: |
            ${{ env.BUILDKIT_IMAGE }}
            ${{ env.SBOM_IMAGE }}
            ${{ env.BINFMT_IMAGE }}
        with:
          script: |
            const { OCI } = require('@docker/github-builder-runtime/lib/oci/oci');
            const { Sigstore } = require('@docker/github-builder-runtime/lib/sigstore/sigstore');

            const sigstore = new Sigstore();
            
            for (const image of core.getMultilineInput('images')) {
              try {
                await core.group(`Verifying ${image}`, async () => {
                  await sigstore.verifyImageAttestations(image, {
                    certificateIdentityRegexp: `^https://github.com/docker/github-builder(-experimental)?/.github/workflows/bake.yml.*$`,
                    platform: OCI.defaultPlatform()
                  });
                });
              } catch (error) {
                core.setFailed(`Failed to verify ${image}: ${error.message || error}`);
                return;
              }
            }
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
        with:
          version: ${{ env.BUILDX_VERSION }}
          cache-binary: false
          driver-opts: |
            image=${{ env.BUILDKIT_IMAGE }}
      -
        name: Set outputs
        id: set
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_SBOM-IMAGE: ${{ env.SBOM_IMAGE }}
          INPUT_MATRIX-SIZE-LIMIT: ${{ env.MATRIX_SIZE_LIMIT }}
          INPUT_META-IMAGES: ${{ inputs.meta-images }}
          INPUT_RUNNER: ${{ inputs.runner }}
          INPUT_DISTRIBUTE: ${{ inputs.distribute }}
          INPUT_ARTIFACT-UPLOAD: ${{ inputs.artifact-upload }}
          INPUT_JOB-NAME-PREFIX: ${{ inputs.job-name-prefix }}
          INPUT_CONTEXT: ${{ inputs.context }}
          INPUT_FILES: ${{ inputs.files }}
          INPUT_OUTPUT: ${{ inputs.output }}
          INPUT_PUSH: ${{ inputs.push }}
          INPUT_REGISTRY-LOGIN: ${{ inputs.registry-login }}
          INPUT_SBOM: ${{ inputs.sbom }}
          INPUT_SET: ${{ inputs.set }}
          INPUT_SIGN: ${{ inputs.sign }}
          INPUT_TARGET: ${{ inputs.target }}
          INPUT_VARS: ${{ inputs.vars }}
          INPUT_GITHUB-TOKEN: ${{ secrets.github-token || github.token }}
          INPUT_BUILDKIT-PROXY-NETWORK: ${{ inputs.buildkit-proxy-network }}
        with:
          script: |
            const os = require('os');
            const { Bake } = require('@docker/github-builder-runtime/lib/buildx/bake');
            const { Build } = require('@docker/github-builder-runtime/lib/buildx/build');
            const { GitHub } = require('@docker/github-builder-runtime/lib/github/github');
            const { MetaImages } = require('@docker/github-builder-runtime/lib/github-builder/meta-images');
            const { RunnerMapping } = require('@docker/github-builder-runtime/lib/github-builder/runner-mapping');
            const { BakeTargets } = require('@docker/github-builder-runtime/lib/github-builder/bake-targets');
            const { BakeVars } = require('@docker/github-builder-runtime/lib/github-builder/bake-vars');
            const { Util } = require('@docker/github-builder-runtime/lib/util');

            const inpSbomImage = core.getInput('sbom-image');
            const inpMatrixSizeLimit = parseInt(core.getInput('matrix-size-limit'), 10);
            const inpMetaImages = core.getMultilineInput('meta-images');
            const actionsIdTokenSet = !!process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN && !!process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
            
            const inpRunner = core.getMultilineInput('runner');
            const inpDistribute = core.getBooleanInput('distribute');
            const inpArtifactUpload = core.getBooleanInput('artifact-upload');
            const inpJobNamePrefix = core.getInput('job-name-prefix');
            const inpContext = core.getInput('context');
            const inpVars = Util.getInputList('vars', {ignoreComma: true, quote: false});
            const inpFiles = Util.getInputList('files');
            const inpOutput = core.getInput('output');
            const inpPush = core.getBooleanInput('push');
            const inpRegistryLogin = core.getInput('registry-login');
            const inpSbom = core.getBooleanInput('sbom');
            const inpSet = Util.getInputList('set', {ignoreComma: true, quote: false});
            const inpSign = core.getInput('sign');
            const inpTarget = core.getInput('target');
            const inpGitHubToken = core.getInput('github-token');
            const inpProxyNetwork = core.getBooleanInput('buildkit-proxy-network');
            
            let runnerConfig;
            try {
              runnerConfig = RunnerMapping.parse(inpRunner);
            } catch (error) {
              core.setFailed(error.message);
              return;
            }
            await core.group(`Set runner config`, async () => {
              core.info(JSON.stringify(runnerConfig, null, 2));
            });
            
            const sign =
              inpSign === 'auto'
              ? (inpOutput === 'image' && inpPush) || (inpOutput === 'local' && inpArtifactUpload)
              : inpSign === 'true';
            
            if (inpOutput === 'local' && inpPush) {
              core.warning(`push is ignored when output is local`);
            } else if (inpOutput === 'image' && inpArtifactUpload) {
              core.warning(`artifact-upload is ignored when output is image`);
            }
            if (inpOutput === 'image' && !inpPush && sign) {
              core.setFailed(`signing attestation manifests requires push to be enabled`);
              return;
            }
            
            const gitContextAttrs = GitHub.context.ref.startsWith('refs/tags/') ? {checksum: GitHub.context.sha} : {'fetch-by-commit': 'true'};
            const bakeSource = await new Build().gitContext({subdir: inpContext, attrs: gitContextAttrs});
            await core.group(`Set bake source`, async () => {
              core.info(bakeSource);
            });

            if (!['auto', 'true', 'false'].includes(inpRegistryLogin)) {
              core.setFailed(`Invalid registry-login input: ${inpRegistryLogin}`);
              return;
            }
            const registryLogin = inpRegistryLogin === 'auto' ? inpOutput === 'image' && inpPush : inpRegistryLogin === 'true';

            const bakeVars = BakeVars.resolve(inpVars);
            await core.group(`Set bake vars`, async () => {
              core.info(JSON.stringify(bakeVars.map(value => {
                const idx = value.indexOf('=');
                return idx === -1 ? '<invalid>' : value.substring(0, idx);
              }).sort(), null, 2));
            });

            const metaImages = MetaImages.resolve(inpMetaImages);
            await core.group(`Set metaImages output`, async () => {
              core.info(JSON.stringify(metaImages, null, 2));
              core.setOutput('metaImages', metaImages.join('\n'));
            });

            let def;
            let target;
            try {
              await core.group(`Validating definition`, async () => {
                const bake = new Bake();
                // Resolve the graph without local secret files. The build job validates
                // secrets after applying the workflow-provided source overrides.
                const validationOverrides = inpSet.filter(override => {
                  const key = override.split('=', 1)[0].split('.')[1];
                  return !['secret', 'secrets', 'secrets+'].includes(key);
                });
                def = await bake.getDefinition({
                  files: inpFiles,
                  overrides: [...validationOverrides, '*.secrets='],
                  sbom: inpSbom ? `generator=${inpSbomImage}` : 'false',
                  source: bakeSource,
                  targets: [inpTarget],
                  vars: bakeVars,
                  githubToken: inpGitHubToken
                }, {
                  env: {
                    BUILDKIT_MULTI_PLATFORM: '1',
                    BUILDX_BAKE_DISABLE_VARS_ENV_LOOKUP: '1'
                  }
                });
                if (!def) {
                  throw new Error('Bake definition not set');
                }
                const targets = BakeTargets.resolve(def, inpTarget);
                target = inpTarget;
                core.setOutput('targets', JSON.stringify(targets));
              });
            } catch (error) {
              core.setFailed(error);
              return;
            }

            const platforms = def.target[target].platforms || [];
            if (inpDistribute && platforms.length > inpMatrixSizeLimit) {
              core.setFailed(`Platforms to build exceed matrix size limit of ${inpMatrixSizeLimit}`);
              return;
            }

            const privateRepo = GitHub.context.payload.repository?.private ?? false;
            await core.group(`Set privateRepo output`, async () => {
              core.info(`privateRepo: ${privateRepo}`);
              core.setOutput('privateRepo', privateRepo);
            });

            await core.group(`Set proxyNetwork output`, async () => {
              const proxyNetwork = inpProxyNetwork ? 'true' : 'false';
              core.info(`proxyNetwork: ${proxyNetwork}`);
              core.setOutput('proxyNetwork', proxyNetwork);
            });
            
            await core.group(`Set includes output`, async () => {
              const withJobNamePrefix = include => {
                if (inpJobNamePrefix) {
                  return {name: inpJobNamePrefix, ...include};
                }
                return include;
              };
              let includes = [];
              if (!inpDistribute || platforms.length === 0) {
                includes.push(withJobNamePrefix({
                  index: 0,
                  runner: RunnerMapping.resolve(runnerConfig)
                }));
              } else {
                platforms.forEach((platform, index) => {
                  includes.push(withJobNamePrefix({
                    index: index,
                    platform: platform,
                    runner: RunnerMapping.resolve(runnerConfig, platform)
                  }));
                });
              }
              core.info(JSON.stringify(includes, null, 2));
              core.setOutput('includes', JSON.stringify(includes));
            });
            await core.group(`Set sign output`, async () => {
              core.info(`sign: ${sign}`);
              core.setOutput('sign', sign);
            });
            await core.group(`Set ghaCacheSign output`, async () => {
              const ghaCacheSign = actionsIdTokenSet ? 'true' : 'false';
              core.info(`ghaCacheSign: ${ghaCacheSign}`);
              core.setOutput('ghaCacheSign', ghaCacheSign);
            });
            await core.group(`Set registryLogin output`, async () => {
              core.info(`registryLogin: ${registryLogin}`);
              core.setOutput('registryLogin', registryLogin);
            });

  build:
    runs-on: ${{ matrix.runner }}
    needs:
      - registry-identities
      - prepare
    env:
      DOCKER_BUILD_SUMMARY: false
      REGISTRY_AUTHS_PRESENT: ${{ secrets.registry-auths != '' }}
    strategy:
      fail-fast: ${{ inputs.fail-fast }}
      matrix:
        include: ${{ fromJson(needs.prepare.outputs.includes) }}
    outputs:
      # needs predefined outputs as we can't use dynamic ones atm: https://github.com/actions/runner/pull/2477
      # 20 is the maximum number of platforms supported by our matrix strategy
      result_0: ${{ steps.result.outputs.result_0 }}
      result_1: ${{ steps.result.outputs.result_1 }}
      result_2: ${{ steps.result.outputs.result_2 }}
      result_3: ${{ steps.result.outputs.result_3 }}
      result_4: ${{ steps.result.outputs.result_4 }}
      result_5: ${{ steps.result.outputs.result_5 }}
      result_6: ${{ steps.result.outputs.result_6 }}
      result_7: ${{ steps.result.outputs.result_7 }}
      result_8: ${{ steps.result.outputs.result_8 }}
      result_9: ${{ steps.result.outputs.result_9 }}
      result_10: ${{ steps.result.outputs.result_10 }}
      result_11: ${{ steps.result.outputs.result_11 }}
      result_12: ${{ steps.result.outputs.result_12 }}
      result_13: ${{ steps.result.outputs.result_13 }}
      result_14: ${{ steps.result.outputs.result_14 }}
      result_15: ${{ steps.result.outputs.result_15 }}
      result_16: ${{ steps.result.outputs.result_16 }}
      result_17: ${{ steps.result.outputs.result_17 }}
      result_18: ${{ steps.result.outputs.result_18 }}
      result_19: ${{ steps.result.outputs.result_19 }}
    steps:
      -
        name: Require GitHub-hosted Linux runner
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_RUNNER-ENVIRONMENT: ${{ runner.environment }}
          INPUT_RUNNER-OS: ${{ runner.os }}
        with:
          script: |
            const runnerEnvironment = core.getInput('runner-environment');
            const runnerOS = core.getInput('runner-os');
            if (runnerEnvironment !== 'github-hosted' || runnerOS !== 'Linux') {
              core.setFailed(`This workflow requires a GitHub-hosted Linux runner, got: environment=${runnerEnvironment || 'unknown'}, os=${runnerOS || 'unknown'}`);
            }
      -
        name: Install dependencies
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_RUNTIME-MODULE: ${{ env.RUNTIME_MODULE }}
          INPUT_RUNTIME-INSTALL-ARGS: ${{ env.RUNTIME_INSTALL_ARGS }}
        with:
          script: |
            const npmArgs = ['install', ...core.getMultilineInput('runtime-install-args'), core.getInput('runtime-module')];
            const maxAttempts = 3;
            for (let attempt = 1; attempt <= maxAttempts; attempt++) {
              const exitCode = await exec.exec('npm', npmArgs, {ignoreReturnCode: true});
              if (exitCode === 0) {
                return;
              }
              if (attempt === maxAttempts) {
                core.setFailed(`npm install failed after ${maxAttempts} attempts`);
                return;
              }
              const retryDelayMs = attempt * 50;
              core.info(`npm install failed with exit code ${exitCode}; retrying in ${retryDelayMs}ms`);
              await new Promise(resolve => setTimeout(resolve, retryDelayMs));
            }
      -
        name: Docker meta
        id: meta
        if: ${{ inputs.output == 'image' }}
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ${{ needs.prepare.outputs.metaImages }}
          tags: ${{ inputs.meta-tags }}
          flavor: ${{ inputs.meta-flavor }}
          labels: ${{ inputs.meta-labels }}
          annotations: ${{ inputs.meta-annotations }}
          bake-target: ${{ inputs.meta-bake-target }}
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
        if: ${{ inputs.setup-qemu }}
        with:
          image: ${{ env.BINFMT_IMAGE }}
          cache-image: false
      -
        name: Set GitHub runtime outputs
        id: github-runtime
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const idTokenRequestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN || '';
            const idTokenRequestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL || '';
            if (idTokenRequestToken) {
              core.setSecret(idTokenRequestToken);
            }
            if (idTokenRequestUrl) {
              core.setSecret(idTokenRequestUrl);
            }
            core.setOutput('actions-id-token-request-token', idTokenRequestToken);
            core.setOutput('actions-id-token-request-url', idTokenRequestUrl);
      -
        name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
        with:
          version: ${{ env.BUILDX_VERSION }}
          cache-binary: false
          buildkitd-flags: --debug
          driver-opts: |
            image=${{ env.BUILDKIT_IMAGE }}
            env.ACTIONS_ID_TOKEN_REQUEST_TOKEN=${{ steps.github-runtime.outputs.actions-id-token-request-token }}
            env.ACTIONS_ID_TOKEN_REQUEST_URL=${{ steps.github-runtime.outputs.actions-id-token-request-url }}
          buildkitd-config-inline: |
            proxyNetwork = ${{ needs.prepare.outputs.proxyNetwork }}

            [cache]
              [cache.gha]
                [cache.gha.sign]
                  command = [${{ needs.prepare.outputs.ghaCacheSign == 'true' && '"ghacache-sign-script.sh"' || '' }}]
                [cache.gha.verify]
                  required = ${{ needs.prepare.outputs.ghaCacheSign }}
                  [cache.gha.verify.policy]
                    timestampThreshold = 1
                    tlogThreshold = ${{ needs.prepare.outputs.privateRepo == 'true' && '0' || '1' }}
                    subjectAlternativeName = "https://github.com/docker/github-builder/.github/workflows/bake.yml*"
                    githubWorkflowRepository = "${{ github.repository }}"
                    issuer = "https://token.actions.githubusercontent.com"
                    runnerEnvironment = "github-hosted"
                    sourceRepositoryURI = "${{ github.server_url }}/${{ github.repository }}"
      -
        name: Install Cosign
        if: ${{ needs.prepare.outputs.sign == 'true' || inputs.cache }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_COSIGN-VERSION: ${{ env.COSIGN_VERSION }}
          INPUT_BUILDER-NAME: ${{ steps.buildx.outputs.name }}
          INPUT_GHA-CACHE-SIGN-SCRIPT: |
            #!/bin/sh
            set -e
            
            # Create temporary files
            tmp_dir=$(mktemp -d)
            out_file="$tmp_dir/bundle"
            in_file="$tmp_dir/blob"
            signing_config="$tmp_dir/signing-config.json"
            trap 'rm -rf "$tmp_dir"' EXIT
            cat > "$in_file"
            
            no_default_rekor=
            if [ "${{ needs.prepare.outputs.privateRepo }}" = "true" ]; then
              no_default_rekor="--no-default-rekor=true"
            fi

            set -x
            
            # Create signing config
            COSIGN_EXPERIMENTAL=1 cosign signing-config create \
              --with-default-services=true \
              ${no_default_rekor:+$no_default_rekor} \
              --out="$signing_config"

            # Sign with cosign
            cosign sign-blob \
              --yes \
              --oidc-provider github-actions \
              --new-bundle-format \
              --signing-config "$signing_config" \
              --bundle "$out_file" \
              "$in_file"
            
            # Output bundle to stdout
            cat "$out_file"
        with:
          script: |
            const fs = require('fs');
            const os = require('os');
            const path = require('path');
            
            const { Buildx } = require('@docker/github-builder-runtime/lib/buildx/buildx');
            const { Cosign } = require('@docker/github-builder-runtime/lib/cosign/cosign');
            const { Install } = require('@docker/github-builder-runtime/lib/cosign/install');
            
            const inpCosignVersion = core.getInput('cosign-version');
            const inpBuilderName = core.getInput('builder-name');
            const inpGHACacheSignScript = core.getInput('gha-cache-sign-script');
            
            const cosignInstall = new Install();
            const cosignBinPath = await cosignInstall.download({
              version: core.getInput('cosign-version'),
              ghaNoCache: true,
              skipState: true,
              verifySignature: true
            });
            const cosignPath = await cosignInstall.install(cosignBinPath);
            
            const cosign = new Cosign();
            await cosign.printVersion();
            
            const containerName = `${Buildx.containerNamePrefix}${inpBuilderName}0`;
            
            const ghaCacheSignScriptPath = path.join(os.tmpdir(), `ghacache-sign-script.sh`);
            core.info(`Writing GitHub Actions cache sign script to ${ghaCacheSignScriptPath}`);
            await fs.writeFileSync(ghaCacheSignScriptPath, inpGHACacheSignScript, {mode: 0o700});
            
            core.info(`Copying GitHub Actions cache sign script to BuildKit container ${containerName}`);
            await exec.exec('docker', [
              'cp',
              ghaCacheSignScriptPath,
              `${containerName}:/usr/bin/ghacache-sign-script.sh`
            ]);
            
            core.info(`Copying cosign binary to BuildKit container ${containerName}`);
            await exec.exec('docker', [
              'cp',
              cosignPath,
              `${containerName}:/usr/bin/cosign`
            ]);
      -
        name: Configure AWS credentials
        if: ${{ needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          role-to-assume: ${{ needs.registry-identities.outputs.aws-ecr-role-to-assume }}
          aws-region: ${{ needs.registry-identities.outputs.aws-ecr-region }}
      -
        name: Login to Amazon ECR
        if: ${{ needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
        env:
          AWS_ACCOUNT_IDS: ${{ needs.registry-identities.outputs.aws-ecr-account-ids }}
        with:
          registry-auth: |
            - registry: ${{ needs.registry-identities.outputs.aws-ecr-registry }}
      -
        name: Authenticate to Google Cloud
        id: gcp-wif-auth
        if: ${{ needs.registry-identities.outputs.gcp-wif-enabled == 'true' }}
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
        with:
          token_format: access_token
          access_token_lifetime: ${{ format('{0}s', needs.registry-identities.outputs.gcp-wif-expires-in || '3600') }}
          workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }}
          service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }}
          project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }}
          create_credentials_file: false
          export_environment_variables: false
      -
        name: Login to Google Artifact Registry
        if: ${{ needs.registry-identities.outputs.gcp-wif-enabled == 'true' }}
        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
        with:
          registry-auth: |
            - registry: ${{ needs.registry-identities.outputs.gcp-wif-registry }}
              username: oauth2accesstoken
              password: ${{ steps.gcp-wif-auth.outputs.access_token }}
      -
        name: Login to Docker Hub with OIDC
        if: ${{ needs.registry-identities.outputs.dockerhub-oidc-enabled == 'true' }}
        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
        env:
          DOCKERHUB_OIDC_CONNECTIONID: ${{ needs.registry-identities.outputs.dockerhub-oidc-connection-id }}
          DOCKERHUB_OIDC_EXPIREIN: ${{ needs.registry-identities.outputs.dockerhub-oidc-expires-in || '3600' }}
        with:
          registry-auth: |
            - registry: ${{ needs.registry-identities.outputs.dockerhub-oidc-registry }}
              username: ${{ needs.registry-identities.outputs.dockerhub-oidc-username }}
              scope: ${{ needs.registry-identities.outputs.dockerhub-oidc-scope }}
      -
        name: Authenticate to Azure
        if: ${{ needs.registry-identities.outputs.azure-acr-enabled == 'true' }}
        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
        with:
          client-id: ${{ needs.registry-identities.outputs.azure-acr-client-id }}
          tenant-id: ${{ needs.registry-identities.outputs.azure-acr-tenant-id }}
          subscription-id: ${{ needs.registry-identities.outputs.azure-acr-subscription-id }}
      -
        name: Login to Azure Container Registry
        if: ${{ needs.registry-identities.outputs.azure-acr-enabled == 'true' }}
        env:
          ACR_REGISTRY: ${{ needs.registry-identities.outputs.azure-acr-registry }}
          AZURE_CORE_OUTPUT: none
        run: az acr login --name "${ACR_REGISTRY%.azurecr.io}"
      -
        name: Set up chainctl
        if: ${{ needs.registry-identities.outputs.chainguard-enabled == 'true' }}
        uses: chainguard-dev/setup-chainctl@2cddd35a2f120d9973e58094dc6878c93cf58c28 # v0.5.1
        with:
          identity: ${{ needs.registry-identities.outputs.chainguard-identity }}
          apk-host: ${{ needs.registry-identities.outputs.chainguard-apk-host }}
          libraries-host: ${{ needs.registry-identities.outputs.chainguard-libraries-host }}
      -
        name: Login to registry
        if: ${{ needs.prepare.outputs.registryLogin == 'true' && env.REGISTRY_AUTHS_PRESENT == 'true' }}
        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
        with:
          registry-auth: ${{ secrets.registry-auths }}
      -
        name: Prepare
        id: prepare
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_PLATFORM: ${{ matrix.platform }}
          INPUT_SBOM-IMAGE: ${{ env.SBOM_IMAGE }}
          INPUT_LOCAL-EXPORT-DIR: ${{ env.LOCAL_EXPORT_DIR }}
          INPUT_CACHE: ${{ inputs.cache }}
          INPUT_CACHE-SCOPE: ${{ inputs.cache-scope }}
          INPUT_CACHE-MODE: ${{ inputs.cache-mode }}
          INPUT_BUILD-SECRETS: ${{ secrets.build-secrets }}
          INPUT_TARGETS: ${{ needs.prepare.outputs.targets }}
          INPUT_CONTEXT: ${{ inputs.context }}
          INPUT_FILES: ${{ inputs.files }}
          INPUT_OUTPUT: ${{ inputs.output }}
          INPUT_PUSH: ${{ inputs.push }}
          INPUT_SBOM: ${{ inputs.sbom }}
          INPUT_SET: ${{ inputs.set }}
          INPUT_TARGET: ${{ inputs.target }}
          INPUT_VARS: ${{ inputs.vars }}
          INPUT_META-IMAGES: ${{ needs.prepare.outputs.metaImages }}
          INPUT_META-VERSION: ${{ steps.meta.outputs.version }}
          INPUT_META-TAGS: ${{ steps.meta.outputs.tags }}
          INPUT_SET-META-ANNOTATIONS: ${{ inputs.set-meta-annotations }}
          INPUT_SET-META-LABELS: ${{ inputs.set-meta-labels }}
          INPUT_BAKE-FILE-TAGS: ${{ steps.meta.outputs.bake-file-tags }}
          INPUT_BAKE-FILE-ANNOTATIONS: ${{ steps.meta.outputs.bake-file-annotations }}
          INPUT_BAKE-FILE-LABELS: ${{ steps.meta.outputs.bake-file-labels }}
          INPUT_BUILDKIT-PROXY-NETWORK: ${{ inputs.buildkit-proxy-network }}
        with:
          script: |
            const os = require('os');
            const { Build } = require('@docker/github-builder-runtime/lib/buildx/build');
            const { BuildSecrets } = require('@docker/github-builder-runtime/lib/github-builder/build-secrets');
            const { BakeVars } = require('@docker/github-builder-runtime/lib/github-builder/bake-vars');
            const { GitHub } = require('@docker/github-builder-runtime/lib/github/github');
            const { Util } = require('@docker/github-builder-runtime/lib/util');

            const inpPlatform = core.getInput('platform');
            const platformPairSuffix = inpPlatform ? `-${inpPlatform.replace(/\//g, '-')}` : '';
            core.setOutput('platform-pair-suffix', platformPairSuffix);
            
            const inpSbomImage = core.getInput('sbom-image');
            const inpLocalExportDir = core.getInput('local-export-dir');
            
            const inpCache = core.getBooleanInput('cache');
            const inpCacheScope = core.getInput('cache-scope');
            const inpCacheMode = core.getInput('cache-mode');
            const inpBuildSecrets = core.getInput('build-secrets', {trimWhitespace: false});
            const inpTargets = core.getInput('targets');
            const inpContext = core.getInput('context');
            const inpFiles = Util.getInputList('files');
            const inpOutput = core.getInput('output');
            const inpPush = core.getBooleanInput('push');
            const inpSbom = core.getBooleanInput('sbom');
            const inpSet = Util.getInputList('set', {ignoreComma: true, quote: false});
            const inpTarget = core.getInput('target');
            const inpVars = Util.getInputList('vars', {ignoreComma: true, quote: false});
            const inpBuildkitProxyNetwork = core.getBooleanInput('buildkit-proxy-network');

            const inpMetaImages = core.getMultilineInput('meta-images');
            const inpMetaVersion = core.getInput('meta-version');
            const inpMetaTags = core.getMultilineInput('meta-tags');
            const inpSetMetaAnnotations = core.getBooleanInput('set-meta-annotations');
            const inpSetMetaLabels = core.getBooleanInput('set-meta-labels');
            const inpBakeFileTags = core.getInput('bake-file-tags');
            const inpBakeFileAnnotations = core.getInput('bake-file-annotations');
            const inpBakeFileLabels = core.getInput('bake-file-labels');

            const meta = {
              version: inpMetaVersion,
              tags: inpMetaTags
            };
            const renderTemplate = value => Util.compileHandlebars(value, {noEscape: true}, {meta});

            const gitContextAttrs = GitHub.context.ref.startsWith('refs/tags/') ? {checksum: GitHub.context.sha} : {'fetch-by-commit': 'true'};
            const bakeSource = await new Build().gitContext({subdir: inpContext, attrs: gitContextAttrs});
            await core.group(`Set source output`, async () => {
              core.info(bakeSource);
              core.setOutput('source', bakeSource);
            });
            
            await core.group(`Set target output`, async () => {
              core.info(inpTarget);
              core.setOutput('target', inpTarget);
            });
            
            const sbom = inpSbom ? `generator=${inpSbomImage}` : 'false';
            await core.group(`Set sbom`, async () => {
              core.info(sbom);
              core.setOutput('sbom', sbom);
            });

            let buildSecrets;
            try {
              buildSecrets = BuildSecrets.prepareBake(inpBuildSecrets, inpTarget, JSON.parse(inpTargets || '[]'));
            } catch (err) {
              core.setFailed(err.message);
              return;
            }
            core.setOutput('secret-dir', buildSecrets.directory);

            const bakeVars = BakeVars.resolve(inpVars);
            await core.group(`Set bake vars`, async () => {
              core.info(JSON.stringify(bakeVars.map(value => {
                const idx = value.indexOf('=');
                return idx === -1 ? '<invalid>' : value.substring(0, idx);
              }).sort(), null, 2));
              core.setOutput('vars', JSON.stringify(bakeVars));
            });

            let bakeFiles = inpFiles;
            await core.group(`Set bake files`, async () => {
              if (bakeFiles.length === 0) {
                bakeFiles = ['docker-bake.hcl'];
              }
              if (inpBakeFileTags) {
                bakeFiles.push(`cwd://${inpBakeFileTags}`);
              }
              if (inpSetMetaAnnotations && inpBakeFileAnnotations) {
                bakeFiles.push(`cwd://${inpBakeFileAnnotations}`);
              }
              if (inpSetMetaLabels && inpBakeFileLabels) {
                bakeFiles.push(`cwd://${inpBakeFileLabels}`);
              }
              core.info(JSON.stringify(bakeFiles, null, 2));
              core.setOutput('files', bakeFiles.join(os.EOL));
            });
            
            let outputOverride = '';
            switch (inpOutput) {
              case 'image':
                if (inpMetaImages.length == 0) {
                  core.setFailed('meta-images is required when output is image');
                  return;
                }
                outputOverride = `*.output=type=image,"name=${inpMetaImages.join(',')}",oci-artifact=true,push-by-digest=true,name-canonical=true,push=${inpPush}`;
                break;
              case 'local':
                outputOverride = `*.output=type=local,platform-split=true,dest=${inpLocalExportDir}`;
                break;
              default:
                core.setFailed(`Invalid output: ${inpOutput}`);
                return;
            }
            
            let bakeOverrides = [];
            try {
              bakeOverrides = inpSet.map(override => renderTemplate(override));
            } catch (err) {
              core.setFailed(`Failed to render Handlebars template: ${err.message}`);
              return;
            }
            await core.group(`Set bake overrides`, async () => {
              bakeOverrides.push(outputOverride);
              bakeOverrides.push('*.tags=');
              if (GitHub.context.payload.repository?.private ?? false) {
                // if this is a private repository, we set min provenance mode
                bakeOverrides.push(`*.attest=type=provenance,${Build.resolveProvenanceAttrs('mode=min,version=v1')}`);
              } else {
                // for a public repository, we set max provenance mode
                bakeOverrides.push(`*.attest=type=provenance,${Build.resolveProvenanceAttrs('mode=max,version=v1')}`);
              }
              if (inpPlatform) {
                bakeOverrides.push(`*.platform=${inpPlatform}`);
              }
              if (inpCache) {
                const proxyNetworkSuffix = inpBuildkitProxyNetwork ? '-proxy-network' : '';
                bakeOverrides.push(`*.cache-from=type=gha,scope=${inpCacheScope || inpTarget}${platformPairSuffix}${proxyNetworkSuffix}`);
                bakeOverrides.push(`*.cache-to=type=gha,ignore-error=true,scope=${inpCacheScope || inpTarget}${platformPairSuffix}${proxyNetworkSuffix},mode=${inpCacheMode}`);
              }
              bakeOverrides.push(...buildSecrets.inputs);
              core.info(JSON.stringify(bakeOverrides, null, 2));
              core.setOutput('overrides', bakeOverrides.join(os.EOL));
            });
      -
        name: Build
        id: bake
        uses: docker/bake-action@59cb1203cd42bcefd40a1b6d73b589e48c86040e # v7.5.0
        with:
          source: ${{ steps.prepare.outputs.source }}
          files: ${{ steps.prepare.outputs.files }}
          targets: ${{ steps.prepare.outputs.target }}
          sbom: ${{ steps.prepare.outputs.sbom }}
          set: ${{ steps.prepare.outputs.overrides }}
          vars: ${{ steps.prepare.outputs.vars }}
          github-token: ${{ secrets.github-token || github.token }}
        env:
          BUILDKIT_MULTI_PLATFORM: '1'
          BUILDX_BAKE_DISABLE_VARS_ENV_LOOKUP: '1'
      -
        name: Remove build secrets
        if: ${{ always() && steps.prepare.outputs.secret-dir != '' }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_SECRET-DIR: ${{ steps.prepare.outputs.secret-dir }}
        with:
          script: |
            const { BuildSecrets } = require('@docker/github-builder-runtime/lib/github-builder/build-secrets');
            BuildSecrets.cleanup(core.getInput('secret-dir', {required: true}));
      -
        name: Get image digest
        id: get-image-digest
        if: ${{ inputs.output == 'image' }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_TARGET: ${{ steps.prepare.outputs.target }}
          INPUT_METADATA: ${{ steps.bake.outputs.metadata }}
        with:
          script: |
            const inpTarget = core.getInput('target');
            const inpMetadata = JSON.parse(core.getInput('metadata'));
            const imageDigest = inpMetadata[inpTarget]['containerimage.digest'];
            core.info(imageDigest);
            core.setOutput('digest', imageDigest);
      -
        name: Authenticate to Google Cloud for signing
        id: gcp-wif-auth-signing
        if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' && needs.registry-identities.outputs.gcp-wif-enabled == 'true' }}
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
        with:
          token_format: access_token
          access_token_lifetime: ${{ format('{0}s', needs.registry-identities.outputs.gcp-wif-expires-in || '3600') }}
          workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }}
          service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }}
          project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }}
          create_credentials_file: false
          export_environment_variables: false
      -
        name: Login to Google Artifact Registry for signing
        if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' && needs.registry-identities.outputs.gcp-wif-enabled == 'true' }}
        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
        with:
          registry-auth: |
            - registry: ${{ needs.registry-identities.outputs.gcp-wif-registry }}
              username: oauth2accesstoken
              password: ${{ steps.gcp-wif-auth-signing.outputs.access_token }}
      -
        name: Login to Docker Hub with OIDC for signing
        if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' && needs.registry-identities.outputs.dockerhub-oidc-enabled == 'true' }}
        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
        env:
          DOCKERHUB_OIDC_CONNECTIONID: ${{ needs.registry-identities.outputs.dockerhub-oidc-connection-id }}
          DOCKERHUB_OIDC_EXPIREIN: ${{ needs.registry-identities.outputs.dockerhub-oidc-expires-in || '3600' }}
          DOCKER_LOGIN_SCOPE_DISABLED: true # make signing credentials available outside Buildx scoped configuration
        with:
          registry-auth: |
            - registry: ${{ needs.registry-identities.outputs.dockerhub-oidc-registry }}
              username: ${{ needs.registry-identities.outputs.dockerhub-oidc-username }}
      -
        name: Authenticate to Azure for signing
        if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' && needs.registry-identities.outputs.azure-acr-enabled == 'true' }}
        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
        with:
          client-id: ${{ needs.registry-identities.outputs.azure-acr-client-id }}
          tenant-id: ${{ needs.registry-identities.outputs.azure-acr-tenant-id }}
          subscription-id: ${{ needs.registry-identities.outputs.azure-acr-subscription-id }}
      -
        name: Login to Azure Container Registry for signing
        if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' && needs.registry-identities.outputs.azure-acr-enabled == 'true' }}
        env:
          ACR_REGISTRY: ${{ needs.registry-identities.outputs.azure-acr-registry }}
          AZURE_CORE_OUTPUT: none
        run: az acr login --name "${ACR_REGISTRY%.azurecr.io}"
      -
        name: Login to registry for signing
        if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' && env.REGISTRY_AUTHS_PRESENT == 'true' }}
        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
        with:
          registry-auth: ${{ secrets.registry-auths }}
        env:
          DOCKER_LOGIN_SCOPE_DISABLED: true # make sure the scope feature is disabled to avoid interfering with cosign OIDC login
      -
        name: Signing attestation manifests
        id: signing-attestation-manifests
        if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_IMAGE-NAMES: ${{ needs.prepare.outputs.metaImages }}
          INPUT_IMAGE-DIGEST: ${{ steps.get-image-digest.outputs.digest }}
        with:
          script: |
            const { Sigstore } = require('@docker/github-builder-runtime/lib/sigstore/sigstore');
            
            const inpImageNames = core.getMultilineInput('image-names');
            const inpImageDigest = core.getInput('image-digest');
            
            const sigstore = new Sigstore();
            const signResults = await sigstore.signAttestationManifests({
              imageNames: inpImageNames,
              imageDigest: inpImageDigest,
              retryOnManifestUnknown: true
            });
            
            const verifyResults = await sigstore.verifySignedManifests(signResults, {
              certificateIdentityRegexp: `^https://github.com/docker/github-builder/.github/workflows/bake.yml.*$`,
              retryOnManifestUnknown: true
            });
            
            await core.group(`Verify commands`, async () => {
              const verifyCommands = [];
              for (const [attestationRef, verifyResult] of Object.entries(verifyResults)) {
                const cmd = `cosign ${verifyResult.cosignArgs.join(' ')} ${attestationRef}`;
                core.info(cmd);
                verifyCommands.push(cmd);
              }
              core.setOutput('verify-commands', verifyCommands.join('\n'));
            });
      -
        name: Signing local artifacts
        id: signing-local-artifacts
        if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'local' }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_LOCAL-OUTPUT-DIR: ${{ env.LOCAL_EXPORT_DIR }}
        with:
          script: |
            const path = require('path');
            const { Sigstore } = require('@docker/github-builder-runtime/lib/sigstore/sigstore');
            const inplocalExportDir = core.getInput('local-output-dir');
            
            const sigstore = new Sigstore();
            const signResults = await sigstore.signProvenanceBlobs({
              localExportDir: inplocalExportDir
            });
            
            const verifyResults = await sigstore.verifySignedArtifacts(signResults, {
              certificateIdentityRegexp: `^https://github.com/docker/github-builder/.github/workflows/bake.yml.*$`
            });
            
            await core.group(`Verify commands`, async () => {
              const verifyCommands = [];
              for (const [artifactPath, verifyResult] of Object.entries(verifyResults)) {
                const cmd = `cosign ${verifyResult.cosignArgs.join(' ')} --bundle ${path.relative(inplocalExportDir, verifyResult.bundlePath)} ${path.relative(inplocalExportDir, artifactPath)}`;
                core.info(cmd);
                verifyCommands.push(cmd);
              }
              core.setOutput('verify-commands', verifyCommands.join('\n'));
            });
      -
        name: List local output
        if: ${{ inputs.output == 'local' }}
        run: |
          tree -nh ${{ env.LOCAL_EXPORT_DIR }}
      -
        name: Upload artifact
        if: ${{ inputs.output == 'local' && inputs.artifact-upload }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ inputs.artifact-name }}${{ steps.prepare.outputs.platform-pair-suffix || '0' }}
          path: ${{ env.LOCAL_EXPORT_DIR }}
          if-no-files-found: error
          retention-days: ${{ inputs.artifact-retention-days }}
      -
        name: Set result output
        id: result
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_INDEX: ${{ matrix.index }}
          INPUT_VERIFY-COMMANDS: ${{ steps.signing-attestation-manifests.outputs.verify-commands || steps.signing-local-artifacts.outputs.verify-commands }}
          INPUT_IMAGE-DIGEST: ${{ steps.get-image-digest.outputs.digest }}
          INPUT_ARTIFACT-NAME: ${{ inputs.artifact-name }}${{ steps.prepare.outputs.platform-pair-suffix }}
          INPUT_ARTIFACT-UPLOAD: ${{ inputs.artifact-upload }}
          INPUT_SIGNED: ${{ needs.prepare.outputs.sign }}
        with:
          script: |
            const inpIndex = core.getInput('index');
            const inpVerifyCommands = core.getInput('verify-commands');
            const inpImageDigest = core.getInput('image-digest');
            const inpArtifactName = core.getInput('artifact-name');
            const inpArtifactUpload = core.getBooleanInput('artifact-upload');
            const inpSigned = core.getBooleanInput('signed');
            
            const result = {
              verifyCommands: inpVerifyCommands,
              imageDigest: inpImageDigest,
              artifactName: inpArtifactUpload ? inpArtifactName : '',
              signed: inpSigned
            }
            core.info(JSON.stringify(result, null, 2));
            
            core.setOutput(`result_${inpIndex}`, JSON.stringify(result));

  finalize:
    runs-on: ubuntu-26.04
    strategy:
      matrix:
        include:
          - name: ${{ inputs.job-name-prefix }}
    outputs:
      meta-json: ${{ steps.meta.outputs.json }}
      cosign-version: ${{ env.COSIGN_VERSION }}
      cosign-verify-commands: ${{ steps.set.outputs.cosign-verify-commands }}
      artifact-name: ${{ inputs.artifact-upload && inputs.artifact-name || '' }}
      digest: ${{ steps.manifest.outputs.digest || steps.artifact.outputs.artifact-digest }}
      output-type: ${{ inputs.output }}
      signed: ${{ needs.prepare.outputs.sign }}
    needs:
      - registry-identities
      - prepare
      - build
    env:
      REGISTRY_AUTHS_PRESENT: ${{ secrets.registry-auths != '' }}
    steps:
      -
        name: Install dependencies
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_RUNTIME-MODULE: ${{ env.RUNTIME_MODULE }}
          INPUT_RUNTIME-INSTALL-ARGS: ${{ env.RUNTIME_INSTALL_ARGS }}
        with:
          script: |
            const npmArgs = ['install', ...core.getMultilineInput('runtime-install-args'), core.getInput('runtime-module')];
            const maxAttempts = 3;
            for (let attempt = 1; attempt <= maxAttempts; attempt++) {
              const exitCode = await exec.exec('npm', npmArgs, {ignoreReturnCode: true});
              if (exitCode === 0) {
                return;
              }
              if (attempt === maxAttempts) {
                core.setFailed(`npm install failed after ${maxAttempts} attempts`);
                return;
              }
              const retryDelayMs = attempt * 50;
              core.info(`npm install failed with exit code ${exitCode}; retrying in ${retryDelayMs}ms`);
              await new Promise(resolve => setTimeout(resolve, retryDelayMs));
            }
      -
        name: Docker meta
        id: meta
        if: ${{ inputs.output == 'image' }}
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ${{ needs.prepare.outputs.metaImages }}
          tags: ${{ inputs.meta-tags }}
          flavor: ${{ inputs.meta-flavor }}
          labels: ${{ inputs.meta-labels }}
          annotations: ${{ inputs.meta-annotations }}
          bake-target: ${{ inputs.meta-bake-target }}
      -
        name: Configure AWS credentials
        if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          role-to-assume: ${{ needs.registry-identities.outputs.aws-ecr-role-to-assume }}
          aws-region: ${{ needs.registry-identities.outputs.aws-ecr-region }}
      -
        name: Login to Amazon ECR
        if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
        env:
          AWS_ACCOUNT_IDS: ${{ needs.registry-identities.outputs.aws-ecr-account-ids }}
        with:
          registry-auth: |
            - registry: ${{ needs.registry-identities.outputs.aws-ecr-registry }}
      -
        name: Authenticate to Google Cloud
        id: gcp-wif-auth
        if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.gcp-wif-enabled == 'true' }}
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
        with:
          token_format: access_token
          access_token_lifetime: ${{ format('{0}s', needs.registry-identities.outputs.gcp-wif-expires-in || '3600') }}
          workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }}
          service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }}
          project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }}
          create_credentials_file: false
          export_environment_variables: false
      -
        name: Login to Google Artifact Registry
        if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.gcp-wif-enabled == 'true' }}
        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
        with:
          registry-auth: |
            - registry: ${{ needs.registry-identities.outputs.gcp-wif-registry }}
              username: oauth2accesstoken
              password: ${{ steps.gcp-wif-auth.outputs.access_token }}
      -
        name: Login to Docker Hub with OIDC
        if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.dockerhub-oidc-enabled == 'true' }}
        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
        env:
          DOCKERHUB_OIDC_CONNECTIONID: ${{ needs.registry-identities.outputs.dockerhub-oidc-connection-id }}
          DOCKERHUB_OIDC_EXPIREIN: ${{ needs.registry-identities.outputs.dockerhub-oidc-expires-in || '3600' }}
        with:
          registry-auth: |
            - registry: ${{ needs.registry-identities.outputs.dockerhub-oidc-registry }}
              username: ${{ needs.registry-identities.outputs.dockerhub-oidc-username }}
              scope: ${{ needs.registry-identities.outputs.dockerhub-oidc-scope }}
      -
        name: Authenticate to Azure
        if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.azure-acr-enabled == 'true' }}
        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
        with:
          client-id: ${{ needs.registry-identities.outputs.azure-acr-client-id }}
          tenant-id: ${{ needs.registry-identities.outputs.azure-acr-tenant-id }}
          subscription-id: ${{ needs.registry-identities.outputs.azure-acr-subscription-id }}
      -
        name: Login to Azure Container Registry
        if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.azure-acr-enabled == 'true' }}
        env:
          ACR_REGISTRY: ${{ needs.registry-identities.outputs.azure-acr-registry }}
          AZURE_CORE_OUTPUT: none
        run: az acr login --name "${ACR_REGISTRY%.azurecr.io}"
      -
        name: Set up chainctl
        if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.chainguard-enabled == 'true' }}
        uses: chainguard-dev/setup-chainctl@2cddd35a2f120d9973e58094dc6878c93cf58c28 # v0.5.1
        with:
          identity: ${{ needs.registry-identities.outputs.chainguard-identity }}
          apk-host: ${{ needs.registry-identities.outputs.chainguard-apk-host }}
          libraries-host: ${{ needs.registry-identities.outputs.chainguard-libraries-host }}
      -
        name: Login to registry
        if: ${{ inputs.push && inputs.output == 'image' && env.REGISTRY_AUTHS_PRESENT == 'true' }}
        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
        with:
          registry-auth: ${{ secrets.registry-auths }}
        env:
          DOCKER_LOGIN_SCOPE_DISABLED: true # FIXME: scope feature is not yet supported by Buildx imagetools command
      -
        name: Set up Docker Buildx
        if: ${{ inputs.push && inputs.output == 'image' }}
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
        with:
          version: ${{ env.BUILDX_VERSION }}
          buildkitd-flags: --debug
          driver-opts: image=${{ env.BUILDKIT_IMAGE }}
          cache-binary: false
      -
        name: Create manifest
        id: manifest
        if: ${{ inputs.output == 'image' }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_PUSH: ${{ inputs.push }}
          INPUT_IMAGE-NAMES: ${{ needs.prepare.outputs.metaImages }}
          INPUT_TAG-NAMES: ${{ steps.meta.outputs.tag-names }}
          INPUT_BUILD-OUTPUTS: ${{ toJSON(needs.build.outputs) }}
          INPUT_SET-META-ANNOTATIONS: ${{ inputs.set-meta-annotations }}
          INPUT_META-ANNOTATIONS: ${{ steps.meta.outputs.annotations }}
        with:
          script: |
            const { ImageTools } = require('@docker/github-builder-runtime/lib/buildx/imagetools');
            
            const inpPush = core.getBooleanInput('push');
            const inpImageNames = core.getMultilineInput('image-names');
            const inpTagNames = core.getMultilineInput('tag-names');
            const inpBuildOutputs = JSON.parse(core.getInput('build-outputs'));
            const inpSetMetaAnnotations = core.getBooleanInput('set-meta-annotations');
            const inpMetaAnnotations = core.getMultilineInput('meta-annotations');
            
            const indexAnnotations = [];
            if (inpSetMetaAnnotations && inpMetaAnnotations.length > 0) {
              indexAnnotations.push(...inpMetaAnnotations.filter(annotation => annotation.length > 0).map(ImageTools.toIndexAnnotation));
            }
            
            const digests = [];
            for (const key of Object.keys(inpBuildOutputs)) {
              const output = JSON.parse(inpBuildOutputs[key]);
              if (output.imageDigest) {
                digests.push(output.imageDigest);
              }
            }
            if (digests.length === 0) {
              core.setFailed('No image digests found from build outputs');
              return;
            }
            
            let digest;
            for (const imageName of inpImageNames) {
              const tags = [];
              for (const tag of inpTagNames) {
                tags.push(`${imageName}:${tag}`);
              }
              const result = await new ImageTools().create({
                sources: digests,
                tags: tags,
                annotations: indexAnnotations,
                skipExec: !inpPush
              });
              if (inpPush) {
                if (!result.digest) {
                  core.setFailed('Failed to create manifest, no digest returned');
                  return;
                }
                digest = result.digest;
                core.info(`Manifest created: ${imageName}@${result.digest}`);
              }
            }
            if (digest) {
              core.setOutput('digest', digest);
            }
      -
        name: Merge artifacts
        id: artifact
        if: ${{ inputs.output == 'local' && inputs.artifact-upload }}
        uses: actions/upload-artifact/merge@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ inputs.artifact-name }}
          pattern: ${{ inputs.artifact-name }}*
          delete-merged: true
          retention-days: ${{ inputs.artifact-retention-days }}
      -
        name: Set outputs
        id: set
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INPUT_BUILD-OUTPUTS: ${{ toJSON(needs.build.outputs) }}
          INPUT_SIGNED: ${{ needs.prepare.outputs.sign }}
        with:
          script: |
            const inpBuildOutputs = JSON.parse(core.getInput('build-outputs'));
            const inpSigned = core.getBooleanInput('signed');
            
            if (inpSigned) {
              const verifyCommands = [];
              for (const key of Object.keys(inpBuildOutputs)) {
                const output = JSON.parse(inpBuildOutputs[key]);
                if (output.verifyCommands) {
                  verifyCommands.push(output.verifyCommands);
                }
              }
              core.setOutput('cosign-verify-commands', verifyCommands.join('\n'));
            }