Merge pull request #440 from crazy-max/k3s-build

ci: k3s test with latest buildx

.github/workflows/ci.yml

@@ -5,6 +5,7 @@ concurrency:
   cancel-in-progress: true
 
 on:
+  workflow_dispatch:
   schedule:
     - cron: '0 10 * * *'
   push:
@@ -25,8 +26,9 @@ jobs:
           - ""
           - "latest"
           - "v0.4.1"
+          - "cloud:latest"
+          - "cloud:v0.11.2-desktop.2"
           - "lab:latest"
-          - "lab:v0.11.2-desktop.2"
     steps:
       -
         name: Checkout
@@ -515,11 +517,12 @@ jobs:
           cleanup: ${{ matrix.cleanup }}
 
   k3s:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         version:
+          - latest
           - v0.11.0
           - v0.10.5
     steps:
@@ -528,9 +531,7 @@ jobs:
         uses: actions/checkout@v4
       -
         name: Install k3s
-        uses: crazy-max/.github/.github/actions/install-k3s@605d30d5ae97f6680578ace4b56645af79343e60
+        uses: crazy-max/.github/.github/actions/install-k3s@a94383ec9e125b23907fb6fcebf7ff87964595e5
-        with:
-          version: "v1.21.2-k3s1"
       -
         name: Set up Docker Buildx
         id: buildx
@@ -582,3 +583,66 @@ jobs:
         with:
           version: v0.11.2
           cache-binary: ${{ matrix.cache }}
+
+  windows-error:
+    runs-on: windows-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Set up Docker Buildx
+        id: buildx
+        continue-on-error: true
+        uses: ./
+      -
+        name: Check
+        run: |
+          echo "${{ toJson(steps.buildx) }}"
+          if [ "${{ steps.buildx.outcome }}" != "failure" ] || [ "${{ steps.buildx.conclusion }}" != "success" ]; then
+            echo "::error::Should have failed"
+            exit 1
+          fi
+        shell: bash
+
+  keep-state:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Set up Docker Buildx
+        uses: ./
+        with:
+          name: foo
+          keep-state: true
+      -
+        name: Set up Docker Buildx
+        uses: ./
+        with:
+          name: foo
+          keep-state: true
+
+  keep-state-error:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Set up Docker Buildx
+        id: buildx
+        continue-on-error: true
+        uses: ./
+        with:
+          driver: docker
+          keep-state: true
+      -
+        name: Check
+        run: |
+          echo "${{ toJson(steps.buildx) }}"
+          if [ "${{ steps.buildx.outcome }}" != "failure" ] || [ "${{ steps.buildx.conclusion }}" != "success" ]; then
+            echo "::error::Should have failed"
+            exit 1
+          fi

.github/workflows/pr-assign-author.yml

@@ -0,0 +1,17 @@
+name: pr-assign-author
+
+permissions:
+  contents: read
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+
+jobs:
+  run:
+    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@1b673f36fad86812f538c1df9794904038a23cbf
+    permissions:
+      contents: read
+      pull-requests: write

.github/workflows/publish.yml

@@ -0,0 +1,21 @@
+name: publish
+
+on:
+  release:
+    types:
+      - published
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Publish
+        uses: actions/publish-immutable-action@v0.0.4

.github/workflows/test.yml

@@ -23,12 +23,12 @@ jobs:
         uses: ./
       -
         name: Test
-        uses: docker/bake-action@v5
+        uses: docker/bake-action@v6
         with:
           targets: test
       -
         name: Upload coverage
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
         with:
-          file: ./coverage/clover.xml
+          files: ./coverage/clover.xml
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/validate.yml

@@ -15,16 +15,17 @@ jobs:
   prepare:
     runs-on: ubuntu-latest
     outputs:
-      targets: ${{ steps.targets.outputs.matrix }}
+      targets: ${{ steps.generate.outputs.targets }}
     steps:
       -
         name: Checkout
         uses: actions/checkout@v4
       -
-        name: Targets matrix
+        name: List targets
-        id: targets
+        id: generate
-        run: |
+        uses: docker/bake-action/subaction/list-targets@v6
-          echo "matrix=$(docker buildx bake validate --print | jq -cr '.group.validate.targets')" >> $GITHUB_OUTPUT
+        with:
+          target: validate
 
   validate:
     runs-on: ubuntu-latest
@@ -35,11 +36,8 @@ jobs:
       matrix:
         target: ${{ fromJson(needs.prepare.outputs.targets) }}
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
       -
         name: Validate
-        uses: docker/bake-action@v5
+        uses: docker/bake-action@v6
         with:
           targets: ${{ matrix.target }}

.yarnrc.yml

@@ -1,3 +1,9 @@
+# https://yarnpkg.com/configuration/yarnrc
+
+compressionLevel: mixed
+enableGlobalCache: false
+enableHardenedMode: true
+
 logFilters:
   - code: YN0013
     level: discard
@@ -5,9 +11,7 @@ logFilters:
     level: discard
   - code: YN0076
     level: discard
+  - code: YN0086
+    level: discard
 
 nodeLinker: node-modules
-
-plugins:
-  - path: .yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
-    spec: "@yarnpkg/plugin-interactive-tools"

README.md

@@ -86,8 +86,9 @@ The following inputs can be used as `step.with` keys:
 > ```
 
 | Name                         | Type     | Default            | Description                                                                                                                                                                 |
-|------------------------------|----------|--------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+|------------------------------|----------|--------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `version`                    | String   |                    | [Buildx](https://github.com/docker/buildx) version. (eg. `v0.3.0`, `latest`, `https://github.com/docker/buildx.git#master`)                                                 |
+| `name`                       | String   |                    | Name of the builder. If not specified, one will be generated or if it already exists, it will be used instead of creating a new one                                         |
 | `driver`                     | String   | `docker-container` | Sets the [builder driver](https://docs.docker.com/engine/reference/commandline/buildx_create/#driver) to be used                                                            |
 | `driver-opts`                | List     |                    | List of additional [driver-specific options](https://docs.docker.com/engine/reference/commandline/buildx_create/#driver-opt) (eg. `image=moby/buildkit:master`)             |
 | `buildkitd-flags`            | String   |                    | [BuildKit daemon flags](https://docs.docker.com/engine/reference/commandline/buildx_create/#buildkitd-flags)                                                                |
@@ -96,12 +97,19 @@ The following inputs can be used as `step.with` keys:
 | `install`                    | Bool     | `false`            | Sets up `docker build` command as an alias to `docker buildx`                                                                                                               |
 | `use`                        | Bool     | `true`             | Switch to this builder instance                                                                                                                                             |
 | `endpoint`                   | String   |                    | [Optional address for docker socket](https://docs.docker.com/engine/reference/commandline/buildx_create/#description) or context from `docker context ls`                   |
-| `platforms`                  | List/CSV |                    | Fixed [platforms](https://docs.docker.com/engine/reference/commandline/buildx_create/#platform) for current node. If not empty, values take priority over the detected ones. |
+| `platforms`                  | List/CSV |                    | Fixed [platforms](https://docs.docker.com/engine/reference/commandline/buildx_create/#platform) for current node. If not empty, values take priority over the detected ones |
 | `append`                     | YAML     |                    | [Append additional nodes](https://docs.docker.com/build/ci/github-actions/configure-builder/#append-additional-nodes-to-the-builder) to the builder                         |
+| `keep-state`                 | Bool     | `false`            | Keep BuildKit state on `cleanup`. This is only useful on persistent self-hosted runners                                                                                     |
 | `cache-binary`               | Bool     | `true`             | Cache buildx binary to GitHub Actions cache backend                                                                                                                         |
 | `cleanup`                    | Bool     | `true`             | Cleanup temp files and remove builder at the end of a job                                                                                                                   |
 
-_\* `buildkitd-config` and `buildkitd-config-inline` are mutually exclusive_
+> [!IMPORTANT]
+> If you set the `buildkitd-flags` input, the default flags (`--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host`)
+> will be reset. If you want to retain the default behavior, make sure to
+> include these flags in your custom `buildkitd-flags` value.
+
+> [!NOTE]
+> `buildkitd-config` and `buildkitd-config-inline` are mutually exclusive.
 
 ### outputs
 

__tests__/context.test.ts

@@ -1,7 +1,6 @@
 import {beforeEach, describe, expect, jest, test} from '@jest/globals';
 import * as fs from 'fs';
 import * as path from 'path';
-import * as uuid from 'uuid';
 import {Buildx} from '@docker/actions-toolkit/lib/buildx/buildx';
 import {Context} from '@docker/actions-toolkit/lib/context';
 import {Docker} from '@docker/actions-toolkit/lib/docker/docker';
@@ -26,8 +25,12 @@ jest.spyOn(Context, 'tmpName').mockImplementation((): string => {
   return tmpName;
 });
 
-jest.mock('uuid');
+jest.mock('crypto', () => {
-jest.spyOn(uuid, 'v4').mockReturnValue('9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d');
+  return {
+    ...(jest.requireActual('crypto') as object),
+    randomUUID: jest.fn(() => '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d')
+  };
+});
 
 jest.spyOn(Docker, 'context').mockImplementation((): Promise<string> => {
   return Promise.resolve('default');
@@ -53,6 +56,7 @@ describe('getCreateArgs', () => {
         ['use', 'true'],
         ['cache-binary', 'true'],
         ['cleanup', 'true'],
+        ['keep-state', 'false']
       ]),
       [
         'create',
@@ -71,6 +75,7 @@ describe('getCreateArgs', () => {
         ['use', 'true'],
         ['cache-binary', 'true'],
         ['cleanup', 'true'],
+        ['keep-state', 'false']
       ]),
       [
         'create',
@@ -89,6 +94,7 @@ describe('getCreateArgs', () => {
         ['driver-opts', 'image=moby/buildkit:master\nnetwork=host'],
         ['cache-binary', 'true'],
         ['cleanup', 'true'],
+        ['keep-state', 'false']
       ]),
       [
         'create',
@@ -109,6 +115,7 @@ describe('getCreateArgs', () => {
         ['use', 'true'],
         ['cache-binary', 'true'],
         ['cleanup', 'true'],
+        ['keep-state', 'false']
       ]),
       [
         'create',
@@ -129,6 +136,7 @@ describe('getCreateArgs', () => {
         ['use', 'true'],
         ['cache-binary', 'true'],
         ['cleanup', 'true'],
+        ['keep-state', 'false']
       ]),
       [
         'create',
@@ -148,6 +156,7 @@ describe('getCreateArgs', () => {
         ['driver-opts', `"env.no_proxy=localhost,127.0.0.1,.mydomain"`],
         ['cache-binary', 'true'],
         ['cleanup', 'true'],
+        ['keep-state', 'false'],
       ]),
       [
         'create',
@@ -166,6 +175,7 @@ describe('getCreateArgs', () => {
         ['platforms', 'linux/amd64\n"linux/arm64,linux/arm/v7"'],
         ['cache-binary', 'true'],
         ['cleanup', 'true'],
+        ['keep-state', 'false'],
       ]),
       [
         'create',
@@ -184,6 +194,7 @@ describe('getCreateArgs', () => {
         ['driver', 'unknown'],
         ['cache-binary', 'true'],
         ['cleanup', 'true'],
+        ['keep-state', 'false'],
       ]),
       [
         'create',
@@ -200,6 +211,7 @@ describe('getCreateArgs', () => {
         ['buildkitd-config', path.join(fixturesDir, 'buildkitd.toml')],
         ['cache-binary', 'true'],
         ['cleanup', 'true'],
+        ['keep-state', 'false'],
       ]),
       [
         'create',
@@ -218,6 +230,7 @@ describe('getCreateArgs', () => {
         ['buildkitd-config-inline', 'debug = true'],
         ['cache-binary', 'true'],
         ['cleanup', 'true'],
+        ['keep-state', 'false'],
       ]),
       [
         'create',
@@ -226,7 +239,64 @@ describe('getCreateArgs', () => {
         '--buildkitd-flags', '--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host',
         '--config', tmpName,
       ]
+    ],
+    [
+      10,
+      'v0.10.3',
+      new Map<string, string>([
+        ['install', 'false'],
+        ['use', 'false'],
+        ['driver', 'cloud'],
+        ['buildkitd-flags', '--allow-insecure-entitlement network.host'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true'],
+        ['keep-state', 'false'],
+      ]),
+      [
+        'create',
+        '--name', 'builder-9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d',
+        '--driver', 'cloud',
+        '--buildkitd-flags', '--allow-insecure-entitlement network.host',
       ]
+    ],
+    [
+      11,
+      'v0.10.3',
+      new Map<string, string>([
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cleanup', 'true'],
+        ['cache-binary', 'true'],
+        ['keep-state', 'false'],
+        ['name', 'test-builder-name'],
+      ]),
+      [
+        'create',
+        '--name', 'test-builder-name',
+        '--driver', 'docker-container',
+        '--buildkitd-flags', '--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host',
+        '--use'
+      ]
+    ],
+    [
+      12,
+      'v0.10.3',
+      new Map<string, string>([
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cleanup', 'true'],
+        ['cache-binary', 'true'],
+        ['keep-state', 'true'],
+        ['name', 'test-builder-name'],
+      ]),
+      [
+        'create',
+        '--name', 'test-builder-name',
+        '--driver', 'docker-container',
+        '--buildkitd-flags', '--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host',
+        '--use',
+      ]
+    ],
   ])(
     '[%d] given buildx %s and %p as inputs, returns %p',
     async (num: number, buildxVersion: string, inputs: Map<string, string>, expected: Array<string>) => {
@@ -264,6 +334,7 @@ describe('getAppendArgs', () => {
         ['use', 'true'],
         ['cache-binary', 'true'],
         ['cleanup', 'true'],
+        ['keep-state', 'false']
       ]),
       {
         "name": "aws_graviton2",
@@ -302,6 +373,149 @@ describe('getAppendArgs', () => {
   );
 });
 
+describe('getVersion', () => {
+  beforeEach(() => {
+    process.env = Object.keys(process.env).reduce((object, key) => {
+      if (!key.startsWith('INPUT_')) {
+        object[key] = process.env[key];
+      }
+      return object;
+    }, {});
+  });
+
+  // prettier-ignore
+  test.each([
+    [
+      0,
+      new Map<string, string>([
+        // defaults
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true'],
+        ['keep-state', 'false']
+      ]),
+      ''
+    ],
+    [
+      1,
+      new Map<string, string>([
+        ['version', 'latest'],
+        // defaults
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true'],
+        ['keep-state', 'false']
+      ]),
+      'latest'
+    ],
+    [
+      2,
+      new Map<string, string>([
+        ['version', 'edge'],
+        // defaults
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true'],
+        ['keep-state', 'false']
+      ]),
+      'edge'
+    ],
+    [
+      3,
+      new Map<string, string>([
+        ['version', 'v0.19.2'],
+        // defaults
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true'],
+        ['keep-state', 'false']
+      ]),
+      'v0.19.2'
+    ],
+    [
+      4,
+      new Map<string, string>([
+        ['version', 'latest'],
+        ['driver', 'cloud'],
+        // defaults
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true'],
+        ['keep-state', 'false']
+      ]),
+      'cloud:latest'
+    ],
+    [
+      5,
+      new Map<string, string>([
+        ['version', 'edge'],
+        ['driver', 'cloud'],
+        // defaults
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true'],
+        ['keep-state', 'false']
+      ]),
+      'cloud:edge'
+    ],
+    [
+      6,
+      new Map<string, string>([
+        ['driver', 'cloud'],
+        // defaults
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true'],
+        ['keep-state', 'false']
+      ]),
+      'cloud:latest'
+    ],
+    [
+      7,
+      new Map<string, string>([
+        ['version', 'cloud:v0.11.2-desktop.2'],
+        ['driver', 'cloud'],
+        // defaults
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true'],
+        ['keep-state', 'false']
+      ]),
+      'cloud:v0.11.2-desktop.2'
+    ],
+    [
+      8,
+      new Map<string, string>([
+        ['version', 'cloud:v0.11.2-desktop.2'],
+        // defaults
+        ['install', 'false'],
+        ['use', 'true'],
+        ['cache-binary', 'true'],
+        ['cleanup', 'true'],
+        ['keep-state', 'false']
+      ]),
+      'cloud:v0.11.2-desktop.2'
+    ],
+  ])(
+    '[%d] given %p as inputs, returns version %p',
+    async (num: number, inputs: Map<string, string>, expected: string) => {
+      inputs.forEach((value: string, name: string) => {
+        setInput(name, value);
+      });
+      const inp = await context.getInputs();
+      expect(context.getVersion(inp)).toEqual(expected);
+    }
+  );
+});
+
 // See: https://github.com/actions/toolkit/blob/master/packages/core/src/core.ts#L67
 function getInputName(name: string): string {
   return `INPUT_${name.replace(/ /g, '_').toUpperCase()}`;

action.yml

@@ -19,7 +19,6 @@ inputs:
     required: false
   buildkitd-flags:
     description: 'BuildKit daemon flags'
-    default: '--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host'
     required: false
   buildkitd-config:
     description: 'BuildKit daemon config file'
@@ -35,6 +34,9 @@ inputs:
     description: 'Switch to this builder instance'
     default: 'true'
     required: false
+  name:
+    description: 'Name of the builder. If not specified, one will be generated or if it already exists, it will be used instead of creating a new one.'
+    required: false
   endpoint:
     description: 'Optional address for docker socket or context from `docker context ls`'
     required: false
@@ -44,6 +46,10 @@ inputs:
   append:
     description: 'Append additional nodes to the builder'
     required: false
+  keep-state:
+    description: 'Keep BuildKit state on cleanup. This is only useful on persistent self-hosted runners.'
+    default: 'false'
+    required: false
   cache-binary:
     description: 'Cache buildx binary to GitHub Actions cache backend'
     default: 'true'
@@ -52,7 +58,7 @@ inputs:
     description: 'Cleanup temp files and remove builder at the end of a job'
     default: 'true'
     required: false
-  # deprecated inputs
+  # TODO: remove deprecated config and config-inline inputs
   config:
     description: 'BuildKit daemon config file'
     deprecationMessage: 'Use buildkitd-config instead'

dist/licenses.txt

@@ -2358,9 +2358,6 @@ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
 IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 
-dot-object
-MIT
-
 encoding
 MIT
 Copyright (c) 2012-2014 Andris Reinman
@@ -3636,9 +3633,6 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 
 
-twirp-ts
-MIT
-
 undici
 MIT
 MIT License

docker-bake.hcl

@@ -1,3 +1,9 @@
+target "_common" {
+  args = {
+    BUILDKIT_CONTEXT_KEEP_GIT_DIR = 1
+  }
+}
+
 group "default" {
   targets = ["build"]
 }
@@ -11,42 +17,49 @@ group "validate" {
 }
 
 target "build" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "build-update"
   output = ["."]
 }
 
 target "build-validate" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "build-validate"
   output = ["type=cacheonly"]
 }
 
 target "format" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "format-update"
   output = ["."]
 }
 
 target "lint" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "lint"
   output = ["type=cacheonly"]
 }
 
 target "vendor" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "vendor-update"
   output = ["."]
 }
 
 target "vendor-validate" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "vendor-validate"
   output = ["type=cacheonly"]
 }
 
 target "test" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "test-coverage"
   output = ["./coverage"]

package.json

@@ -23,28 +23,27 @@
   ],
   "author": "Docker Inc.",
   "license": "Apache-2.0",
-  "packageManager": "yarn@3.6.3",
+  "packageManager": "yarn@4.9.2",
   "dependencies": {
-    "@actions/core": "^1.10.1",
+    "@actions/core": "^1.11.1",
-    "@docker/actions-toolkit": "^0.35.0",
+    "@docker/actions-toolkit": "^0.63.0",
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^4.1.0"
-    "uuid": "^10.0.0"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^20.12.12",
+    "@types/node": "^20.19.9",
     "@types/uuid": "^10.0.0",
-    "@typescript-eslint/eslint-plugin": "^7.9.0",
+    "@typescript-eslint/eslint-plugin": "^7.18.0",
-    "@typescript-eslint/parser": "^7.9.0",
+    "@typescript-eslint/parser": "^7.18.0",
-    "@vercel/ncc": "^0.38.1",
+    "@vercel/ncc": "^0.38.3",
-    "eslint": "^8.57.0",
+    "eslint": "^8.57.1",
-    "eslint-config-prettier": "^9.1.0",
+    "eslint-config-prettier": "^9.1.2",
-    "eslint-plugin-jest": "^28.5.0",
+    "eslint-plugin-jest": "^28.14.0",
-    "eslint-plugin-prettier": "^5.1.3",
+    "eslint-plugin-prettier": "^5.5.4",
     "jest": "^29.7.0",
-    "prettier": "^3.2.5",
+    "prettier": "^3.6.2",
-    "ts-jest": "^29.1.2",
+    "ts-jest": "^29.4.1",
     "ts-node": "^10.9.2",
-    "typescript": "^5.4.5"
+    "typescript": "^5.9.2"
   }
 }

src/context.ts

@@ -1,4 +1,4 @@
-import * as uuid from 'uuid';
+import * as crypto from 'crypto';
 import * as core from '@actions/core';
 
 import {Docker} from '@docker/actions-toolkit/lib/docker/docker';
@@ -8,6 +8,7 @@ import {Toolkit} from '@docker/actions-toolkit/lib/toolkit';
 import {Node} from '@docker/actions-toolkit/lib/types/buildx/builder';
 
 export const builderNodeEnvPrefix = 'BUILDER_NODE';
+const defaultBuildkitdFlags = '--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host';
 
 export interface Inputs {
   version: string;
@@ -24,15 +25,16 @@ export interface Inputs {
   append: string;
   cacheBinary: boolean;
   cleanup: boolean;
+  keepState: boolean;
 }
 
 export async function getInputs(): Promise<Inputs> {
   return {
     version: core.getInput('version'),
-    name: await getBuilderName(core.getInput('driver') || 'docker-container'),
+    name: await getBuilderName(core.getInput('name'), core.getInput('driver') || 'docker-container'),
     driver: core.getInput('driver') || 'docker-container',
     driverOpts: Util.getInputList('driver-opts', {ignoreComma: true, quote: false}),
-    buildkitdFlags: core.getInput('buildkitd-flags') || '--allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host',
+    buildkitdFlags: core.getInput('buildkitd-flags'),
     platforms: Util.getInputList('platforms'),
     install: core.getBooleanInput('install'),
     use: core.getBooleanInput('use'),
@@ -40,23 +42,26 @@ export async function getInputs(): Promise<Inputs> {
     buildkitdConfig: core.getInput('buildkitd-config') || core.getInput('config'),
     buildkitdConfigInline: core.getInput('buildkitd-config-inline') || core.getInput('config-inline'),
     append: core.getInput('append'),
+    keepState: core.getBooleanInput('keep-state'),
     cacheBinary: core.getBooleanInput('cache-binary'),
     cleanup: core.getBooleanInput('cleanup')
   };
 }
 
-export async function getBuilderName(driver: string): Promise<string> {
+export async function getBuilderName(name: string, driver: string): Promise<string> {
-  return driver == 'docker' ? await Docker.context() : `builder-${uuid.v4()}`;
+  return driver == 'docker' ? await Docker.context() : name || `builder-${crypto.randomUUID()}`;
 }
 
 export async function getCreateArgs(inputs: Inputs, toolkit: Toolkit): Promise<Array<string>> {
   const args: Array<string> = ['create', '--name', inputs.name, '--driver', inputs.driver];
   if (await toolkit.buildx.versionSatisfies('>=0.3.0')) {
-    await Util.asyncForEach(inputs.driverOpts, async driverOpt => {
+    await Util.asyncForEach(inputs.driverOpts, async (driverOpt: string) => {
       args.push('--driver-opt', driverOpt);
     });
-    if (driverSupportsFlags(inputs.driver) && inputs.buildkitdFlags) {
+    if (inputs.buildkitdFlags) {
       args.push('--buildkitd-flags', inputs.buildkitdFlags);
+    } else if (driverSupportsBuildkitdFlags(inputs.driver)) {
+      args.push('--buildkitd-flags', defaultBuildkitdFlags);
     }
   }
   if (inputs.platforms.length > 0) {
@@ -65,13 +70,11 @@ export async function getCreateArgs(inputs: Inputs, toolkit: Toolkit): Promise<A
   if (inputs.use) {
     args.push('--use');
   }
-  if (driverSupportsFlags(inputs.driver)) {
   if (inputs.buildkitdConfig) {
     args.push('--config', toolkit.buildkit.config.resolveFromFile(inputs.buildkitdConfig));
   } else if (inputs.buildkitdConfigInline) {
     args.push('--config', toolkit.buildkit.config.resolveFromString(inputs.buildkitdConfigInline));
   }
-  }
   if (inputs.endpoint) {
     args.push(inputs.endpoint);
   }
@@ -83,14 +86,16 @@ export async function getAppendArgs(inputs: Inputs, node: Node, toolkit: Toolkit
   if (node.name) {
     args.push('--node', node.name);
   } else if (inputs.driver == 'kubernetes' && (await toolkit.buildx.versionSatisfies('<0.11.0'))) {
-    args.push('--node', `node-${uuid.v4()}`);
+    args.push('--node', `node-${crypto.randomUUID()}`);
   }
   if (node['driver-opts'] && (await toolkit.buildx.versionSatisfies('>=0.3.0'))) {
-    await Util.asyncForEach(node['driver-opts'], async driverOpt => {
+    await Util.asyncForEach(node['driver-opts'], async (driverOpt: string) => {
       args.push('--driver-opt', driverOpt);
     });
-    if (driverSupportsFlags(inputs.driver) && node['buildkitd-flags']) {
+    if (node['buildkitd-flags']) {
       args.push('--buildkitd-flags', node['buildkitd-flags']);
+    } else if (driverSupportsBuildkitdFlags(inputs.driver)) {
+      args.push('--buildkitd-flags', defaultBuildkitdFlags);
     }
   }
   if (node.platforms) {
@@ -110,6 +115,20 @@ export async function getInspectArgs(inputs: Inputs, toolkit: Toolkit): Promise<
   return args;
 }
 
-function driverSupportsFlags(driver: string): boolean {
+function driverSupportsBuildkitdFlags(driver: string): boolean {
   return driver == '' || driver == 'docker-container' || driver == 'docker' || driver == 'kubernetes';
 }
+
+export function getVersion(inputs: Inputs): string {
+  const version = inputs.version;
+  if (inputs.driver === 'cloud') {
+    if (!version || version === 'latest') {
+      return 'cloud:latest';
+    }
+    if (version.startsWith('cloud:') || version.startsWith('lab:')) {
+      return version;
+    }
+    return `cloud:${version}`;
+  }
+  return version;
+}

src/main.ts

@@ -1,3 +1,4 @@
+import * as crypto from 'crypto';
 import * as fs from 'fs';
 import * as yaml from 'js-yaml';
 import * as core from '@actions/core';
@@ -11,6 +12,7 @@ import {Toolkit} from '@docker/actions-toolkit/lib/toolkit';
 import {Util} from '@docker/actions-toolkit/lib/util';
 
 import {Node} from '@docker/actions-toolkit/lib/types/buildx/builder';
+import {ContextInfo} from '@docker/actions-toolkit/lib/types/docker/docker';
 
 import * as context from './context';
 import * as stateHelper from './state-helper';
@@ -20,11 +22,18 @@ actionsToolkit.run(
   async () => {
     const inputs: context.Inputs = await context.getInputs();
     stateHelper.setCleanup(inputs.cleanup);
+    const version = context.getVersion(inputs);
 
     const toolkit = new Toolkit();
     const standalone = await toolkit.buildx.isStandalone();
     stateHelper.setStandalone(standalone);
 
+    if (inputs.keepState && inputs.driver !== 'docker-container') {
+      // https://docs.docker.com/reference/cli/docker/buildx/rm/#keep-state
+      throw new Error(`Cannot use keep-state with ${inputs.driver} driver`);
+    }
+    stateHelper.setKeepState(inputs.keepState);
+
     await core.group(`Docker info`, async () => {
       try {
         await Docker.printVersion();
@@ -35,16 +44,16 @@ actionsToolkit.run(
     });
 
     let toolPath;
-    if (Util.isValidRef(inputs.version)) {
+    if (Util.isValidRef(version)) {
       if (standalone) {
         throw new Error(`Cannot build from source without the Docker CLI`);
       }
       await core.group(`Build buildx from source`, async () => {
-        toolPath = await toolkit.buildxInstall.build(inputs.version, !inputs.cacheBinary);
+        toolPath = await toolkit.buildxInstall.build(version, !inputs.cacheBinary);
       });
-    } else if (!(await toolkit.buildx.isAvailable()) || inputs.version) {
+    } else if (!(await toolkit.buildx.isAvailable()) || version) {
       await core.group(`Download buildx from GitHub Releases`, async () => {
-        toolPath = await toolkit.buildxInstall.download(inputs.version || 'latest', !inputs.cacheBinary);
+        toolPath = await toolkit.buildxInstall.download(version || 'latest', !inputs.cacheBinary);
       });
     }
     if (toolPath) {
@@ -68,8 +77,56 @@ actionsToolkit.run(
     fs.mkdirSync(Buildx.certsDir, {recursive: true});
     stateHelper.setCertsDir(Buildx.certsDir);
 
+    // if the default context has TLS data loaded and endpoint is not set, then
+    // we create a temporary docker context only if driver is docker-container
+    // https://github.com/docker/buildx/blob/b96ad59f64d40873e4959336d294b648bb3937fe/builder/builder.go#L489
+    // https://github.com/docker/setup-buildx-action/issues/105
+    if (!standalone && inputs.driver == 'docker-container' && (await Docker.context()) == 'default' && inputs.endpoint.length == 0) {
+      let defaultContextWithTLS: boolean = false;
+      await core.group(`Inspecting default docker context`, async () => {
+        await Docker.getExecOutput(['context', 'inspect', '--format=json', 'default'], {
+          ignoreReturnCode: true,
+          silent: true
+        }).then(res => {
+          if (res.stderr.length > 0 && res.exitCode != 0) {
+            core.info(`Cannot inspect default docker context: ${res.stderr.trim()}`);
+          } else {
+            try {
+              const contextInfo = (<Array<ContextInfo>>JSON.parse(res.stdout.trim()))[0];
+              core.info(JSON.stringify(JSON.parse(res.stdout.trim()), undefined, 2));
+              const hasTLSData = Object.keys(contextInfo.Endpoints).length > 0 && Object.values(contextInfo.Endpoints)[0].TLSData !== undefined;
+              const hasTLSMaterial = Object.keys(contextInfo.TLSMaterial).length > 0 && Object.values(contextInfo.TLSMaterial)[0].length > 0;
+              defaultContextWithTLS = hasTLSData || hasTLSMaterial;
+            } catch (e) {
+              core.info(`Unable to parse default docker context info: ${e}`);
+              core.info(res.stdout.trim());
+            }
+          }
+        });
+      });
+      if (defaultContextWithTLS) {
+        const tmpDockerContext = `buildx-${crypto.randomUUID()}`;
+        await core.group(`Creating temp docker context (TLS data loaded in default one)`, async () => {
+          await Docker.getExecOutput(['context', 'create', tmpDockerContext], {
+            ignoreReturnCode: true
+          }).then(res => {
+            if (res.stderr.length > 0 && res.exitCode != 0) {
+              core.warning(`Cannot create docker context ${tmpDockerContext}: ${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
+            } else {
+              core.info(`Setting builder endpoint to ${tmpDockerContext} context`);
+              inputs.endpoint = tmpDockerContext;
+              stateHelper.setTmpDockerContext(tmpDockerContext);
+            }
+          });
+        });
+      }
+    }
+
     if (inputs.driver !== 'docker') {
       await core.group(`Creating a new builder instance`, async () => {
+        if (await toolkit.builder.exists(inputs.name)) {
+          core.info(`Builder ${inputs.name} already exists, skipping creation`);
+        } else {
           const certsDriverOpts = Buildx.resolveCertsDriverOpts(inputs.driver, inputs.endpoint, {
             cacert: process.env[`${context.builderNodeEnvPrefix}_0_AUTH_TLS_CACERT`],
             cert: process.env[`${context.builderNodeEnvPrefix}_0_AUTH_TLS_CERT`],
@@ -86,6 +143,7 @@ actionsToolkit.run(
               throw new Error(res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error');
             }
           });
+        }
       });
     }
 
@@ -131,6 +189,7 @@ actionsToolkit.run(
         throw new Error(`Cannot set buildx as default builder without the Docker CLI`);
       }
       await core.group(`Setting buildx as default builder`, async () => {
+        stateHelper.setBuildxIsDefaultBuilder(true);
         const installCmd = await toolkit.buildx.getCommand(['install']);
         await Exec.getExecOutput(installCmd.command, installCmd.args, {
           ignoreReturnCode: true
@@ -200,7 +259,7 @@ actionsToolkit.run(
         const buildx = new Buildx({standalone: stateHelper.standalone});
         const builder = new Builder({buildx: buildx});
         if (await builder.exists(stateHelper.builderName)) {
-          const rmCmd = await buildx.getCommand(['rm', stateHelper.builderName]);
+          const rmCmd = await buildx.getCommand(['rm', stateHelper.builderName, ...(stateHelper.keepState ? ['--keep-state'] : [])]);
           await Exec.getExecOutput(rmCmd.command, rmCmd.args, {
             ignoreReturnCode: true
           }).then(res => {
@@ -214,10 +273,34 @@ actionsToolkit.run(
       });
     }
 
+    if (stateHelper.tmpDockerContext) {
+      await core.group(`Removing temp docker context`, async () => {
+        await Exec.getExecOutput('docker', ['context', 'rm', '-f', stateHelper.tmpDockerContext], {
+          ignoreReturnCode: true
+        }).then(res => {
+          if (res.stderr.length > 0 && res.exitCode != 0) {
+            core.warning(`${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
+          }
+        });
+      });
+    }
+
     if (stateHelper.certsDir.length > 0 && fs.existsSync(stateHelper.certsDir)) {
       await core.group(`Cleaning up certificates`, async () => {
         fs.rmSync(stateHelper.certsDir, {recursive: true});
       });
     }
+
+    if (stateHelper.buildxIsDefaultBuilder) {
+      await core.group(`Restoring default builder`, async () => {
+        await Exec.getExecOutput('docker', ['buildx', 'uninstall'], {
+          ignoreReturnCode: true
+        }).then(res => {
+          if (res.stderr.length > 0 && res.exitCode != 0) {
+            core.warning(`${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
+          }
+        });
+      });
+    }
   }
 );

src/state-helper.ts

@@ -6,7 +6,10 @@ export const builderName = process.env['STATE_builderName'] || '';
 export const builderDriver = process.env['STATE_builderDriver'] || '';
 export const containerName = process.env['STATE_containerName'] || '';
 export const certsDir = process.env['STATE_certsDir'] || '';
+export const tmpDockerContext = process.env['STATE_tmpDockerContext'] || '';
 export const cleanup = /true/i.test(process.env['STATE_cleanup'] || '');
+export const buildxIsDefaultBuilder = /true/i.test(process.env['STATE_buildxIsDefaultBuilder'] || '');
+export const keepState = /true/i.test(process.env['STATE_keepState'] || '');
 
 export function setDebug(debug: string) {
   core.saveState('isDebug', debug);
@@ -32,6 +35,18 @@ export function setCertsDir(certsDir: string) {
   core.saveState('certsDir', certsDir);
 }
 
+export function setTmpDockerContext(tmpDockerContext: string) {
+  core.saveState('tmpDockerContext', tmpDockerContext);
+}
+
 export function setCleanup(cleanup: boolean) {
   core.saveState('cleanup', cleanup);
 }
+
+export function setBuildxIsDefaultBuilder(buildxIsDefaultBuilder: boolean) {
+  core.saveState('buildxIsDefaultBuilder', buildxIsDefaultBuilder);
+}
+
+export function setKeepState(keepState: boolean) {
+  core.saveState('keepState', keepState);
+}