Merge pull request #413 from crazy-max/ci-dispatch

ci: add workflow_dispatch event

.dockerignore

@@ -1,2 +1,12 @@
 /coverage
-/node_modules
+
+# Dependency directories
+node_modules/
+jspm_packages/
+
+# yarn v2
+.yarn/cache
+.yarn/unplugged
+.yarn/build-state.yml
+.yarn/install-state.gz
+.pnp.*

.gitattributes

@@ -1,2 +1,4 @@
+/.yarn/releases/** binary
+/.yarn/plugins/** binary
 /dist/** linguist-generated=true
 /lib/** linguist-generated=true

.github/workflows/ci.yml

@@ -5,6 +5,7 @@ concurrency:
   cancel-in-progress: true
 
 on:
+  workflow_dispatch:
   schedule:
     - cron: '0 10 * * *'
   push:
@@ -25,8 +26,9 @@ jobs:
           - ""
           - "latest"
           - "v0.4.1"
+          - "cloud:latest"
+          - "cloud:v0.11.2-desktop.2"
           - "lab:latest"
-          - "lab:v0.11.2-desktop.2"
     steps:
       -
         name: Checkout
@@ -108,7 +110,7 @@ jobs:
           buildkitd-flags: --debug
       -
         name: Build
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/ppc64le
@@ -254,7 +256,7 @@ jobs:
           buildkitd-config: /tmp/buildkitd.toml
       -
         name: Build
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
 
@@ -281,7 +283,7 @@ jobs:
               mirrors = ["mirror.gcr.io"]
       -
         name: Build
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
 
@@ -515,7 +517,7 @@ jobs:
           cleanup: ${{ matrix.cleanup }}
 
   k3s:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
@@ -528,9 +530,7 @@ jobs:
         uses: actions/checkout@v4
       -
         name: Install k3s
-        uses: crazy-max/.github/.github/actions/install-k3s@605d30d5ae97f6680578ace4b56645af79343e60
-        with:
-          version: "v1.21.2-k3s1"
+        uses: crazy-max/.github/.github/actions/install-k3s@f5cb4a109b7a3b466a2ac293ef4bb13f1571acd7
       -
         name: Set up Docker Buildx
         id: buildx
@@ -582,3 +582,24 @@ jobs:
         with:
           version: v0.11.2
           cache-binary: ${{ matrix.cache }}
+
+  windows-error:
+    runs-on: windows-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Set up Docker Buildx
+        id: buildx
+        continue-on-error: true
+        uses: ./
+      -
+        name: Check
+        run: |
+          echo "${{ toJson(steps.buildx) }}"
+          if [ "${{ steps.buildx.outcome }}" != "failure" ] || [ "${{ steps.buildx.conclusion }}" != "success" ]; then
+            echo "::error::Should have failed"
+            exit 1
+          fi
+        shell: bash

.github/workflows/publish.yml

@@ -0,0 +1,21 @@
+name: publish
+
+on:
+  release:
+    types:
+      - published
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Publish
+        uses: actions/publish-immutable-action@v0.0.4

.github/workflows/test.yml

@@ -23,12 +23,12 @@ jobs:
         uses: ./
       -
         name: Test
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@v6
         with:
           targets: test
       -
         name: Upload coverage
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
         with:
-          file: ./coverage/clover.xml
+          files: ./coverage/clover.xml
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/validate.yml

@@ -15,16 +15,17 @@ jobs:
   prepare:
     runs-on: ubuntu-latest
     outputs:
-      targets: ${{ steps.targets.outputs.matrix }}
+      targets: ${{ steps.generate.outputs.targets }}
     steps:
       -
         name: Checkout
         uses: actions/checkout@v4
       -
-        name: Targets matrix
-        id: targets
-        run: |
-          echo "matrix=$(docker buildx bake validate --print | jq -cr '.group.validate.targets')" >> $GITHUB_OUTPUT
+        name: List targets
+        id: generate
+        uses: docker/bake-action/subaction/list-targets@v6
+        with:
+          target: validate
 
   validate:
     runs-on: ubuntu-latest
@@ -35,11 +36,8 @@ jobs:
       matrix:
         target: ${{ fromJson(needs.prepare.outputs.targets) }}
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
       -
         name: Validate
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@v6
         with:
           targets: ${{ matrix.target }}

.gitignore

@@ -1,12 +1,5 @@
-/.dev
-node_modules
-lib
+# https://raw.githubusercontent.com/github/gitignore/main/Node.gitignore
 
-# Jetbrains
-/.idea
-/*.iml
-
-# Rest of the file pulled from https://github.com/github/gitignore/blob/master/Node.gitignore
 # Logs
 logs
 *.log
@@ -14,6 +7,7 @@ npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 lerna-debug.log*
+.pnpm-debug.log*
 
 # Diagnostic reports (https://nodejs.org/api/report.html)
 report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
@@ -24,34 +18,14 @@ pids
 *.seed
 *.pid.lock
 
-# Directory for instrumented libs generated by jscoverage/JSCover
-lib-cov
-
 # Coverage directory used by tools like istanbul
 coverage
 *.lcov
 
-# nyc test coverage
-.nyc_output
-
-# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
-.grunt
-
-# Bower dependency directory (https://bower.io/)
-bower_components
-
-# node-waf configuration
-.lock-wscript
-
-# Compiled binary addons (https://nodejs.org/api/addons.html)
-build/Release
-
 # Dependency directories
+node_modules/
 jspm_packages/
 
-# TypeScript v1 declaration files
-typings/
-
 # TypeScript cache
 *.tsbuildinfo
 
@@ -61,36 +35,19 @@ typings/
 # Optional eslint cache
 .eslintcache
 
-# Optional REPL history
-.node_repl_history
-
-# Output of 'npm pack'
-*.tgz
-
 # Yarn Integrity file
 .yarn-integrity
 
-# dotenv environment variables file
+# dotenv environment variable files
 .env
-.env.test
+.env.development.local
+.env.test.local
+.env.production.local
+.env.local
 
-# parcel-bundler cache (https://parceljs.org/)
-.cache
-
-# next.js build output
-.next
-
-# nuxt.js build output
-.nuxt
-
-# vuepress build output
-.vuepress/dist
-
-# Serverless directories
-.serverless/
-
-# FuseBox cache
-.fusebox/
-
-# DynamoDB Local files
-.dynamodb/
+# yarn v2
+.yarn/cache
+.yarn/unplugged
+.yarn/build-state.yml
+.yarn/install-state.gz
+.pnp.*

.prettierignore

@@ -0,0 +1,6 @@
+# Dependency directories
+node_modules/
+jspm_packages/
+
+# yarn v2
+.yarn/

.yarnrc.yml

@@ -0,0 +1,13 @@
+logFilters:
+  - code: YN0013
+    level: discard
+  - code: YN0019
+    level: discard
+  - code: YN0076
+    level: discard
+
+nodeLinker: node-modules
+
+plugins:
+  - path: .yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
+    spec: "@yarnpkg/plugin-interactive-tools"

README.md

@@ -101,7 +101,13 @@ The following inputs can be used as `step.with` keys:
 | `cache-binary`               | Bool     | `true`             | Cache buildx binary to GitHub Actions cache backend                                                                                                                          |
 | `cleanup`                    | Bool     | `true`             | Cleanup temp files and remove builder at the end of a job                                                                                                                    |
 
-_\* `buildkitd-config` and `buildkitd-config-inline` are mutually exclusive_
+> [!IMPORTANT]
+> If you set the `buildkitd-flags` input, the default flags (`--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host`)
+> will be reset. If you want to retain the default behavior, make sure to
+> include these flags in your custom `buildkitd-flags` value.
+
+> [!NOTE]
+> `buildkitd-config` and `buildkitd-config-inline` are mutually exclusive.
 
 ### outputs
 

__tests__/context.test.ts

@@ -1,12 +1,11 @@
 import {beforeEach, describe, expect, jest, test} from '@jest/globals';
 import * as fs from 'fs';
 import * as path from 'path';
-import * as uuid from 'uuid';
 import {Buildx} from '@docker/actions-toolkit/lib/buildx/buildx';
 import {Context} from '@docker/actions-toolkit/lib/context';
 import {Docker} from '@docker/actions-toolkit/lib/docker/docker';
 import {Toolkit} from '@docker/actions-toolkit/lib/toolkit';
-import {Node} from '@docker/actions-toolkit/lib/types/builder';
+import {Node} from '@docker/actions-toolkit/lib/types/buildx/builder';
 
 import * as context from '../src/context';
 
@@ -26,8 +25,12 @@ jest.spyOn(Context, 'tmpName').mockImplementation((): string => {
   return tmpName;
 });
 
-jest.mock('uuid');
-jest.spyOn(uuid, 'v4').mockReturnValue('9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d');
+jest.mock('crypto', () => {
+  return {
+    ...(jest.requireActual('crypto') as object),
+    randomUUID: jest.fn(() => '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d')
+  };
+});
 
 jest.spyOn(Docker, 'context').mockImplementation((): Promise<string> => {
   return Promise.resolve('default');
@@ -226,6 +229,24 @@ describe('getCreateArgs', () => {
         '--buildkitd-flags', '--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host',
         '--config', tmpName,
       ]
+    ],
+    [
+      10,
+      'v0.10.3',
+      new Map<string, string>([
+        ['install', 'false'],
+        ['use', 'false'],
+        ['driver', 'cloud'],
+        ['buildkitd-flags', '--allow-insecure-entitlement network.host'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true'],
+      ]),
+      [
+        'create',
+        '--name', 'builder-9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d',
+        '--driver', 'cloud',
+        '--buildkitd-flags', '--allow-insecure-entitlement network.host',
+      ]
     ]
   ])(
     '[%d] given buildx %s and %p as inputs, returns %p',
@@ -302,6 +323,140 @@ describe('getAppendArgs', () => {
   );
 });
 
+describe('getVersion', () => {
+  beforeEach(() => {
+    process.env = Object.keys(process.env).reduce((object, key) => {
+      if (!key.startsWith('INPUT_')) {
+        object[key] = process.env[key];
+      }
+      return object;
+    }, {});
+  });
+
+  // prettier-ignore
+  test.each([
+    [
+      0,
+      new Map<string, string>([
+        // defaults
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true'],
+      ]),
+      ''
+    ],
+    [
+      1,
+      new Map<string, string>([
+        ['version', 'latest'],
+        // defaults
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true']
+      ]),
+      'latest'
+    ],
+    [
+      2,
+      new Map<string, string>([
+        ['version', 'edge'],
+        // defaults
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true']
+      ]),
+      'edge'
+    ],
+    [
+      3,
+      new Map<string, string>([
+        ['version', 'v0.19.2'],
+        // defaults
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true']
+      ]),
+      'v0.19.2'
+    ],
+    [
+      4,
+      new Map<string, string>([
+        ['version', 'latest'],
+        ['driver', 'cloud'],
+        // defaults
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true']
+      ]),
+      'cloud:latest'
+    ],
+    [
+      5,
+      new Map<string, string>([
+        ['version', 'edge'],
+        ['driver', 'cloud'],
+        // defaults
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true']
+      ]),
+      'cloud:edge'
+    ],
+    [
+      6,
+      new Map<string, string>([
+        ['driver', 'cloud'],
+        // defaults
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true'],
+      ]),
+      'cloud:latest'
+    ],
+    [
+      7,
+      new Map<string, string>([
+        ['version', 'cloud:v0.11.2-desktop.2'],
+        ['driver', 'cloud'],
+        // defaults
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true'],
+      ]),
+      'cloud:v0.11.2-desktop.2'
+    ],
+    [
+      8,
+      new Map<string, string>([
+        ['version', 'cloud:v0.11.2-desktop.2'],
+        // defaults
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true'],
+      ]),
+      'cloud:v0.11.2-desktop.2'
+    ],
+  ])(
+    '[%d] given %p as inputs, returns version %p',
+    async (num: number, inputs: Map<string, string>, expected: string) => {
+      inputs.forEach((value: string, name: string) => {
+        setInput(name, value);
+      });
+      const inp = await context.getInputs();
+      expect(context.getVersion(inp)).toEqual(expected);
+    }
+  );
+});
+
 // See: https://github.com/actions/toolkit/blob/master/packages/core/src/core.ts#L67
 function getInputName(name: string): string {
   return `INPUT_${name.replace(/ /g, '_').toUpperCase()}`;

action.yml

@@ -19,7 +19,6 @@ inputs:
     required: false
   buildkitd-flags:
     description: 'BuildKit daemon flags'
-    default: '--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host'
     required: false
   buildkitd-config:
     description: 'BuildKit daemon config file'
@@ -52,7 +51,7 @@ inputs:
     description: 'Cleanup temp files and remove builder at the end of a job'
     default: 'true'
     required: false
-  # deprecated inputs
+  # TODO: remove deprecated config and config-inline inputs
   config:
     description: 'BuildKit daemon config file'
     deprecationMessage: 'Use buildkitd-config instead'

dev.Dockerfile

@@ -5,9 +5,16 @@ ARG NODE_VERSION=20
 FROM node:${NODE_VERSION}-alpine AS base
 RUN apk add --no-cache cpio findutils git
 WORKDIR /src
+RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/.yarn/cache <<EOT
+  corepack enable
+  yarn --version
+  yarn config set --home enableTelemetry 0
+EOT
 
 FROM base AS deps
 RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/.yarn/cache \
   --mount=type=cache,target=/src/node_modules \
   yarn install && mkdir /vendor && cp yarn.lock /vendor
 
@@ -16,18 +23,19 @@ COPY --from=deps /vendor /
 
 FROM deps AS vendor-validate
 RUN --mount=type=bind,target=.,rw <<EOT
-set -e
-git add -A
-cp -rf /vendor/* .
-if [ -n "$(git status --porcelain -- yarn.lock)" ]; then
-  echo >&2 'ERROR: Vendor result differs. Please vendor your package with "docker buildx bake vendor-update"'
-  git status --porcelain -- yarn.lock
-  exit 1
-fi
+  set -e
+  git add -A
+  cp -rf /vendor/* .
+  if [ -n "$(git status --porcelain -- yarn.lock)" ]; then
+    echo >&2 'ERROR: Vendor result differs. Please vendor your package with "docker buildx bake vendor"'
+    git status --porcelain -- yarn.lock
+    exit 1
+  fi
 EOT
 
 FROM deps AS build
 RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/.yarn/cache \
   --mount=type=cache,target=/src/node_modules \
   yarn run build && mkdir /out && cp -Rf dist /out/
 
@@ -36,34 +44,35 @@ COPY --from=build /out /
 
 FROM build AS build-validate
 RUN --mount=type=bind,target=.,rw <<EOT
-set -e
-git add -A
-cp -rf /out/* .
-if [ -n "$(git status --porcelain -- dist)" ]; then
-  echo >&2 'ERROR: Build result differs. Please build first with "docker buildx bake build"'
-  git status --porcelain -- dist
-  exit 1
-fi
+  set -e
+  git add -A
+  cp -rf /out/* .
+  if [ -n "$(git status --porcelain -- dist)" ]; then
+    echo >&2 'ERROR: Build result differs. Please build first with "docker buildx bake build"'
+    git status --porcelain -- dist
+    exit 1
+  fi
 EOT
 
 FROM deps AS format
 RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/.yarn/cache \
   --mount=type=cache,target=/src/node_modules \
   yarn run format \
-  && mkdir /out && find . -name '*.ts' -not -path './node_modules/*' | cpio -pdm /out
+  && mkdir /out && find . -name '*.ts' -not -path './node_modules/*' -not -path './.yarn/*' | cpio -pdm /out
 
 FROM scratch AS format-update
 COPY --from=format /out /
 
 FROM deps AS lint
 RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/.yarn/cache \
   --mount=type=cache,target=/src/node_modules \
   yarn run lint
 
 FROM deps AS test
-ENV RUNNER_TEMP=/tmp/github_runner
-ENV RUNNER_TOOL_CACHE=/tmp/github_tool_cache
 RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/.yarn/cache \
   --mount=type=cache,target=/src/node_modules \
   yarn run test --coverage --coverageDirectory=/tmp/coverage
 

docker-bake.hcl

@@ -1,9 +1,15 @@
+target "_common" {
+  args = {
+    BUILDKIT_CONTEXT_KEEP_GIT_DIR = 1
+  }
+}
+
 group "default" {
   targets = ["build"]
 }
 
 group "pre-checkin" {
-  targets = ["vendor-update", "format", "build"]
+  targets = ["vendor", "format", "build"]
 }
 
 group "validate" {
@@ -11,42 +17,49 @@ group "validate" {
 }
 
 target "build" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "build-update"
   output = ["."]
 }
 
 target "build-validate" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "build-validate"
   output = ["type=cacheonly"]
 }
 
 target "format" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "format-update"
   output = ["."]
 }
 
 target "lint" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "lint"
   output = ["type=cacheonly"]
 }
 
-target "vendor-update" {
+target "vendor" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "vendor-update"
   output = ["."]
 }
 
 target "vendor-validate" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "vendor-validate"
   output = ["type=cacheonly"]
 }
 
 target "test" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "test-coverage"
   output = ["./coverage"]

package.json

@@ -1,17 +1,16 @@
 {
   "name": "docker-setup-buildx",
   "description": "Set up Docker Buildx",
-  "main": "lib/main.js",
+  "main": "src/main.ts",
   "scripts": {
-    "build": "ncc build src/main.ts --source-map --minify --license licenses.txt",
+    "build": "ncc build --source-map --minify --license licenses.txt",
     "lint": "yarn run prettier && yarn run eslint",
     "format": "yarn run prettier:fix && yarn run eslint:fix",
     "eslint": "eslint --max-warnings=0 .",
     "eslint:fix": "eslint --fix .",
     "prettier": "prettier --check \"./**/*.ts\"",
     "prettier:fix": "prettier --write \"./**/*.ts\"",
-    "test": "jest",
-    "all": "yarn run build && yarn run format && yarn test"
+    "test": "jest"
   },
   "repository": {
     "type": "git",
@@ -24,26 +23,27 @@
   ],
   "author": "Docker Inc.",
   "license": "Apache-2.0",
+  "packageManager": "yarn@3.6.3",
   "dependencies": {
-    "@actions/core": "^1.10.1",
-    "@actions/exec": "^1.1.1",
-    "@docker/actions-toolkit": "^0.19.0",
-    "js-yaml": "^4.1.0",
-    "uuid": "^9.0.1"
+    "@actions/core": "^1.11.1",
+    "@docker/actions-toolkit": "^0.56.0",
+    "js-yaml": "^4.1.0"
   },
   "devDependencies": {
-    "@types/node": "^20.5.9",
-    "@typescript-eslint/eslint-plugin": "^6.6.0",
-    "@typescript-eslint/parser": "^6.6.0",
-    "@vercel/ncc": "^0.38.0",
-    "eslint": "^8.48.0",
-    "eslint-config-prettier": "^9.0.0",
-    "eslint-plugin-jest": "^27.2.3",
-    "eslint-plugin-prettier": "^5.0.0",
-    "jest": "^29.6.4",
-    "prettier": "^3.0.3",
-    "ts-jest": "^29.1.1",
-    "ts-node": "^10.9.1",
-    "typescript": "^5.2.2"
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^20.12.12",
+    "@types/uuid": "^10.0.0",
+    "@typescript-eslint/eslint-plugin": "^7.9.0",
+    "@typescript-eslint/parser": "^7.9.0",
+    "@vercel/ncc": "^0.38.1",
+    "eslint": "^8.57.0",
+    "eslint-config-prettier": "^9.1.0",
+    "eslint-plugin-jest": "^28.5.0",
+    "eslint-plugin-prettier": "^5.1.3",
+    "jest": "^29.7.0",
+    "prettier": "^3.2.5",
+    "ts-jest": "^29.1.2",
+    "ts-node": "^10.9.2",
+    "typescript": "^5.4.5"
   }
 }

src/context.ts

@@ -1,11 +1,14 @@
-import * as uuid from 'uuid';
+import * as crypto from 'crypto';
 import * as core from '@actions/core';
+
 import {Docker} from '@docker/actions-toolkit/lib/docker/docker';
 import {Util} from '@docker/actions-toolkit/lib/util';
 import {Toolkit} from '@docker/actions-toolkit/lib/toolkit';
-import {Node} from '@docker/actions-toolkit/lib/types/builder';
+
+import {Node} from '@docker/actions-toolkit/lib/types/buildx/builder';
 
 export const builderNodeEnvPrefix = 'BUILDER_NODE';
+const defaultBuildkitdFlags = '--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host';
 
 export interface Inputs {
   version: string;
@@ -30,7 +33,7 @@ export async function getInputs(): Promise<Inputs> {
     name: await getBuilderName(core.getInput('driver') || 'docker-container'),
     driver: core.getInput('driver') || 'docker-container',
     driverOpts: Util.getInputList('driver-opts', {ignoreComma: true, quote: false}),
-    buildkitdFlags: core.getInput('buildkitd-flags') || '--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host',
+    buildkitdFlags: core.getInput('buildkitd-flags'),
     platforms: Util.getInputList('platforms'),
     install: core.getBooleanInput('install'),
     use: core.getBooleanInput('use'),
@@ -44,17 +47,19 @@ export async function getInputs(): Promise<Inputs> {
 }
 
 export async function getBuilderName(driver: string): Promise<string> {
-  return driver == 'docker' ? await Docker.context() : `builder-${uuid.v4()}`;
+  return driver == 'docker' ? await Docker.context() : `builder-${crypto.randomUUID()}`;
 }
 
 export async function getCreateArgs(inputs: Inputs, toolkit: Toolkit): Promise<Array<string>> {
   const args: Array<string> = ['create', '--name', inputs.name, '--driver', inputs.driver];
   if (await toolkit.buildx.versionSatisfies('>=0.3.0')) {
-    await Util.asyncForEach(inputs.driverOpts, async driverOpt => {
+    await Util.asyncForEach(inputs.driverOpts, async (driverOpt: string) => {
       args.push('--driver-opt', driverOpt);
     });
-    if (driverSupportsFlags(inputs.driver) && inputs.buildkitdFlags) {
+    if (inputs.buildkitdFlags) {
       args.push('--buildkitd-flags', inputs.buildkitdFlags);
+    } else if (driverSupportsBuildkitdFlags(inputs.driver)) {
+      args.push('--buildkitd-flags', defaultBuildkitdFlags);
     }
   }
   if (inputs.platforms.length > 0) {
@@ -63,12 +68,10 @@ export async function getCreateArgs(inputs: Inputs, toolkit: Toolkit): Promise<A
   if (inputs.use) {
     args.push('--use');
   }
-  if (driverSupportsFlags(inputs.driver)) {
-    if (inputs.buildkitdConfig) {
-      args.push('--config', toolkit.buildkit.config.resolveFromFile(inputs.buildkitdConfig));
-    } else if (inputs.buildkitdConfigInline) {
-      args.push('--config', toolkit.buildkit.config.resolveFromString(inputs.buildkitdConfigInline));
-    }
+  if (inputs.buildkitdConfig) {
+    args.push('--config', toolkit.buildkit.config.resolveFromFile(inputs.buildkitdConfig));
+  } else if (inputs.buildkitdConfigInline) {
+    args.push('--config', toolkit.buildkit.config.resolveFromString(inputs.buildkitdConfigInline));
   }
   if (inputs.endpoint) {
     args.push(inputs.endpoint);
@@ -81,14 +84,16 @@ export async function getAppendArgs(inputs: Inputs, node: Node, toolkit: Toolkit
   if (node.name) {
     args.push('--node', node.name);
   } else if (inputs.driver == 'kubernetes' && (await toolkit.buildx.versionSatisfies('<0.11.0'))) {
-    args.push('--node', `node-${uuid.v4()}`);
+    args.push('--node', `node-${crypto.randomUUID()}`);
   }
   if (node['driver-opts'] && (await toolkit.buildx.versionSatisfies('>=0.3.0'))) {
-    await Util.asyncForEach(node['driver-opts'], async driverOpt => {
+    await Util.asyncForEach(node['driver-opts'], async (driverOpt: string) => {
       args.push('--driver-opt', driverOpt);
     });
-    if (driverSupportsFlags(inputs.driver) && node['buildkitd-flags']) {
+    if (node['buildkitd-flags']) {
       args.push('--buildkitd-flags', node['buildkitd-flags']);
+    } else if (driverSupportsBuildkitdFlags(inputs.driver)) {
+      args.push('--buildkitd-flags', defaultBuildkitdFlags);
     }
   }
   if (node.platforms) {
@@ -108,6 +113,20 @@ export async function getInspectArgs(inputs: Inputs, toolkit: Toolkit): Promise<
   return args;
 }
 
-function driverSupportsFlags(driver: string): boolean {
+function driverSupportsBuildkitdFlags(driver: string): boolean {
   return driver == '' || driver == 'docker-container' || driver == 'docker' || driver == 'kubernetes';
 }
+
+export function getVersion(inputs: Inputs): string {
+  const version = inputs.version;
+  if (inputs.driver === 'cloud') {
+    if (!version || version === 'latest') {
+      return 'cloud:latest';
+    }
+    if (version.startsWith('cloud:') || version.startsWith('lab:')) {
+      return version;
+    }
+    return `cloud:${version}`;
+  }
+  return version;
+}

src/main.ts

@@ -1,14 +1,18 @@
+import * as crypto from 'crypto';
 import * as fs from 'fs';
 import * as yaml from 'js-yaml';
 import * as core from '@actions/core';
-import * as exec from '@actions/exec';
 import * as actionsToolkit from '@docker/actions-toolkit';
+
 import {Buildx} from '@docker/actions-toolkit/lib/buildx/buildx';
 import {Builder} from '@docker/actions-toolkit/lib/buildx/builder';
 import {Docker} from '@docker/actions-toolkit/lib/docker/docker';
+import {Exec} from '@docker/actions-toolkit/lib/exec';
 import {Toolkit} from '@docker/actions-toolkit/lib/toolkit';
 import {Util} from '@docker/actions-toolkit/lib/util';
-import {Node} from '@docker/actions-toolkit/lib/types/builder';
+
+import {Node} from '@docker/actions-toolkit/lib/types/buildx/builder';
+import {ContextInfo} from '@docker/actions-toolkit/lib/types/docker/docker';
 
 import * as context from './context';
 import * as stateHelper from './state-helper';
@@ -18,6 +22,7 @@ actionsToolkit.run(
   async () => {
     const inputs: context.Inputs = await context.getInputs();
     stateHelper.setCleanup(inputs.cleanup);
+    const version = context.getVersion(inputs);
 
     const toolkit = new Toolkit();
     const standalone = await toolkit.buildx.isStandalone();
@@ -33,16 +38,16 @@ actionsToolkit.run(
     });
 
     let toolPath;
-    if (Util.isValidRef(inputs.version)) {
+    if (Util.isValidRef(version)) {
       if (standalone) {
         throw new Error(`Cannot build from source without the Docker CLI`);
       }
       await core.group(`Build buildx from source`, async () => {
-        toolPath = await toolkit.buildxInstall.build(inputs.version, !inputs.cacheBinary);
+        toolPath = await toolkit.buildxInstall.build(version, !inputs.cacheBinary);
       });
-    } else if (!(await toolkit.buildx.isAvailable()) || inputs.version) {
+    } else if (!(await toolkit.buildx.isAvailable()) || version) {
       await core.group(`Download buildx from GitHub Releases`, async () => {
-        toolPath = await toolkit.buildxInstall.download(inputs.version || 'latest', !inputs.cacheBinary);
+        toolPath = await toolkit.buildxInstall.download(version || 'latest', !inputs.cacheBinary);
       });
     }
     if (toolPath) {
@@ -66,6 +71,51 @@ actionsToolkit.run(
     fs.mkdirSync(Buildx.certsDir, {recursive: true});
     stateHelper.setCertsDir(Buildx.certsDir);
 
+    // if the default context has TLS data loaded and endpoint is not set, then
+    // we create a temporary docker context only if driver is docker-container
+    // https://github.com/docker/buildx/blob/b96ad59f64d40873e4959336d294b648bb3937fe/builder/builder.go#L489
+    // https://github.com/docker/setup-buildx-action/issues/105
+    if (!standalone && inputs.driver == 'docker-container' && (await Docker.context()) == 'default' && inputs.endpoint.length == 0) {
+      let defaultContextWithTLS: boolean = false;
+      await core.group(`Inspecting default docker context`, async () => {
+        await Docker.getExecOutput(['context', 'inspect', '--format=json', 'default'], {
+          ignoreReturnCode: true,
+          silent: true
+        }).then(res => {
+          if (res.stderr.length > 0 && res.exitCode != 0) {
+            core.info(`Cannot inspect default docker context: ${res.stderr.trim()}`);
+          } else {
+            try {
+              const contextInfo = (<Array<ContextInfo>>JSON.parse(res.stdout.trim()))[0];
+              core.info(JSON.stringify(JSON.parse(res.stdout.trim()), undefined, 2));
+              const hasTLSData = Object.keys(contextInfo.Endpoints).length > 0 && Object.values(contextInfo.Endpoints)[0].TLSData !== undefined;
+              const hasTLSMaterial = Object.keys(contextInfo.TLSMaterial).length > 0 && Object.values(contextInfo.TLSMaterial)[0].length > 0;
+              defaultContextWithTLS = hasTLSData || hasTLSMaterial;
+            } catch (e) {
+              core.info(`Unable to parse default docker context info: ${e}`);
+              core.info(res.stdout.trim());
+            }
+          }
+        });
+      });
+      if (defaultContextWithTLS) {
+        const tmpDockerContext = `buildx-${crypto.randomUUID()}`;
+        await core.group(`Creating temp docker context (TLS data loaded in default one)`, async () => {
+          await Docker.getExecOutput(['context', 'create', tmpDockerContext], {
+            ignoreReturnCode: true
+          }).then(res => {
+            if (res.stderr.length > 0 && res.exitCode != 0) {
+              core.warning(`Cannot create docker context ${tmpDockerContext}: ${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
+            } else {
+              core.info(`Setting builder endpoint to ${tmpDockerContext} context`);
+              inputs.endpoint = tmpDockerContext;
+              stateHelper.setTmpDockerContext(tmpDockerContext);
+            }
+          });
+        });
+      }
+    }
+
     if (inputs.driver !== 'docker') {
       await core.group(`Creating a new builder instance`, async () => {
         const certsDriverOpts = Buildx.resolveCertsDriverOpts(inputs.driver, inputs.endpoint, {
@@ -77,7 +127,13 @@ actionsToolkit.run(
           inputs.driverOpts = [...inputs.driverOpts, ...certsDriverOpts];
         }
         const createCmd = await toolkit.buildx.getCommand(await context.getCreateArgs(inputs, toolkit));
-        await exec.exec(createCmd.command, createCmd.args);
+        await Exec.getExecOutput(createCmd.command, createCmd.args, {
+          ignoreReturnCode: true
+        }).then(res => {
+          if (res.stderr.length > 0 && res.exitCode != 0) {
+            throw new Error(res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error');
+          }
+        });
       });
     }
 
@@ -95,7 +151,13 @@ actionsToolkit.run(
             node['driver-opts'] = [...(node['driver-opts'] || []), ...certsDriverOpts];
           }
           const appendCmd = await toolkit.buildx.getCommand(await context.getAppendArgs(inputs, node, toolkit));
-          await exec.exec(appendCmd.command, appendCmd.args);
+          await Exec.getExecOutput(appendCmd.command, appendCmd.args, {
+            ignoreReturnCode: true
+          }).then(res => {
+            if (res.stderr.length > 0 && res.exitCode != 0) {
+              throw new Error(`Failed to append node ${node.name}: ${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
+            }
+          });
           nodeIndex++;
         }
       });
@@ -103,7 +165,13 @@ actionsToolkit.run(
 
     await core.group(`Booting builder`, async () => {
       const inspectCmd = await toolkit.buildx.getCommand(await context.getInspectArgs(inputs, toolkit));
-      await exec.exec(inspectCmd.command, inspectCmd.args);
+      await Exec.getExecOutput(inspectCmd.command, inspectCmd.args, {
+        ignoreReturnCode: true
+      }).then(res => {
+        if (res.stderr.length > 0 && res.exitCode != 0) {
+          throw new Error(res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error');
+        }
+      });
     });
 
     if (inputs.install) {
@@ -112,7 +180,13 @@ actionsToolkit.run(
       }
       await core.group(`Setting buildx as default builder`, async () => {
         const installCmd = await toolkit.buildx.getCommand(['install']);
-        await exec.exec(installCmd.command, installCmd.args);
+        await Exec.getExecOutput(installCmd.command, installCmd.args, {
+          ignoreReturnCode: true
+        }).then(res => {
+          if (res.stderr.length > 0 && res.exitCode != 0) {
+            throw new Error(res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error');
+          }
+        });
       });
     }
 
@@ -155,15 +229,13 @@ actionsToolkit.run(
   async () => {
     if (stateHelper.IsDebug && stateHelper.containerName.length > 0) {
       await core.group(`BuildKit container logs`, async () => {
-        await exec
-          .getExecOutput('docker', ['logs', `${stateHelper.containerName}`], {
-            ignoreReturnCode: true
-          })
-          .then(res => {
-            if (res.stderr.length > 0 && res.exitCode != 0) {
-              core.warning(res.stderr.trim());
-            }
-          });
+        await Docker.getExecOutput(['logs', `${stateHelper.containerName}`], {
+          ignoreReturnCode: true
+        }).then(res => {
+          if (res.stderr.length > 0 && res.exitCode != 0) {
+            core.warning(res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error');
+          }
+        });
       });
     }
 
@@ -177,21 +249,31 @@ actionsToolkit.run(
         const builder = new Builder({buildx: buildx});
         if (await builder.exists(stateHelper.builderName)) {
           const rmCmd = await buildx.getCommand(['rm', stateHelper.builderName]);
-          await exec
-            .getExecOutput(rmCmd.command, rmCmd.args, {
-              ignoreReturnCode: true
-            })
-            .then(res => {
-              if (res.stderr.length > 0 && res.exitCode != 0) {
-                core.warning(res.stderr.trim());
-              }
-            });
+          await Exec.getExecOutput(rmCmd.command, rmCmd.args, {
+            ignoreReturnCode: true
+          }).then(res => {
+            if (res.stderr.length > 0 && res.exitCode != 0) {
+              core.warning(res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error');
+            }
+          });
         } else {
           core.info(`${stateHelper.builderName} does not exist`);
         }
       });
     }
 
+    if (stateHelper.tmpDockerContext) {
+      await core.group(`Removing temp docker context`, async () => {
+        await Exec.getExecOutput('docker', ['context', 'rm', '-f', stateHelper.tmpDockerContext], {
+          ignoreReturnCode: true
+        }).then(res => {
+          if (res.stderr.length > 0 && res.exitCode != 0) {
+            core.warning(`${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
+          }
+        });
+      });
+    }
+
     if (stateHelper.certsDir.length > 0 && fs.existsSync(stateHelper.certsDir)) {
       await core.group(`Cleaning up certificates`, async () => {
         fs.rmSync(stateHelper.certsDir, {recursive: true});

src/state-helper.ts

@@ -6,6 +6,7 @@ export const builderName = process.env['STATE_builderName'] || '';
 export const builderDriver = process.env['STATE_builderDriver'] || '';
 export const containerName = process.env['STATE_containerName'] || '';
 export const certsDir = process.env['STATE_certsDir'] || '';
+export const tmpDockerContext = process.env['STATE_tmpDockerContext'] || '';
 export const cleanup = /true/i.test(process.env['STATE_cleanup'] || '');
 
 export function setDebug(debug: string) {
@@ -32,6 +33,10 @@ export function setCertsDir(certsDir: string) {
   core.saveState('certsDir', certsDir);
 }
 
+export function setTmpDockerContext(tmpDockerContext: string) {
+  core.saveState('tmpDockerContext', tmpDockerContext);
+}
+
 export function setCleanup(cleanup: boolean) {
   core.saveState('cleanup', cleanup);
 }