chore(deps): Bump brace-expansion from 1.1.11 to 1.1.12

Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.11 to 1.1.12. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/1.1.11...v1.1.12) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.12 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Merge pull request #1391 from docker/dependabot/npm_and_yarn/form-data-2.5.5
2025-08-06 15:14:37 +00:00 · 2025-08-05 15:17:00 +02:00 · 2025-07-21 23:10:01 +00:00 · 2025-05-27 18:32:33 +02:00 · 2025-05-27 18:24:03 +02:00 · 2025-05-27 18:23:18 +02:00
23 changed files with 1280 additions and 416 deletions
--- a/.github/build-push-summary.png
+++ b/.github/build-push-summary.png
--- a/.github/workflows/.e2e-run.yml
+++ b/.github/workflows/.e2e-run.yml
@@ -38,6 +38,9 @@ jobs:
      fail-fast: false
      matrix:
        include:
          -
            buildx_version: edge
            buildkit_image: moby/buildkit:latest
          -
            buildx_version: latest
            buildkit_image: moby/buildkit:buildx-stable-1
@@ -65,10 +68,11 @@ jobs:
        if: inputs.type == 'local'
        run: |
          if [ ! -e /etc/docker/daemon.json ]; then
-            echo '{}' | tee /etc/docker/daemon.json >/dev/null
+            echo '{}' | sudo tee /etc/docker/daemon.json >/dev/null
          fi
          DOCKERD_CONFIG=$(jq '.+{"insecure-registries":["http://${{ env.REGISTRY_FQDN }}"]}' /etc/docker/daemon.json)
          sudo tee /etc/docker/daemon.json <<<"$DOCKERD_CONFIG" >/dev/null
          cat /etc/docker/daemon.json
          sudo service docker restart
      -
        name: Install ${{ inputs.name }}
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,8 +24,8 @@ on:
  pull_request:
 env:
-  BUILDX_VERSION: latest
+  BUILDX_VERSION: edge
-  BUILDKIT_IMAGE: moby/buildkit:buildx-stable-1
+  BUILDKIT_IMAGE: moby/buildkit:latest
 jobs:
  minimal:
@@ -288,7 +288,6 @@ jobs:
      -
        name: Check
        run: |
          echo "${{ toJson(steps.docker_build) }}"
          if [ "${{ steps.docker_build.outcome }}" != "failure" ] || [ "${{ steps.docker_build.conclusion }}" != "success" ]; then
            echo "::error::Should have failed"
            exit 1
@@ -324,7 +323,6 @@ jobs:
      -
        name: Check
        run: |
          echo "${{ toJson(steps.docker_build) }}"
          if [ "${{ steps.docker_build.outcome }}" != "failure" ] || [ "${{ steps.docker_build.conclusion }}" != "success" ]; then
            echo "::error::Should have failed"
            exit 1
@@ -567,6 +565,8 @@ jobs:
      fail-fast: false
      matrix:
        include:
          - buildx: edge
            buildkit: moby/buildkit:latest
          - buildx: latest
            buildkit: moby/buildkit:buildx-stable-1
          - buildx: latest
@@ -1344,3 +1344,253 @@ jobs:
        name: Check docker
        run: |
          docker image inspect localhost:5000/name/app:latest
  summary-disable:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
        with:
          path: action
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
          driver-opts: |
            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
      -
        name: Build
        uses: ./action
        with:
          file: ./test/Dockerfile
        env:
          DOCKER_BUILD_SUMMARY: false
  summary-disable-deprecated:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
        with:
          path: action
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
          driver-opts: |
            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
      -
        name: Build
        uses: ./action
        with:
          file: ./test/Dockerfile
        env:
          DOCKER_BUILD_NO_SUMMARY: true
  summary-not-supported:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
        with:
          path: action
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: v0.12.1
          driver-opts: |
            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
      -
        name: Build
        uses: ./action
        with:
          file: ./test/Dockerfile
  record-upload-disable:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
        with:
          path: action
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
          driver-opts: |
            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
      -
        name: Build
        uses: ./action
        with:
          file: ./test/Dockerfile
        env:
          DOCKER_BUILD_RECORD_UPLOAD: false
  record-retention-days:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        days:
          - 2
          - 0
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
        with:
          path: action
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
          driver-opts: |
            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
      -
        name: Build
        uses: ./action
        with:
          file: ./test/Dockerfile
        env:
          DOCKER_BUILD_RECORD_RETENTION_DAYS: ${{ matrix.days }}
  export-legacy:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        legacy:
          - false
          - true
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
        with:
          path: action
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
          driver-opts: |
            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
      -
        name: Build
        uses: ./action
        with:
          file: ./test/Dockerfile
        env:
          DOCKER_BUILD_EXPORT_LEGACY: ${{ matrix.legacy }}
  checks:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        buildx-version:
          - edge
          - latest
          - v0.14.1
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: ${{ matrix.buildx-version }}
          driver-opts: |
            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
      -
        name: Build
        uses: ./
        with:
          context: ./test
          file: ./test/lint.Dockerfile
  annotations-disabled:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
          driver-opts: |
            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
      -
        name: Build
        uses: ./
        with:
          context: ./test
          file: ./test/lint.Dockerfile
        env:
          DOCKER_BUILD_CHECKS_ANNOTATIONS: false
  call-check:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
          driver-opts: |
            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
      -
        name: Build
        id: docker_build
        continue-on-error: true
        uses: ./
        with:
          context: ./test
          file: ./test/lint.Dockerfile
          call: check
      -
        name: Check
        run: |
          if [ "${{ steps.docker_build.outcome }}" != "failure" ] || [ "${{ steps.docker_build.conclusion }}" != "success" ]; then
            echo "::error::Should have failed"
            exit 1
          fi
  no-default-attestations:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
        with:
          path: action
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
          driver-opts: |
            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
      -
        name: Build
        uses: ./action
        with:
          file: ./test/Dockerfile
        env:
          BUILDX_NO_DEFAULT_ATTESTATIONS: 1
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -67,13 +67,6 @@ jobs:
            username_secret: GAR_USERNAME
            password_secret: GAR_JSON_KEY
            type: remote
          -
            name: Google Container Registry
            registry: gcr.io
            slug: gcr.io/sandbox-298914/test-docker-action
            username_secret: GCR_USERNAME
            password_secret: GCR_JSON_KEY
            type: remote
          -
            name: Azure Container Registry
            registry: officialgithubactions.azurecr.io
--- a/.github/workflows/pr-assign-author.yml
+++ b/.github/workflows/pr-assign-author.yml
@@ -0,0 +1,17 @@
 name: pr-assign-author
 permissions:
  contents: read
 on:
  pull_request_target:
    types:
      - opened
      - reopened
 jobs:
  run:
    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@1b673f36fad86812f538c1df9794904038a23cbf
    permissions:
      contents: read
      pull-requests: write
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,21 @@
 name: publish
 on:
  release:
    types:
      - published
 jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      packages: write
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Publish
        uses: actions/publish-immutable-action@v0.0.4
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -20,12 +20,13 @@ jobs:
        uses: actions/checkout@v4
      -
        name: Test
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@v6
        with:
          source: .
          targets: test
      -
        name: Upload coverage
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
        with:
-          file: ./coverage/clover.xml
+          files: ./coverage/clover.xml
          token: ${{ secrets.CODECOV_TOKEN }}
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -15,16 +15,17 @@ jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
-      targets: ${{ steps.targets.outputs.matrix }}
+      targets: ${{ steps.generate.outputs.targets }}
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
-        name: Targets matrix
+        name: List targets
-        id: targets
+        id: generate
-        run: |
+        uses: docker/bake-action/subaction/list-targets@v6
-          echo "matrix=$(docker buildx bake validate --print | jq -cr '.group.validate.targets')" >> $GITHUB_OUTPUT
+        with:
          target: validate
  validate:
    runs-on: ubuntu-latest
@@ -35,11 +36,8 @@ jobs:
      matrix:
        target: ${{ fromJson(needs.prepare.outputs.targets) }}
    steps:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Validate
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@v6
        with:
          targets: ${{ matrix.target }}
--- a/README.md
+++ b/README.md
@@ -19,24 +19,11 @@ ___
  * [Git context](#git-context)
  * [Path context](#path-context)
 * [Examples](#examples)
-  * [Multi-platform image](https://docs.docker.com/build/ci/github-actions/multi-platform/)
+* [Summaries](#summaries)
  * [Secrets](https://docs.docker.com/build/ci/github-actions/secrets/)
  * [Push to multi-registries](https://docs.docker.com/build/ci/github-actions/push-multi-registries/)
  * [Manage tags and labels](https://docs.docker.com/build/ci/github-actions/manage-tags-labels/)
  * [Cache management](https://docs.docker.com/build/ci/github-actions/cache/)
  * [Export to Docker](https://docs.docker.com/build/ci/github-actions/export-docker/)
  * [Test before push](https://docs.docker.com/build/ci/github-actions/test-before-push/)
  * [Local registry](https://docs.docker.com/build/ci/github-actions/local-registry/)
  * [Share built image between jobs](https://docs.docker.com/build/ci/github-actions/share-image-jobs/)
  * [Named contexts](https://docs.docker.com/build/ci/github-actions/named-contexts/)
  * [Copy image between registries](https://docs.docker.com/build/ci/github-actions/copy-image-registries/)
  * [Update Docker Hub repo description](https://docs.docker.com/build/ci/github-actions/update-dockerhub-desc/)
  * [SBOM and provenance attestations](https://docs.docker.com/build/ci/github-actions/attestations/)
  * [Annotations](https://docs.docker.com/build/ci/github-actions/annotations/)
  * [Reproducible builds](https://docs.docker.com/build/ci/github-actions/reproducible-builds/)
 * [Customizing](#customizing)
  * [inputs](#inputs)
  * [outputs](#outputs)
  * [environment variables](#environment-variables)
 * [Troubleshooting](#troubleshooting)
 * [Contributing](#contributing)
@@ -68,28 +55,26 @@ name: ci
 on:
  push:
    branches:
      - 'main'
 jobs:
  docker:
    runs-on: ubuntu-latest
    steps:
      -
        name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      -
        name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      -
        name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
        with:
          push: true
          tags: user/app:latest
@@ -107,14 +92,9 @@ expression `{{defaultContext}}`. Here we can use it to provide a subdirectory
 to the default Git context:
 ```yaml
      -
        # Setting up Docker Buildx with docker-container driver is required
        # at the moment to be able to use a subdirectory with Git context
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      -
        name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
        with:
          context: "{{defaultContext}}:mysubdir"
          push: true
@@ -129,7 +109,7 @@ named `GIT_AUTH_TOKEN` to be able to authenticate against it with Buildx:
 ```yaml
      -
        name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
        with:
          push: true
          tags: user/app:latest
@@ -144,8 +124,6 @@ name: ci
 on:
  push:
    branches:
      - 'main'
 jobs:
  docker:
@@ -154,21 +132,21 @@ jobs:
      -
        name: Checkout
        uses: actions/checkout@v4
      -
        name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      -
        name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      -
        name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
@@ -184,6 +162,7 @@ jobs:
 * [Cache management](https://docs.docker.com/build/ci/github-actions/cache/)
 * [Export to Docker](https://docs.docker.com/build/ci/github-actions/export-docker/)
 * [Test before push](https://docs.docker.com/build/ci/github-actions/test-before-push/)
 * [Validating build configuration](https://docs.docker.com/build/ci/github-actions/checks/)
 * [Local registry](https://docs.docker.com/build/ci/github-actions/local-registry/)
 * [Share built image between jobs](https://docs.docker.com/build/ci/github-actions/share-image-jobs/)
 * [Named contexts](https://docs.docker.com/build/ci/github-actions/named-contexts/)
@@ -193,11 +172,44 @@ jobs:
 * [Annotations](https://docs.docker.com/build/ci/github-actions/annotations/)
 * [Reproducible builds](https://docs.docker.com/build/ci/github-actions/reproducible-builds/)
 ## Summaries
 This action generates a [job summary](https://github.blog/2022-05-09-supercharging-github-actions-with-job-summaries/)
 that provides a detailed overview of the build execution. The summary shows an
 overview of all the steps executed during the build, including the build inputs
 and eventual errors.
 ![build-push-action job summary](./.github/build-push-summary.png)
 The summary also includes a link for downloading the build record with
 additional details about the build, including build stats, logs, outputs, and
 more. The build record can be imported to Docker Desktop for inspecting the
 build in greater detail.
 > [!WARNING]
 >
 > If you're using the [`actions/download-artifact`](https://github.com/actions/download-artifact)
 > action in your workflow, you need to ignore the build record artifacts
 > if `name` and `pattern` inputs are not specified ([defaults to download all artifacts](https://github.com/actions/download-artifact?tab=readme-ov-file#download-all-artifacts) of the workflow),
 > otherwise the action will fail:
 > ```yaml
 > - uses: actions/download-artifact@v4
 >   with:
 >     pattern: "!*.dockerbuild"
 > ```
 > More info: https://github.com/actions/toolkit/pull/1874
 Summaries are enabled by default, but can be disabled with the
 `DOCKER_BUILD_SUMMARY` [environment variable](#environment-variables).
 For more information about summaries, refer to the
 [documentation](https://docs.docker.com/go/build-summary/).
 ## Customizing
 ### inputs
-Following inputs can be used as `step.with` keys
+The following inputs can be used as `step.with` keys:
 > `List` type is a newline-delimited string
 > ```yaml
@@ -222,6 +234,7 @@ Following inputs can be used as `step.with` keys
 | `build-contexts`   | List        | List of additional [build contexts](https://docs.docker.com/engine/reference/commandline/buildx_build/#build-context) (e.g., `name=path`)                                         |
 | `cache-from`       | List        | List of [external cache sources](https://docs.docker.com/engine/reference/commandline/buildx_build/#cache-from) (e.g., `type=local,src=path/to/dir`)                              |
 | `cache-to`         | List        | List of [cache export destinations](https://docs.docker.com/engine/reference/commandline/buildx_build/#cache-to) (e.g., `type=local,dest=path/to/dir`)                            |
 | `call`             | String      | Set [method for evaluating build](https://docs.docker.com/reference/cli/docker/buildx/build/#call) (e.g., `check`)                                                                |
 | `cgroup-parent`    | String      | Optional [parent cgroup](https://docs.docker.com/engine/reference/commandline/build/#use-a-custom-parent-cgroup---cgroup-parent) for the container used in the build              |
 | `context`          | String      | Build's context is the set of files located in the specified [`PATH` or `URL`](https://docs.docker.com/engine/reference/commandline/build/) (default [Git context](#git-context)) |
 | `file`             | String      | Path to the Dockerfile. (default `{context}/Dockerfile`)                                                                                                                          |
@@ -256,6 +269,16 @@ The following outputs are available:
 | `digest`   | String  | Image digest          |
 | `metadata` | JSON    | Build result metadata |
 ### environment variables
 | Name                                 | Type   | Default | Description                                                                                                                                                                                                                                                        |
 |--------------------------------------|--------|---------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `DOCKER_BUILD_CHECKS_ANNOTATIONS`    | Bool   | `true`  | If `false`, GitHub annotations are not generated for [build checks](https://docs.docker.com/build/checks/)                                                                                                                                                         |
 | `DOCKER_BUILD_SUMMARY`               | Bool   | `true`  | If `false`, [build summary](https://docs.docker.com/build/ci/github-actions/build-summary/) generation is disabled                                                                                                                                                 |
 | `DOCKER_BUILD_RECORD_UPLOAD`         | Bool   | `true`  | If `false`, build record upload as [GitHub artifact](https://docs.github.com/en/actions/using-workflows/storing-workflow-data-as-artifacts) is disabled                                                                                                            |
 | `DOCKER_BUILD_RECORD_RETENTION_DAYS` | Number |         | Duration after which build record artifact will expire in days. Defaults to repository/org [retention settings](https://docs.github.com/en/actions/learn-github-actions/usage-limits-billing-and-administration#artifact-and-log-retention-policy) if unset or `0` |
 | `DOCKER_BUILD_EXPORT_LEGACY`         | Bool   | `false` | If `true`, exports build using legacy export-build tool instead of [`buildx history export` command](https://docs.docker.com/reference/cli/docker/buildx/history/export/)                                                                                          |
 ## Troubleshooting
 See [TROUBLESHOOTING.md](TROUBLESHOOTING.md)
--- a/TROUBLESHOOTING.md
+++ b/TROUBLESHOOTING.md
@@ -4,7 +4,6 @@
  * [BuildKit container logs](#buildkit-container-logs)
  * [With containerd](#with-containerd)
 * [`repository name must be lowercase`](#repository-name-must-be-lowercase)
 * [Image not loaded](#image-not-loaded)
 ## Cannot push to a registry
@@ -59,7 +58,7 @@ jobs:
        uses: crazy-max/ghaction-setup-containerd@v2
      -
        name: Build Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
@@ -112,7 +111,7 @@ to generate sanitized tags:
    tags: latest
 - name: Build and push
-  uses: docker/build-push-action@v5
+  uses: docker/build-push-action@v6
  with:
    context: .
    push: true
@@ -130,35 +129,9 @@ Or a dedicated step to sanitize the slug:
    script: return 'ghcr.io/${{ github.repository }}'.toLowerCase()
 - name: Build and push
-  uses: docker/build-push-action@v5
+  uses: docker/build-push-action@v6
  with:
    context: .
    push: true
    tags: ${{ steps.repo_slug.outputs.result }}:latest
 ```
 ## Image not loaded
 Sometimes when your workflows are heavy consumers of disk storage, it can happen that build-push-action declares that the built image is loaded, but then not found in the following workflow steps.
 - You can use the following solution as workaround, to free space on disk before building docker image using the following workflow step
 ```yaml
      # Free disk space
      - name: Free Disk space
        shell: bash
        run: |
          sudo rm -rf /usr/local/lib/android  # will release about 10 GB if you don't need Android
          sudo rm -rf /usr/share/dotnet # will release about 20GB if you don't need .NET
 ```
 - Another workaround can be to call `docker/setup-buildx-action` with docker driver
 ```yaml
 name: Set up Docker Buildx
 uses: docker/setup-buildx-action@v3
 with:
  driver: docker
 ```
 More details in the [related issue](https://github.com/docker/build-push-action/issues/321)
--- a/tests/context.test.ts
+++ b/tests/context.test.ts
@@ -1,4 +1,4 @@
-import {beforeEach, describe, expect, jest, test} from '@jest/globals';
+import {afterEach, beforeEach, describe, expect, jest, test} from '@jest/globals';
 import * as fs from 'fs';
 import * as path from 'path';
@@ -68,6 +68,7 @@ jest.spyOn(Builder.prototype, 'inspect').mockImplementation(async (): Promise<Bu
 });
 describe('getArgs', () => {
  const originalEnv = process.env;
  beforeEach(() => {
    process.env = Object.keys(process.env).reduce((object, key) => {
      if (!key.startsWith('INPUT_')) {
@@ -76,6 +77,9 @@ describe('getArgs', () => {
      return object;
    }, {});
  });
  afterEach(() => {
    process.env = originalEnv;
  });
  // prettier-ignore
  test.each([
@@ -93,7 +97,8 @@ describe('getArgs', () => {
        'build',
        '--iidfile', imageIDFilePath,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      1,
@@ -116,7 +121,8 @@ ccc"`],
        '--build-arg', `MULTILINE=aaaa\nbbbb\nccc`,
        '--iidfile', imageIDFilePath,
        'https://github.com/docker/build-push-action.git#refs/heads/master'
-      ]
+      ],
      undefined
    ],
    [
      2,
@@ -134,7 +140,8 @@ ccc"`],
        '--tag', 'name/app:7.4',
        '--tag', 'name/app:latest',
        'https://github.com/docker/build-push-action.git#refs/heads/master'
-      ]
+      ],
      undefined
    ],
    [
      3,
@@ -154,7 +161,8 @@ ccc"`],
        '--label', 'org.opencontainers.image.description=concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit',
        '--output', 'type=local,dest=./release-out',
        '.'
-      ]
+      ],
      undefined
    ],
    [
      4,
@@ -171,7 +179,8 @@ ccc"`],
        'build',
        '--platform', 'linux/amd64,linux/arm64',
        '.'
-      ]
+      ],
      undefined
    ],
    [
      5,
@@ -187,7 +196,8 @@ ccc"`],
        'build',
        '--iidfile', imageIDFilePath,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      6,
@@ -205,7 +215,8 @@ ccc"`],
        '--iidfile', imageIDFilePath,
        '--secret', `id=GIT_AUTH_TOKEN,src=${tmpName}`,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      7,
@@ -223,7 +234,8 @@ ccc"`],
        '--output', '.',
        '--secret', `id=GIT_AUTH_TOKEN,src=${tmpName}`,
        'https://github.com/docker/build-push-action.git#refs/heads/master'
-      ]
+      ],
      undefined
    ],
    [
      8,
@@ -249,7 +261,8 @@ ccc"`],
        '--builder', 'builder-git-context-2',
        '--push',
        'https://github.com/docker/build-push-action.git#refs/heads/master'
-      ]
+      ],
      undefined
    ],
    [
      9,
@@ -286,7 +299,8 @@ ccc"`],
        '--builder', 'builder-git-context-2',
        '--push',
        'https://github.com/docker/build-push-action.git#refs/heads/master'
-      ]
+      ],
      undefined
    ],
    [
      10,
@@ -323,7 +337,8 @@ ccc`],
        '--builder', 'builder-git-context-2',
        '--push',
        'https://github.com/docker/build-push-action.git#refs/heads/master'
-      ]
+      ],
      undefined
    ],
    [
      11,
@@ -349,7 +364,8 @@ ccc`],
        '--network', 'host',
        '--push',
        'https://github.com/docker/build-push-action.git#refs/heads/master'
-      ]
+      ],
      undefined
    ],
    [
      12,
@@ -369,7 +385,8 @@ ccc`],
        '--label', 'org.opencontainers.image.description=Reference implementation of operation "filter results (top-n)"',
        '--output', 'type=local,dest=./release-out',
        '.'
-      ]
+      ],
      undefined
    ],
    [
      13,
@@ -395,7 +412,8 @@ ccc`],
        '--network', 'host',
        '--push',
        '.'
-      ]
+      ],
      undefined
    ],
    [
      14,
@@ -425,7 +443,8 @@ nproc=3`],
        '--ulimit', 'nproc=3',
        '--metadata-file', metadataJson,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      15,
@@ -442,7 +461,8 @@ nproc=3`],
        '--iidfile', imageIDFilePath,
        '--metadata-file', metadataJson,
        'https://github.com/docker/build-push-action.git#refs/heads/master:docker'
-      ]
+      ],
      undefined
    ],
    [
      16,
@@ -461,7 +481,8 @@ nproc=3`],
        '--secret', `id=GIT_AUTH_TOKEN,src=${tmpName}`,
        '--metadata-file', metadataJson,
        'https://github.com/docker/build-push-action.git#refs/heads/master:subdir'
-      ]
+      ],
      undefined
    ],
    [
      17,
@@ -479,7 +500,8 @@ nproc=3`],
        '--iidfile', imageIDFilePath,
        '--metadata-file', metadataJson,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      18,
@@ -494,10 +516,11 @@ nproc=3`],
      [
        'build',
        '--iidfile', imageIDFilePath,
-        '--attest', `type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789`,
+        '--attest', `type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
        '--metadata-file', metadataJson,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      19,
@@ -513,10 +536,11 @@ nproc=3`],
      [
        'build',
        '--iidfile', imageIDFilePath,
-        '--attest', `type=provenance,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789`,
+        '--attest', `type=provenance,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
        '--metadata-file', metadataJson,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      20,
@@ -532,10 +556,11 @@ nproc=3`],
      [
        'build',
        '--iidfile', imageIDFilePath,
-        '--attest', `type=provenance,mode=max,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789`,
+        '--attest', `type=provenance,mode=max,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
        '--metadata-file', metadataJson,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      21,
@@ -554,7 +579,8 @@ nproc=3`],
        '--attest', 'type=provenance,disabled=true',
        '--metadata-file', metadataJson,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      22,
@@ -573,7 +599,8 @@ nproc=3`],
        '--attest', 'type=provenance,builder-id=foo',
        '--metadata-file', metadataJson,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      23,
@@ -592,7 +619,8 @@ nproc=3`],
        "--output", 'type=docker',
        '--metadata-file', metadataJson,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      24,
@@ -610,7 +638,8 @@ nproc=3`],
        '--load',
        '--metadata-file', metadataJson,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      25,
@@ -630,7 +659,8 @@ nproc=3`],
        '--load',
        '--metadata-file', metadataJson,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      26,
@@ -652,7 +682,8 @@ ANOTHER_SECRET=ANOTHER_SECRET_ENV`]
        '--load',
        '--metadata-file', metadataJson,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      27,
@@ -673,7 +704,8 @@ ANOTHER_SECRET=ANOTHER_SECRET_ENV`]
        '--load',
        '--metadata-file', metadataJson,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      28,
@@ -690,10 +722,11 @@ ANOTHER_SECRET=ANOTHER_SECRET_ENV`]
      [
        'build',
        '--output', 'type=local,dest=./release-out',
-        '--attest', `type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789`,
+        '--attest', `type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
        '--metadata-file', metadataJson,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      29,
@@ -714,10 +747,11 @@ ANOTHER_SECRET=ANOTHER_SECRET_ENV`]
        '--annotation', 'manifest:example3=yyy',
        '--annotation', 'manifest-descriptor[linux/amd64]:example4=zzz',
        '--output', 'type=local,dest=./release-out',
-        '--attest', `type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789`,
+        '--attest', `type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
        '--metadata-file', metadataJson,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      30,
@@ -734,10 +768,11 @@ ANOTHER_SECRET=ANOTHER_SECRET_ENV`]
        'build',
        '--iidfile', imageIDFilePath,
        "--output", `type=image,"name=localhost:5000/name/app:latest,localhost:5000/name/app:foo",push-by-digest=true,name-canonical=true,push=true`,
-        '--attest', `type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789`,
+        '--attest', `type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
        '--metadata-file', metadataJson,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      31,
@@ -754,11 +789,12 @@ ANOTHER_SECRET=ANOTHER_SECRET_ENV`]
      [
        'build',
        '--iidfile', imageIDFilePath,
-        '--attest', `type=provenance,mode=max,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789`,
+        '--attest', `type=provenance,mode=max,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
        '--attest', `type=sbom,disabled=false`,
        '--metadata-file', metadataJson,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      32,
@@ -775,10 +811,11 @@ ANOTHER_SECRET=ANOTHER_SECRET_ENV`]
      [
        'build',
        '--iidfile', imageIDFilePath,
-        '--attest', `type=provenance,mode=max,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789`,
+        '--attest', `type=provenance,mode=max,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
        '--metadata-file', metadataJson,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      33,
@@ -794,14 +831,40 @@ ANOTHER_SECRET=ANOTHER_SECRET_ENV`]
      [
        'build',
        '--iidfile', imageIDFilePath,
-        '--attest', `type=provenance,mode=min,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789`,
+        '--attest', `type=provenance,mode=min,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
        '--metadata-file', metadataJson,
        '.'
-      ]
+      ],
      undefined
    ],
    [
      34,
      '0.13.1',
      new Map<string, string>([
        ['context', '.'],
        ['load', 'false'],
        ['no-cache', 'false'],
        ['push', 'false'],
        ['pull', 'false']
      ]),
      [
        'build',
        '--iidfile', imageIDFilePath,
        '--metadata-file', metadataJson,
        '.'
      ],
      new Map<string, string>([
        ['BUILDX_NO_DEFAULT_ATTESTATIONS', '1']
      ])
    ],
  ])(
    '[%d] given %p with %p as inputs, returns %p',
-    async (num: number, buildxVersion: string, inputs: Map<string, string>, expected: Array<string>) => {
+    async (num: number, buildxVersion: string, inputs: Map<string, string>, expected: Array<string>, envs: Map<string, string> | undefined) => {
      if (envs) {
        envs.forEach((value: string, name: string) => {
          process.env[name] = value;
        });
      }
      inputs.forEach((value: string, name: string) => {
        setInput(name, value);
      });
--- a/action.yml
+++ b/action.yml
@@ -34,6 +34,9 @@ inputs:
  cache-to:
    description: "List of cache export destinations for buildx (e.g., user/app:cache, type=local,dest=path/to/dir)"
    required: false
  call:
    description: "Set method for evaluating build (e.g., check)"
    required: false
  cgroup-parent:
    description: "Optional parent cgroup for the container used in the build"
    required: false
--- a/dist/index.js
+++ b/dist/index.js
--- a/dist/index.js.map
+++ b/dist/index.js.map
--- a/dist/licenses.txt
+++ b/dist/licenses.txt
@@ -2358,9 +2358,6 @@ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
 IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 dot-object
 MIT
 encoding
 MIT
 Copyright (c) 2012-2014 Andris Reinman
@@ -2516,6 +2513,30 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 he
 MIT
 Copyright Mathias Bynens <https://mathiasbynens.be/>
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
 "Software"), to deal in the Software without restriction, including
 without limitation the rights to use, copy, modify, merge, publish,
 distribute, sublicense, and/or sell copies of the Software, and to
 permit persons to whom the Software is furnished to do so, subject to
 the following conditions:
 The above copyright notice and this permission notice shall be
 included in all copies or substantial portions of the Software.
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
 MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
 LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
 OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 iconv-lite
 MIT
 Copyright (c) 2011 Alexander Shtuchkin
@@ -2807,7 +2828,7 @@ minimatch
 ISC
 The ISC License
-Copyright (c) Isaac Z. Schlueter and Contributors
+Copyright (c) 2011-2023 Isaac Z. Schlueter and Contributors
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
@@ -3667,9 +3688,6 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 twirp-ts
 MIT
 undici
 MIT
 MIT License
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -1,3 +1,9 @@
 target "_common" {
  args = {
    BUILDKIT_CONTEXT_KEEP_GIT_DIR = 1
  }
 }
 group "default" {
  targets = ["build"]
 }
@@ -11,42 +17,49 @@ group "validate" {
 }
 target "build" {
  inherits = ["_common"]
  dockerfile = "dev.Dockerfile"
  target = "build-update"
  output = ["."]
 }
 target "build-validate" {
  inherits = ["_common"]
  dockerfile = "dev.Dockerfile"
  target = "build-validate"
  output = ["type=cacheonly"]
 }
 target "format" {
  inherits = ["_common"]
  dockerfile = "dev.Dockerfile"
  target = "format-update"
  output = ["."]
 }
 target "lint" {
  inherits = ["_common"]
  dockerfile = "dev.Dockerfile"
  target = "lint"
  output = ["type=cacheonly"]
 }
 target "vendor" {
  inherits = ["_common"]
  dockerfile = "dev.Dockerfile"
  target = "vendor-update"
  output = ["."]
 }
 target "vendor-validate" {
  inherits = ["_common"]
  dockerfile = "dev.Dockerfile"
  target = "vendor-validate"
  output = ["type=cacheonly"]
 }
 target "test" {
  inherits = ["_common"]
  dockerfile = "dev.Dockerfile"
  target = "test-coverage"
  output = ["./coverage"]
--- a/package.json
+++ b/package.json
@@ -26,8 +26,8 @@
  "license": "Apache-2.0",
  "packageManager": "yarn@3.6.3",
  "dependencies": {
-    "@actions/core": "^1.10.1",
+    "@actions/core": "^1.11.1",
-    "@docker/actions-toolkit": "0.24.0",
+    "@docker/actions-toolkit": "0.62.1",
    "handlebars": "^4.7.7"
  },
  "devDependencies": {
--- a/src/context.ts
+++ b/src/context.ts
@@ -17,6 +17,7 @@ export interface Inputs {
  builder: string;
  'cache-from': string[];
  'cache-to': string[];
  call: string;
  'cgroup-parent': string;
  context: string;
  file: string;
@@ -53,6 +54,7 @@ export async function getInputs(): Promise<Inputs> {
    builder: core.getInput('builder'),
    'cache-from': Util.getInputList('cache-from', {ignoreComma: true}),
    'cache-to': Util.getInputList('cache-to', {ignoreComma: true}),
    call: core.getInput('call'),
    'cgroup-parent': core.getInput('cgroup-parent'),
    context: core.getInput('context') || Context.gitContext(),
    file: core.getInput('file'),
@@ -96,9 +98,9 @@ async function getBuildArgs(inputs: Inputs, context: string, toolkit: Toolkit):
  await Util.asyncForEach(inputs['add-hosts'], async addHost => {
    args.push('--add-host', addHost);
  });
-  if (inputs.allow.length > 0) {
+  await Util.asyncForEach(inputs.allow, async allow => {
-    args.push('--allow', inputs.allow.join(','));
+    args.push('--allow', allow);
-  }
+  });
  if (await toolkit.buildx.versionSatisfies('>=0.12.0')) {
    await Util.asyncForEach(inputs.annotations, async annotation => {
      args.push('--annotation', annotation);
@@ -111,7 +113,12 @@ async function getBuildArgs(inputs: Inputs, context: string, toolkit: Toolkit):
  });
  if (await toolkit.buildx.versionSatisfies('>=0.8.0')) {
    await Util.asyncForEach(inputs['build-contexts'], async buildContext => {
-      args.push('--build-context', buildContext);
+      args.push(
        '--build-context',
        handlebars.compile(buildContext)({
          defaultContext: Context.gitContext()
        })
      );
    });
  } else if (inputs['build-contexts'].length > 0) {
    core.warning("Build contexts are only supported by buildx >= 0.8.0; the input 'build-contexts' is ignored.");
@@ -122,6 +129,12 @@ async function getBuildArgs(inputs: Inputs, context: string, toolkit: Toolkit):
  await Util.asyncForEach(inputs['cache-to'], async cacheTo => {
    args.push('--cache-to', cacheTo);
  });
  if (inputs.call) {
    if (!(await toolkit.buildx.versionSatisfies('>=0.15.0'))) {
      throw new Error(`Buildx >= 0.15.0 is required to use the call flag.`);
    }
    args.push('--call', inputs.call);
  }
  if (inputs['cgroup-parent']) {
    args.push('--cgroup-parent', inputs['cgroup-parent']);
  }
@@ -232,7 +245,7 @@ async function getAttestArgs(inputs: Inputs, toolkit: Toolkit): Promise<Array<st
  if (inputs.provenance) {
    args.push('--attest', Build.resolveAttestationAttrs(`type=provenance,${inputs.provenance}`));
    provenanceSet = true;
-  } else if (!hasAttestProvenance && (await toolkit.buildkit.versionSatisfies(inputs.builder, '>=0.11.0')) && !Build.hasDockerExporter(inputs.outputs, inputs.load)) {
+  } else if (!hasAttestProvenance && !noDefaultAttestations() && (await toolkit.buildkit.versionSatisfies(inputs.builder, '>=0.11.0')) && !Build.hasDockerExporter(inputs.outputs, inputs.load)) {
    // if provenance not specified in provenance or attests inputs and BuildKit
    // version compatible for attestation, set default provenance. Also needs
    // to make sure user doesn't want to explicitly load the image to docker.
@@ -264,3 +277,10 @@ async function getAttestArgs(inputs: Inputs, toolkit: Toolkit): Promise<Array<st
  return args;
 }
 function noDefaultAttestations(): boolean {
  if (process.env.BUILDX_NO_DEFAULT_ATTESTATIONS) {
    return Util.parseBool(process.env.BUILDX_NO_DEFAULT_ATTESTATIONS);
  }
  return false;
 }
--- a/src/main.ts
+++ b/src/main.ts
@@ -4,20 +4,27 @@ import * as stateHelper from './state-helper';
 import * as core from '@actions/core';
 import * as actionsToolkit from '@docker/actions-toolkit';
 import {Buildx} from '@docker/actions-toolkit/lib/buildx/buildx';
 import {History as BuildxHistory} from '@docker/actions-toolkit/lib/buildx/history';
 import {Context} from '@docker/actions-toolkit/lib/context';
 import {Docker} from '@docker/actions-toolkit/lib/docker/docker';
 import {Exec} from '@docker/actions-toolkit/lib/exec';
 import {GitHub} from '@docker/actions-toolkit/lib/github';
 import {Toolkit} from '@docker/actions-toolkit/lib/toolkit';
 import {Util} from '@docker/actions-toolkit/lib/util';
 import {BuilderInfo} from '@docker/actions-toolkit/lib/types/buildx/builder';
 import {ConfigFile} from '@docker/actions-toolkit/lib/types/docker/docker';
 import {UploadArtifactResponse} from '@docker/actions-toolkit/lib/types/github';
 import * as context from './context';
 actionsToolkit.run(
  // main
  async () => {
    const startedTime = new Date();
    const inputs: context.Inputs = await context.getInputs();
    stateHelper.setSummaryInputs(inputs);
    core.debug(`inputs: ${JSON.stringify(inputs)}`);
    const toolkit = new Toolkit();
@@ -75,8 +82,11 @@ actionsToolkit.run(
      await toolkit.buildx.printVersion();
    });
    let builder: BuilderInfo;
    await core.group(`Builder info`, async () => {
-      const builder = await toolkit.builder.inspect(inputs.builder);
+      builder = await toolkit.builder.inspect(inputs.builder);
      stateHelper.setBuilderDriver(builder.driver ?? '');
      stateHelper.setBuilderEndpoint(builder.nodes?.[0]?.endpoint ?? '');
      core.info(JSON.stringify(builder, null, 2));
    });
@@ -87,18 +97,29 @@ actionsToolkit.run(
    core.debug(`buildCmd.command: ${buildCmd.command}`);
    core.debug(`buildCmd.args: ${JSON.stringify(buildCmd.args)}`);
    let err: Error | undefined;
    await Exec.getExecOutput(buildCmd.command, buildCmd.args, {
-      ignoreReturnCode: true
+      ignoreReturnCode: true,
      env: Object.assign({}, process.env, {
        BUILDX_METADATA_WARNINGS: 'true'
      }) as {
        [key: string]: string;
      }
    }).then(res => {
-      if (res.stderr.length > 0 && res.exitCode != 0) {
+      if (res.exitCode != 0) {
-        throw new Error(`buildx failed with: ${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
+        if (inputs.call && inputs.call === 'check' && res.stdout.length > 0) {
          // checks warnings are printed to stdout: https://github.com/docker/buildx/pull/2647
          // take the first line with the message summaryzing the warnings
          err = new Error(res.stdout.split('\n')[0]?.trim());
        } else if (res.stderr.length > 0) {
          err = new Error(`buildx failed with: ${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
        }
      }
    });
    const imageID = toolkit.buildxBuild.resolveImageID();
    const metadata = toolkit.buildxBuild.resolveMetadata();
-    const digest = toolkit.buildxBuild.resolveDigest();
+    const digest = toolkit.buildxBuild.resolveDigest(metadata);
    if (imageID) {
      await core.group(`ImageID`, async () => {
        core.info(imageID);
@@ -118,13 +139,168 @@ actionsToolkit.run(
        core.setOutput('metadata', metadatadt);
      });
    }
    let ref: string | undefined;
    await core.group(`Reference`, async () => {
      ref = await buildRef(toolkit, startedTime, inputs.builder);
      if (ref) {
        core.info(ref);
        stateHelper.setBuildRef(ref);
      } else {
        core.info('No build reference found');
      }
    });
    if (buildChecksAnnotationsEnabled()) {
      const warnings = toolkit.buildxBuild.resolveWarnings(metadata);
      if (ref && warnings && warnings.length > 0) {
        const annotations = await Buildx.convertWarningsToGitHubAnnotations(warnings, [ref]);
        core.debug(`annotations: ${JSON.stringify(annotations, null, 2)}`);
        if (annotations && annotations.length > 0) {
          await core.group(`Generating GitHub annotations (${annotations.length} build checks found)`, async () => {
            for (const annotation of annotations) {
              core.warning(annotation.message, annotation);
            }
          });
        }
      }
    }
    await core.group(`Check build summary support`, async () => {
      if (!buildSummaryEnabled()) {
        core.info('Build summary disabled');
      } else if (inputs.call && inputs.call !== 'build') {
        core.info(`Build summary skipped for ${inputs.call} subrequest`);
      } else if (GitHub.isGHES) {
        core.info('Build summary is not yet supported on GHES');
      } else if (!(await toolkit.buildx.versionSatisfies('>=0.13.0'))) {
        core.info('Build summary requires Buildx >= 0.13.0');
      } else if (!ref) {
        core.info('Build summary requires a build reference');
      } else {
        core.info('Build summary supported!');
        stateHelper.setSummarySupported();
      }
    });
    if (err) {
      throw err;
    }
  },
  // post
  async () => {
    if (stateHelper.isSummarySupported) {
      await core.group(`Generating build summary`, async () => {
        try {
          const recordUploadEnabled = buildRecordUploadEnabled();
          let recordRetentionDays: number | undefined;
          if (recordUploadEnabled) {
            recordRetentionDays = buildRecordRetentionDays();
          }
          const buildxHistory = new BuildxHistory();
          const exportRes = await buildxHistory.export({
            refs: stateHelper.buildRef ? [stateHelper.buildRef] : [],
            useContainer: buildExportLegacy()
          });
          core.info(`Build record written to ${exportRes.dockerbuildFilename} (${Util.formatFileSize(exportRes.dockerbuildSize)})`);
          let uploadRes: UploadArtifactResponse | undefined;
          if (recordUploadEnabled) {
            uploadRes = await GitHub.uploadArtifact({
              filename: exportRes.dockerbuildFilename,
              mimeType: 'application/gzip',
              retentionDays: recordRetentionDays
            });
          }
          await GitHub.writeBuildSummary({
            exportRes: exportRes,
            uploadRes: uploadRes,
            inputs: stateHelper.summaryInputs,
            driver: stateHelper.builderDriver,
            endpoint: stateHelper.builderEndpoint
          });
        } catch (e) {
          core.warning(e.message);
        }
      });
    }
    if (stateHelper.tmpDir.length > 0) {
      await core.group(`Removing temp folder ${stateHelper.tmpDir}`, async () => {
-        fs.rmSync(stateHelper.tmpDir, {recursive: true});
+        try {
          fs.rmSync(stateHelper.tmpDir, {recursive: true});
        } catch (e) {
          core.warning(`Failed to remove temp folder ${stateHelper.tmpDir}`);
        }
      });
    }
  }
 );
 async function buildRef(toolkit: Toolkit, since: Date, builder?: string): Promise<string> {
  // get ref from metadata file
  const ref = toolkit.buildxBuild.resolveRef();
  if (ref) {
    return ref;
  }
  // otherwise, look for the very first build ref since the build has started
  if (!builder) {
    const currentBuilder = await toolkit.builder.inspect();
    builder = currentBuilder.name;
  }
  const refs = Buildx.refs({
    dir: Buildx.refsDir,
    builderName: builder,
    since: since
  });
  return Object.keys(refs).length > 0 ? Object.keys(refs)[0] : '';
 }
 function buildChecksAnnotationsEnabled(): boolean {
  if (process.env.DOCKER_BUILD_CHECKS_ANNOTATIONS) {
    return Util.parseBool(process.env.DOCKER_BUILD_CHECKS_ANNOTATIONS);
  }
  return true;
 }
 function buildSummaryEnabled(): boolean {
  if (process.env.DOCKER_BUILD_NO_SUMMARY) {
    core.warning('DOCKER_BUILD_NO_SUMMARY is deprecated. Set DOCKER_BUILD_SUMMARY to false instead.');
    return !Util.parseBool(process.env.DOCKER_BUILD_NO_SUMMARY);
  } else if (process.env.DOCKER_BUILD_SUMMARY) {
    return Util.parseBool(process.env.DOCKER_BUILD_SUMMARY);
  }
  return true;
 }
 function buildRecordUploadEnabled(): boolean {
  if (process.env.DOCKER_BUILD_RECORD_UPLOAD) {
    return Util.parseBool(process.env.DOCKER_BUILD_RECORD_UPLOAD);
  }
  return true;
 }
 function buildRecordRetentionDays(): number | undefined {
  let val: string | undefined;
  if (process.env.DOCKER_BUILD_EXPORT_RETENTION_DAYS) {
    core.warning('DOCKER_BUILD_EXPORT_RETENTION_DAYS is deprecated. Use DOCKER_BUILD_RECORD_RETENTION_DAYS instead.');
    val = process.env.DOCKER_BUILD_EXPORT_RETENTION_DAYS;
  } else if (process.env.DOCKER_BUILD_RECORD_RETENTION_DAYS) {
    val = process.env.DOCKER_BUILD_RECORD_RETENTION_DAYS;
  }
  if (val) {
    const res = parseInt(val);
    if (isNaN(res)) {
      throw new Error(`Invalid build record retention days: ${val}`);
    }
    return res;
  }
 }
 function buildExportLegacy(): boolean {
  if (process.env.DOCKER_BUILD_EXPORT_LEGACY) {
    return Util.parseBool(process.env.DOCKER_BUILD_EXPORT_LEGACY);
  }
  return false;
 }
--- a/src/state-helper.ts
+++ b/src/state-helper.ts
@@ -1,7 +1,70 @@
 import * as core from '@actions/core';
 import {Build} from '@docker/actions-toolkit/lib/buildx/build';
 import {Inputs} from './context';
 export const tmpDir = process.env['STATE_tmpDir'] || '';
 export const builderDriver = process.env['STATE_builderDriver'] || '';
 export const builderEndpoint = process.env['STATE_builderEndpoint'] || '';
 export const summaryInputs = process.env['STATE_summaryInputs'] ? JSON.parse(process.env['STATE_summaryInputs']) : undefined;
 export const buildRef = process.env['STATE_buildRef'] || '';
 export const isSummarySupported = !!process.env['STATE_isSummarySupported'];
 export function setTmpDir(tmpDir: string) {
  core.saveState('tmpDir', tmpDir);
 }
 export function setBuilderDriver(builderDriver: string) {
  core.saveState('builderDriver', builderDriver);
 }
 export function setBuilderEndpoint(builderEndpoint: string) {
  core.saveState('builderEndpoint', builderEndpoint);
 }
 export function setBuildRef(buildRef: string) {
  core.saveState('buildRef', buildRef);
 }
 export function setSummarySupported() {
  core.saveState('isSummarySupported', 'true');
 }
 export function setSummaryInputs(inputs: Inputs) {
  const res = {};
  for (const key of Object.keys(inputs)) {
    if (key === 'github-token') {
      continue;
    }
    const value: string | string[] | boolean = inputs[key];
    if (typeof value === 'boolean' && !value) {
      continue;
    } else if (Array.isArray(value)) {
      if (value.length === 0) {
        continue;
      } else if (key === 'secrets' && value.length > 0) {
        const secretKeys: string[] = [];
        for (const secret of value) {
          try {
            // eslint-disable-next-line @typescript-eslint/no-unused-vars
            const [skey, _] = Build.parseSecretKvp(secret, true);
            secretKeys.push(skey);
          } catch (err) {
            // ignore invalid secret
          }
        }
        if (secretKeys.length > 0) {
          res[key] = secretKeys;
        }
        continue;
      }
    } else if (!value) {
      continue;
    }
    res[key] = value;
  }
  core.saveState('summaryInputs', JSON.stringify(res));
 }
--- a/test/lint.Dockerfile
+++ b/test/lint.Dockerfile
@@ -0,0 +1,12 @@
 frOM busybox as base
 cOpy lint.Dockerfile .
 from scratch
 MAINTAINER moby@example.com
 COPy --from=base \
  /lint.Dockerfile \
  /
 CMD [ "echo", "Hello, Norway!" ]
 CMD [ "echo", "Hello, Sweden!" ]
 ENTRYPOINT my-program start
--- a/test/multi-sudo.Dockerfile
+++ b/test/multi-sudo.Dockerfile
@@ -1,5 +1,6 @@
 # syntax=docker/dockerfile:1
-FROM --platform=$BUILDPLATFORM golang:alpine AS build
+
 FROM --platform=$BUILDPLATFORM alpine AS build
 ARG TARGETPLATFORM
 ARG BUILDPLATFORM
 RUN echo "I am running on $BUILDPLATFORM, building for $TARGETPLATFORM" > /log
@@ -12,7 +13,7 @@ RUN apk --update --no-cache add \
  && rm -rf /tmp/* /var/cache/apk/*
 USER buildx
-RUN sudo chown buildx. /log
+RUN sudo chown buildx: /log
 USER root
 FROM alpine
--- a/yarn.lock
+++ b/yarn.lock