Merge pull request #1198 from docker/dependabot/npm_and_yarn/docker/actions-toolkit-0.37.0

chore(deps): Bump @docker/actions-toolkit from 0.36.0 to 0.37.0

.github/workflows/ci.yml

@@ -1463,3 +1463,51 @@ jobs:
           file: ./test/Dockerfile
         env:
           DOCKER_BUILD_RECORD_RETENTION_DAYS: ${{ matrix.days }}
+
+  checks:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        buildx-version:
+          - latest
+          - v0.14.1
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: ${{ matrix.buildx-version }}
+          driver-opts: |
+            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
+      -
+        name: Build
+        uses: ./
+        with:
+          context: ./test
+          file: ./test/lint.Dockerfile
+
+  annotations-disabled:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
+          driver-opts: |
+            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
+      -
+        name: Build
+        uses: ./
+        with:
+          context: ./test
+          file: ./test/lint.Dockerfile
+        env:
+          DOCKER_BUILD_CHECKS_ANNOTATIONS: false

README.md

@@ -258,6 +258,7 @@ The following outputs are available:
 
 | Name                                 | Type   | Default | Description                                                                                                                                                                                                                                                        |
 |--------------------------------------|--------|---------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `DOCKER_BUILD_CHECKS_ANNOTATIONS`    | Bool   | `true`  | If `false`, GitHub annotations are not generated for [build checks](https://docs.docker.com/build/checks/)                                                                                                                                                         |
 | `DOCKER_BUILD_SUMMARY`               | Bool   | `true`  | If `false`, [build summary](https://docs.docker.com/build/ci/github-actions/build-summary/) generation is disabled                                                                                                                                                 |
 | `DOCKER_BUILD_RECORD_UPLOAD`         | Bool   | `true`  | If `false`, build record upload as [GitHub artifact](https://docs.github.com/en/actions/using-workflows/storing-workflow-data-as-artifacts) is disabled                                                                                                            |
 | `DOCKER_BUILD_RECORD_RETENTION_DAYS` | Number |         | Duration after which build record artifact will expire in days. Defaults to repository/org [retention settings](https://docs.github.com/en/actions/learn-github-actions/usage-limits-billing-and-administration#artifact-and-log-retention-policy) if unset or `0` |

__tests__/context.test.ts

@@ -799,27 +799,6 @@ ANOTHER_SECRET=ANOTHER_SECRET_ENV`]
         '.'
       ]
     ],
-    [
-      34,
-      '0.14.1',
-      new Map<string, string>([
-        ['context', '.'],
-        ['load', 'false'],
-        ['no-cache', 'false'],
-        ['push', 'false'],
-        ['pull', 'false'],
-        ['cache-to', 'type=gha'],
-        ['github-token', `abcd1234`],
-      ]),
-      [
-        'build',
-        '--cache-to', 'type=gha,repository=docker/build-push-action,ghtoken=abcd1234',
-        '--iidfile', imageIDFilePath,
-        '--attest', `type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
-        '--metadata-file', metadataJson,
-        '.'
-      ]
-    ],
   ])(
     '[%d] given %p with %p as inputs, returns %p',
     async (num: number, buildxVersion: string, inputs: Map<string, string>, expected: Array<string>) => {

package.json

@@ -27,7 +27,7 @@
   "packageManager": "yarn@3.6.3",
   "dependencies": {
     "@actions/core": "^1.10.1",
-    "@docker/actions-toolkit": "0.33.0",
+    "@docker/actions-toolkit": "0.37.0",
     "handlebars": "^4.7.7"
   },
   "devDependencies": {

src/context.ts

@@ -139,7 +139,7 @@ async function getBuildArgs(inputs: Inputs, context: string, toolkit: Toolkit):
     args.push('--cache-from', cacheFrom);
   });
   await Util.asyncForEach(inputs['cache-to'], async cacheTo => {
-    args.push('--cache-to', Build.resolveCacheToAttrs(cacheTo, inputs['github-token']));
+    args.push('--cache-to', cacheTo);
   });
   if (inputs['cgroup-parent']) {
     args.push('--cgroup-parent', inputs['cgroup-parent']);

src/main.ts

@@ -97,7 +97,12 @@ actionsToolkit.run(
 
     let err: Error | undefined;
     await Exec.getExecOutput(buildCmd.command, buildCmd.args, {
-      ignoreReturnCode: true
+      ignoreReturnCode: true,
+      env: Object.assign({}, process.env, {
+        BUILDX_METADATA_WARNINGS: 'true'
+      }) as {
+        [key: string]: string;
+      }
     }).then(res => {
       if (res.stderr.length > 0 && res.exitCode != 0) {
         err = Error(`buildx failed with: ${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
@@ -106,7 +111,7 @@ actionsToolkit.run(
 
     const imageID = toolkit.buildxBuild.resolveImageID();
     const metadata = toolkit.buildxBuild.resolveMetadata();
-    const digest = toolkit.buildxBuild.resolveDigest();
+    const digest = toolkit.buildxBuild.resolveDigest(metadata);
     if (imageID) {
       await core.group(`ImageID`, async () => {
         core.info(imageID);
@@ -127,7 +132,7 @@ actionsToolkit.run(
       });
     }
 
-    let ref: string;
+    let ref: string | undefined;
     await core.group(`Reference`, async () => {
       ref = await buildRef(toolkit, startedTime, inputs.builder);
       if (ref) {
@@ -138,6 +143,21 @@ actionsToolkit.run(
       }
     });
 
+    if (buildChecksAnnotationsEnabled()) {
+      const warnings = toolkit.buildxBuild.resolveWarnings(metadata);
+      if (ref && warnings && warnings.length > 0) {
+        const annotations = await Buildx.convertWarningsToGitHubAnnotations(warnings, [ref]);
+        core.debug(`annotations: ${JSON.stringify(annotations, null, 2)}`);
+        if (annotations && annotations.length > 0) {
+          await core.group(`Generating GitHub annotations (${annotations.length} build checks found)`, async () => {
+            for (const annotation of annotations) {
+              core.warning(annotation.message, annotation);
+            }
+          });
+        }
+      }
+    }
+
     await core.group(`Check build summary support`, async () => {
       if (!buildSummaryEnabled()) {
         core.info('Build summary disabled');
@@ -222,6 +242,13 @@ async function buildRef(toolkit: Toolkit, since: Date, builder?: string): Promis
   return Object.keys(refs).length > 0 ? Object.keys(refs)[0] : '';
 }
 
+function buildChecksAnnotationsEnabled(): boolean {
+  if (process.env.DOCKER_BUILD_CHECKS_ANNOTATIONS) {
+    return Util.parseBool(process.env.DOCKER_BUILD_CHECKS_ANNOTATIONS);
+  }
+  return true;
+}
+
 function buildSummaryEnabled(): boolean {
   if (process.env.DOCKER_BUILD_NO_SUMMARY) {
     core.warning('DOCKER_BUILD_NO_SUMMARY is deprecated. Set DOCKER_BUILD_SUMMARY to false instead.');

test/lint.Dockerfile

@@ -0,0 +1,12 @@
+frOM busybox as base
+cOpy lint.Dockerfile .
+
+from scratch
+MAINTAINER moby@example.com
+COPy --from=base \
+  /lint.Dockerfile \
+  /
+
+CMD [ "echo", "Hello, Norway!" ]
+CMD [ "echo", "Hello, Sweden!" ]
+ENTRYPOINT my-program start

yarn.lock

@@ -1055,9 +1055,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@docker/actions-toolkit@npm:0.33.0":
-  version: 0.33.0
-  resolution: "@docker/actions-toolkit@npm:0.33.0"
+"@docker/actions-toolkit@npm:0.37.0":
+  version: 0.37.0
+  resolution: "@docker/actions-toolkit@npm:0.37.0"
   dependencies:
     "@actions/artifact": ^2.1.8
     "@actions/cache": ^3.2.4
@@ -1077,10 +1077,10 @@ __metadata:
     he: ^1.2.0
     js-yaml: ^4.1.0
     jwt-decode: ^4.0.0
-    semver: ^7.6.2
+    semver: ^7.6.3
     tar-stream: ^3.1.7
     tmp: ^0.2.3
-  checksum: 510273d28bcf0c8a6acd4ffffa0b52cf98f46018f7f3f0772026b8fdb9422cf1dc851558140a0e95e8af3c584eb087ecb2dc48bdab0bc4f8dd9994959b052a22
+  checksum: e0972ce4a205ddb72542cbaba3c08342ccadb198baa3093ca2b66fb926d49bed41e5b55fd1ed48df04d375529c16e1166dc0571360fc01921b30f6e55879e1f1
   languageName: node
   linkType: hard
 
@@ -3150,7 +3150,7 @@ __metadata:
   resolution: "docker-build-push@workspace:."
   dependencies:
     "@actions/core": ^1.10.1
-    "@docker/actions-toolkit": 0.33.0
+    "@docker/actions-toolkit": 0.37.0
     "@types/node": ^20.12.12
     "@typescript-eslint/eslint-plugin": ^7.9.0
     "@typescript-eslint/parser": ^7.9.0
@@ -5894,7 +5894,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"semver@npm:^7.6.0, semver@npm:^7.6.2":
+"semver@npm:^7.6.0":
   version: 7.6.2
   resolution: "semver@npm:7.6.2"
   bin:
@@ -5903,6 +5903,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"semver@npm:^7.6.3":
+  version: 7.6.3
+  resolution: "semver@npm:7.6.3"
+  bin:
+    semver: bin/semver.js
+  checksum: 4110ec5d015c9438f322257b1c51fe30276e5f766a3f64c09edd1d7ea7118ecbc3f379f3b69032bacf13116dc7abc4ad8ce0d7e2bd642e26b0d271b56b61a7d8
+  languageName: node
+  linkType: hard
+
 "shebang-command@npm:^2.0.0":
   version: 2.0.0
   resolution: "shebang-command@npm:2.0.0"