bake.yml

name: bake

on:
  workflow_call:
    inputs:
      context:
        type: string
        description: "Context to build from (defaults to repository root)"
        required: false
        default: .
      target:
        type: string
        description: "Target to build"
        required: true
        default: default
      output:
        type: string
        description: "Build output destination (image or local)"
        required: true
      artifact-name:
        type: string
        description: "Name of the uploaded artifact (for local output)"
        required: false
        default: 'docker-github-builder-assets'
      envs:
        type: string
        description: "Environment variables to set"
        required: false
      push:
        type: boolean
        description: "Push image to the registry (for image output) and/or sign attestation manifests or local artifacts"
        required: false
        default: false
      cache:
        type: boolean
        description: "Enable cache to GitHub Actions cache backend"
        required: false
        default: false
      cache-scope:
        type: string
        description: "Which scope cache object belongs to if cache enabled (defaults to target name)"
        required: false
      cache-mode:
        type: string
        description: "Cache layers to export if cache enabled (min or max)"
        required: false
        default: 'min'
      set-meta-annotations:
        type: boolean
        description: "Set metadata-action annotations"
        required: false
        default: false
      set-meta-labels:
        type: boolean
        description: "Set metadata-action labels"
        required: false
        default: false
      setup-qemu:
        type: boolean
        description: "Install QEMU static binaries"
        required: false
        default: false
      # same as docker/metadata-action inputs (minus sep-tags, sep-labels, sep-annotations, bake-target)
      meta-images:
        type: string
        description: "List of images to use as base name for tags"
        required: false
      meta-tags:
        type: string
        description: "List of tags as key-value pair attributes"
        required: false
      meta-flavor:
        type: string
        description: "Flavors to apply"
        required: false
      meta-labels:
        type: string
        description: "List of custom labels"
        required: false
      meta-annotations:
        type: string
        description: "List of custom annotations"
        required: false
      meta-bake-target:
        type: string
        description: "Bake target name for metadata (defaults to docker-metadata-action)"
        required: false
      # same as docker/setup-qemu-action inputs (minus platforms, cache-image)
      qemu-image:
        type: string
        description: "QEMU static binaries Docker image (e.g. tonistiigi/binfmt:latest)"
        required: false
      # same as docker/bake-action inputs
      bake-allow:
        type: string
        description: "Allow build to access specified resources (e.g., network.host)"
        required: false
      bake-files:
        type: string
        description: "List of bake definition files (defaults to docker-bake.hcl)"
        required: false
      bake-pull:
        type: boolean
        description: "Always attempt to pull all referenced images"
        required: false
        default: false
      bake-sbom:
        type: string
        description: "SBOM is a shorthand for --set=*.attest=type=sbom"
        required: false
      bake-set:
        type: string
        description: "List of targets values to override (eg. targetpattern.key=value)"
        required: false
    secrets:
      registry-auths:
        description: "Registry authentication details as YAML objects"
        required: false
      github-token:
        description: "GitHub Token used to authenticate against a repository for Git context"
        required: false
    outputs:
      cosign-version:
        description: Cosign version used for verification
        value: ${{ jobs.finalize.outputs.cosign-version }}
      cosign-verify-commands:
        description: Cosign verify commands
        value: ${{ jobs.finalize.outputs.cosign-verify-commands }}
      artifact-name:
        description: Name of the uploaded artifact (for local output)
        value: ${{ jobs.finalize.outputs.artifact-name }}
      output-type:
        description: Build output type
        value: ${{ jobs.finalize.outputs.output-type }}

env:
  DOCKER_ACTIONS_TOOLKIT_MODULE: "@docker/actions-toolkit@0.67.0"
  COSIGN_VERSION: "v3.0.2"
  LOCAL_EXPORT_DIR: "/tmp/buildx-output"
  MATRIX_SIZE_LIMIT: "20"

jobs:
  prepare:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    outputs:
      includes: ${{ steps.set.outputs.includes }}
    steps:
      -
        name: Environment variables
        uses: actions/github-script@v8
        env:
          INPUT_ENVS: ${{ inputs.envs }}
        with:
          script: |
            for (const env of core.getMultilineInput('envs')) {
              core.info(env);
              const [key, value] = env.split('=', 2);
              core.exportVariable(key, value);
            }
      -
        name: Install @docker/actions-toolkit
        uses: actions/github-script@v8
        env:
          INPUT_DAT-MODULE: ${{ env.DOCKER_ACTIONS_TOOLKIT_MODULE }}
        with:
          script: |
            await exec.exec('npm', ['install', '--prefer-offline', '--no-audit', core.getInput('dat-module')]);
      -
        name: Set includes
        id: set
        uses: actions/github-script@v8
        env:
          INPUT_MATRIX-SIZE-LIMIT: ${{ env.MATRIX_SIZE_LIMIT }}
          INPUT_CONTEXT: ${{ inputs.context }}
          INPUT_TARGET: ${{ inputs.target }}
          INPUT_BAKE-ALLOW: ${{ inputs.bake-allow }}
          INPUT_BAKE-FILES: ${{ inputs.bake-files }}
          INPUT_BAKE-PULL: ${{ inputs.bake-pull }}
          INPUT_BAKE-SBOM: ${{ inputs.bake-sbom }}
          INPUT_BAKE-SET: ${{ inputs.bake-set }}
          INPUT_GITHUB-TOKEN: ${{ secrets.github-token || github.token }}
        with:
          script: |
            const os = require('os');
            const { Bake } = require('@docker/actions-toolkit/lib/buildx/bake');
            const { Util } = require('@docker/actions-toolkit/lib/util');

            const inpMatrixSizeLimit = parseInt(core.getInput('matrix-size-limit'), 10);
            
            const inpContext = core.getInput('context');
            const inpTarget = core.getInput('target');
            const inpBakeAllow = core.getInput('bake-allow');
            const inpBakeFiles = Util.getInputList('bake-files');
            const inpBakePull = core.getBooleanInput('bake-pull');
            const inpBakeSbom = core.getInput('bake-sbom');
            const inpBakeSet = Util.getInputList('bake-set', {ignoreComma: true, quote: false});
            const inpGitHubToken = core.getInput('github-token');

            const bakeSource = `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}.git#${process.env.GITHUB_REF}:${inpContext}`;
            await core.group(`Set bake source`, async () => {
              core.info(bakeSource);
            });

            let def;
            let target;
            await core.group(`Validating definition`, async () => {
              const bake = new Bake();
              def = await bake.getDefinition({
                allow: inpBakeAllow,
                files: inpBakeFiles,
                overrides: inpBakeSet,
                sbom: inpBakeSbom,
                source: bakeSource,
                targets: [inpTarget],
                githubToken: inpGitHubToken
              });
              if (!def) {
                throw new Error('Bake definition not set');
              }
              const targets = Object.keys(def.target);
              if (targets.length > 1) {
                throw new Error(`Only one target can be built at once, found: ${targets.join(', ')}`);
              }
              target = targets[0];
            });

            await core.group(`Set includes`, async () => {
              let includes = [];
              const platforms = def.target[target].platforms || [];
              if (platforms.length > inpMatrixSizeLimit) {
                throw new Error(`Platforms to build exceed matrix size limit of ${inpMatrixSizeLimit}`);
              } else if (platforms.length === 0) {
                includes.push({
                  index: 0,
                  runner: 'ubuntu-24.04'
                });
              } else {
                platforms.forEach((platform, index) => {
                  includes.push({
                    index: index,
                    platform: platform,
                    runner: platform.startsWith('linux/arm') ? 'ubuntu-24.04-arm' : 'ubuntu-24.04'
                  });
                });
              }
              core.info(JSON.stringify(includes, null, 2));
              core.setOutput('includes', JSON.stringify(includes));
            });

  build:
    runs-on: ${{ matrix.runner }}
    needs:
      - prepare
    permissions:
      contents: read
      id-token: write # for signing attestation manifests and/or registry authentication with GitHub OIDC Token
      packages: write # for pushing manifests to GHCR if needed
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJson(needs.prepare.outputs.includes) }}
    outputs:
      # needs predefined outputs as we can't use dynamic ones atm: https://github.com/actions/runner/pull/2477
      # 20 is the maximum number of platforms supported by our matrix strategy
      result_0: ${{ steps.result.outputs.result_0 }}
      result_1: ${{ steps.result.outputs.result_1 }}
      result_2: ${{ steps.result.outputs.result_2 }}
      result_3: ${{ steps.result.outputs.result_3 }}
      result_4: ${{ steps.result.outputs.result_4 }}
      result_5: ${{ steps.result.outputs.result_5 }}
      result_6: ${{ steps.result.outputs.result_6 }}
      result_7: ${{ steps.result.outputs.result_7 }}
      result_8: ${{ steps.result.outputs.result_8 }}
      result_9: ${{ steps.result.outputs.result_9 }}
      result_10: ${{ steps.result.outputs.result_10 }}
      result_11: ${{ steps.result.outputs.result_11 }}
      result_12: ${{ steps.result.outputs.result_12 }}
      result_13: ${{ steps.result.outputs.result_13 }}
      result_14: ${{ steps.result.outputs.result_14 }}
      result_15: ${{ steps.result.outputs.result_15 }}
      result_16: ${{ steps.result.outputs.result_16 }}
      result_17: ${{ steps.result.outputs.result_17 }}
      result_18: ${{ steps.result.outputs.result_18 }}
      result_19: ${{ steps.result.outputs.result_19 }}
    steps:
      -
        name: Environment variables
        uses: actions/github-script@v8
        env:
          INPUT_ENVS: ${{ inputs.envs }}
        with:
          script: |
            for (const env of core.getMultilineInput('envs')) {
              core.info(env);
              const [key, value] = env.split('=', 2);
              core.exportVariable(key, value);
            }
      -
        name: Install @docker/actions-toolkit
        uses: actions/github-script@v8
        env:
          INPUT_DAT-MODULE: ${{ env.DOCKER_ACTIONS_TOOLKIT_MODULE }}
        with:
          script: |
            await exec.exec('npm', ['install', '--prefer-offline', '--no-audit', core.getInput('dat-module')]);
      -
        name: Docker meta
        id: meta
        if: ${{ inputs.output == 'image' }}
        uses: docker/metadata-action@v5
        with:
          images: ${{ inputs.meta-images }}
          tags: ${{ inputs.meta-tags }}
          flavor: ${{ inputs.meta-flavor }}
          labels: ${{ inputs.meta-labels }}
          annotations: ${{ inputs.meta-annotations }}
          bake-target: ${{ inputs.meta-bake-target }}
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        if: ${{ inputs.setup-qemu }}
        with:
          image: ${{ inputs.qemu-image }}
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          version: latest
          buildkitd-flags: --debug
      -
        name: Prepare
        id: prepare
        uses: actions/github-script@v8
        env:
          INPUT_PLATFORM: ${{ matrix.platform }}
          INPUT_LOCAL-EXPORT-DIR: ${{ env.LOCAL_EXPORT_DIR }}
          INPUT_CONTEXT: ${{ inputs.context }}
          INPUT_TARGET: ${{ inputs.target }}
          INPUT_OUTPUT: ${{ inputs.output }}
          INPUT_PUSH: ${{ inputs.push }}
          INPUT_CACHE: ${{ inputs.cache }}
          INPUT_CACHE-SCOPE: ${{ inputs.cache-scope }}
          INPUT_CACHE-MODE: ${{ inputs.cache-mode }}
          INPUT_META-IMAGES: ${{ inputs.meta-images }}
          INPUT_SET-META-ANNOTATIONS: ${{ inputs.set-meta-annotations }}
          INPUT_SET-META-LABELS: ${{ inputs.set-meta-labels }}
          INPUT_BAKE-FILE-TAGS: ${{ steps.meta.outputs.bake-file-tags }}
          INPUT_BAKE-FILE-ANNOTATIONS: ${{ steps.meta.outputs.bake-file-annotations }}
          INPUT_BAKE-FILE-LABELS: ${{ steps.meta.outputs.bake-file-labels }}
          INPUT_BAKE-ALLOW: ${{ inputs.bake-allow }}
          INPUT_BAKE-FILES: ${{ inputs.bake-files }}
          INPUT_BAKE-PULL: ${{ inputs.bake-pull }}
          INPUT_BAKE-SBOM: ${{ inputs.bake-sbom }}
          INPUT_BAKE-SET: ${{ inputs.bake-set }}
          INPUT_GITHUB-TOKEN: ${{ secrets.github-token || github.token }}
        with:
          script: |
            const os = require('os');
            const { Bake } = require('@docker/actions-toolkit/lib/buildx/bake');
            const { Util } = require('@docker/actions-toolkit/lib/util');
            
            const inpPlatform = core.getInput('platform');
            const platformPairSuffix = inpPlatform ? `-${inpPlatform.replace(/\//g, '-')}` : '';
            core.setOutput('platform-pair-suffix', platformPairSuffix);
            
            const inpLocalExportDir = core.getInput('local-export-dir');
            
            const inpContext = core.getInput('context');
            const inpTarget = core.getInput('target');
            const inpOutput = core.getInput('output');
            const inpPush = core.getBooleanInput('push');
            const inpCache = core.getBooleanInput('cache');
            const inpCacheScope = core.getInput('cache-scope');
            const inpCacheMode = core.getInput('cache-mode');
            const inpMetaImages = core.getMultilineInput('meta-images');
            const inpSetMetaAnnotations = core.getBooleanInput('set-meta-annotations');
            const inpSetMetaLabels = core.getBooleanInput('set-meta-labels');
            const inpBakeFileTags = core.getInput('bake-file-tags');
            const inpBakeFileAnnotations = core.getInput('bake-file-annotations');
            const inpBakeFileLabels = core.getInput('bake-file-labels');
            
            const inpBakeAllow = core.getInput('bake-allow');
            const inpBakeFiles = Util.getInputList('bake-files');
            const inpBakePull = core.getBooleanInput('bake-pull');
            const inpBakeSbom = core.getInput('bake-sbom');
            const inpBakeSet = Util.getInputList('bake-set', {ignoreComma: true, quote: false});
            const inpGitHubToken = core.getInput('github-token');
            
            const bakeSource = `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}.git#${process.env.GITHUB_REF}:${inpContext}`;
            await core.group(`Set bake source`, async () => {
              core.info(bakeSource);
              core.setOutput('source', bakeSource);
            });
            
            let target;
            await core.group(`Validating definition`, async () => {
              const bake = new Bake();
              const def = await bake.getDefinition({
                allow: inpBakeAllow,
                files: inpBakeFiles,
                overrides: inpBakeSet,
                sbom: inpBakeSbom,
                source: bakeSource,
                targets: [inpTarget],
                githubToken: inpGitHubToken
              });
              if (!def) {
                throw new Error('Bake definition not set');
              }
              const targets = Object.keys(def.target);
              if (targets.length > 1) {
                throw new Error(`Only one target can be built at once, found: ${targets.join(', ')}`);
              }
              target = targets[0];
              core.setOutput('target', target);
            });
            
            let bakeFiles = inpBakeFiles;
            await core.group(`Set bake files`, async () => {
              if (bakeFiles.length === 0) {
                bakeFiles = ['docker-bake.hcl'];
              }
              if (inpBakeFileTags) {
                bakeFiles.push(`cwd://${inpBakeFileTags}`);
              }
              if (inpSetMetaAnnotations && inpBakeFileAnnotations) {
                bakeFiles.push(`cwd://${inpBakeFileAnnotations}`);
              }
              if (inpSetMetaLabels && inpBakeFileLabels) {
                bakeFiles.push(`cwd://${inpBakeFileLabels}`);
              }
              core.info(JSON.stringify(bakeFiles, null, 2));
              core.setOutput('files', bakeFiles.join(os.EOL));
            });
            
            let outputOverride = '';
            switch (inpOutput) {
              case 'image':
                if (inpMetaImages.length == 0) {
                  core.setFailed('meta-images is required when output is image');
                }
                outputOverride = `*.output=type=image,"name=${inpMetaImages.join(',')}",oci-artifact=true,push-by-digest=true,name-canonical=true,push=${inpPush}`;
                break;
              case 'local':
                outputOverride = `*.output=type=local,platform-split=true,dest=${inpLocalExportDir}`;
                break;
              default:
                core.setFailed(`Invalid output: ${inpOutput}`);
            }
            
            let bakeOverrides = [...inpBakeSet, outputOverride];
            await core.group(`Set bake overrides`, async () => {
              bakeOverrides.push('*.attest=type=provenance,mode=max,version=v1', '*.tags=');
              if (inpPlatform) {
                bakeOverrides.push(`*.platform=${inpPlatform}`);
              }
              if (inpCache) {
                bakeOverrides.push(`*.cache-from=type=gha,scope=${inpCacheScope || target}${platformPairSuffix}`);
                bakeOverrides.push(`*.cache-to=type=gha,scope=${inpCacheScope || target}${platformPairSuffix},mode=${inpCacheMode}`);
              }
              core.info(JSON.stringify(bakeOverrides, null, 2));
              core.setOutput('overrides', bakeOverrides.join(os.EOL));
            });
      -
        name: Login to registry
        if: ${{ inputs.push && inputs.output == 'image' }}
        # TODO: switch to docker/login-action when OIDC is supported
        uses: crazy-max/docker-login-action@dockerhub-oidc
        with:
          registry-auth: ${{ secrets.registry-auths }}
      -
        name: Build
        id: bake
        uses: docker/bake-action@v6
        with:
          source: ${{ steps.prepare.outputs.source }}
          files: ${{ steps.prepare.outputs.files }}
          targets: ${{ steps.prepare.outputs.target }}
          allow: ${{ inputs.bake-allow }}
          pull: ${{ inputs.bake-pull }}
          sbom: ${{ inputs.bake-sbom }}
          set: ${{ steps.prepare.outputs.overrides }}
          github-token: ${{ secrets.github-token || github.token }}
        env:
          BUILDKIT_MULTI_PLATFORM: 1
      -
        name: Get image digest
        id: get-image-digest
        if: ${{ inputs.output == 'image' }}
        uses: actions/github-script@v8
        env:
          INPUT_TARGET: ${{ steps.prepare.outputs.target }}
          INPUT_METADATA: ${{ steps.bake.outputs.metadata }}
        with:
          script: |
            const inpTarget = core.getInput('target');
            const inpMetadata = JSON.parse(core.getInput('metadata'));
            const imageDigest = inpMetadata[inpTarget]['containerimage.digest'];
            core.info(imageDigest);
            core.setOutput('digest', imageDigest);
      -
        name: Install Cosign
        if: ${{ inputs.push }}
        uses: actions/github-script@v8
        env:
          INPUT_COSIGN-VERSION: ${{ env.COSIGN_VERSION }}
        with:
          script: |
            const { Cosign } = require('@docker/actions-toolkit/lib/cosign/cosign');
            const { Install } = require('@docker/actions-toolkit/lib/cosign/install');
            
            const cosignInstall = new Install();
            const cosignBinPath = await cosignInstall.download(core.getInput('cosign-version'), false, true);
            await cosignInstall.install(cosignBinPath);
            
            const cosign = new Cosign();
            await cosign.printVersion();
      -
        name: Signing attestation manifests
        id: signing-attestation-manifests
        if: ${{ inputs.push && inputs.output == 'image' }}
        uses: actions/github-script@v8
        env:
          INPUT_IMAGE-NAMES: ${{ inputs.meta-images }}
          INPUT_IMAGE-DIGEST: ${{ steps.get-image-digest.outputs.digest }}
        with:
          script: |
            const { Sigstore } = require('@docker/actions-toolkit/lib/sigstore/sigstore');
            
            const inpImageNames = core.getMultilineInput('image-names');
            const inpImageDigest = core.getInput('image-digest');
            
            const sigstore = new Sigstore();
            const signResults = await sigstore.signAttestationManifests({
              imageNames: inpImageNames,
              imageDigest: inpImageDigest
            });
            
            const verifyResults = await sigstore.verifySignedManifests(
              { certificateIdentityRegexp: `^https://github.com/docker/github-builder-experimental/.github/workflows/bake.yml.*$` },
              signResults
            );
            
            await core.group(`Verify commands`, async () => {
              const verifyCommands = [];
              for (const [attestationRef, verifyResult] of Object.entries(verifyResults)) {
                const cmd = `cosign ${verifyResult.cosignArgs.join(' ')} ${attestationRef}`;
                core.info(cmd);
                verifyCommands.push(cmd);
              }
              core.setOutput('verify-commands', verifyCommands.join('\n'));
            });
      -
        name: Signing local artifacts
        id: signing-local-artifacts
        if: ${{ inputs.push && inputs.output == 'local' }}
        uses: actions/github-script@v8
        env:
          INPUT_LOCAL-OUTPUT-DIR: ${{ env.LOCAL_EXPORT_DIR }}
        with:
          script: |
            const path = require('path');
            const { Sigstore } = require('@docker/actions-toolkit/lib/sigstore/sigstore');
            const inplocalExportDir = core.getInput('local-output-dir');
            
            const sigstore = new Sigstore();
            const signResults = await sigstore.signProvenanceBlobs({
              localExportDir: inplocalExportDir
            });
            
            const verifyResults = await sigstore.verifySignedArtifacts(
              { certificateIdentityRegexp: `^https://github.com/docker/github-builder-experimental/.github/workflows/bake.yml.*$` },
              signResults
            );
            
            await core.group(`Verify commands`, async () => {
              const verifyCommands = [];
              for (const [artifactPath, verifyResult] of Object.entries(verifyResults)) {
                const cmd = `cosign ${verifyResult.cosignArgs.join(' ')} --bundle ${path.relative(inplocalExportDir, verifyResult.bundlePath)} ${path.relative(inplocalExportDir, artifactPath)}`;
                core.info(cmd);
                verifyCommands.push(cmd);
              }
              core.setOutput('verify-commands', verifyCommands.join('\n'));
            });
      -
        name: List local output
        if: ${{ inputs.output == 'local' }}
        run: |
          tree -nh ${{ env.LOCAL_EXPORT_DIR }}
      -
        name: Upload artifact
        if: ${{ inputs.output == 'local' }}
        uses: actions/upload-artifact@v5
        with:
          name: ${{ inputs.artifact-name }}${{ steps.prepare.outputs.platform-pair-suffix }}
          path: ${{ env.LOCAL_EXPORT_DIR }}
          if-no-files-found: error
      -
        name: Set result output
        id: result
        uses: actions/github-script@v8
        env:
          INPUT_INDEX: ${{ matrix.index }}
          INPUT_VERIFY-COMMANDS: ${{ steps.signing-attestation-manifests.outputs.verify-commands || steps.signing-local-artifacts.outputs.verify-commands }}
          INPUT_IMAGE-DIGEST: ${{ steps.get-image-digest.outputs.digest }}
          INPUT_ARTIFACT-NAME: ${{ inputs.artifact-name }}${{ steps.prepare.outputs.platform-pair-suffix }}
        with:
          script: |
            const inpIndex = core.getInput('index');
            const inpVerifyCommands = core.getInput('verify-commands');
            const inpImageDigest = core.getInput('image-digest');
            const inpArtifactName = core.getInput('artifact-name');
            
            const result = {
              verifyCommands: inpVerifyCommands,
              imageDigest: inpImageDigest,
              artifactName: inpArtifactName
            }
            core.info(JSON.stringify(result, null, 2));
            
            core.setOutput(`result_${inpIndex}`, JSON.stringify(result));

  finalize:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write # for registry authentication with OIDC if needed
      packages: write # for pushing to GHCR when merging manifests if needed
    outputs:
      cosign-version: ${{ env.COSIGN_VERSION }}
      cosign-verify-commands: ${{ steps.set.outputs.cosign-verify-commands }}
      artifact-name: ${{ inputs.artifact-name }}
      output-type: ${{ inputs.output }}
    needs:
      - build
    steps:
      -
        name: Docker meta
        id: meta
        if: ${{ inputs.output == 'image' }}
        uses: docker/metadata-action@v5
        with:
          images: ${{ inputs.meta-images }}
          tags: ${{ inputs.meta-tags }}
          flavor: ${{ inputs.meta-flavor }}
          labels: ${{ inputs.meta-labels }}
          annotations: ${{ inputs.meta-annotations }}
          bake-target: ${{ inputs.meta-bake-target }}
      -
        name: Login to registry
        if: ${{ inputs.push && inputs.output == 'image' }}
        # TODO: switch to docker/login-action when OIDC is supported
        uses: crazy-max/docker-login-action@dockerhub-oidc
        with:
          registry-auth: ${{ secrets.registry-auths }}
      -
        name: Set up Docker Buildx
        if: ${{ inputs.push && inputs.output == 'image' }}
        uses: docker/setup-buildx-action@v3
        with:
          version: latest
          buildkitd-flags: --debug
      -
        name: Create manifest
        if: ${{ inputs.push && inputs.output == 'image' }}
        uses: actions/github-script@v8
        env:
          INPUT_IMAGE-NAMES: ${{ inputs.meta-images }}
          INPUT_TAG-NAMES: ${{ steps.meta.outputs.tag-names }}
          INPUT_BUILD-OUTPUTS: ${{ toJSON(needs.build.outputs) }}
        with:
          script: |
            const inpImageNames = core.getMultilineInput('image-names');
            const inpTagNames = core.getMultilineInput('tag-names');
            const inpBuildOutputs = JSON.parse(core.getInput('build-outputs'));
            
            const digests = [];
            for (const key of Object.keys(inpBuildOutputs)) {
              const output = JSON.parse(inpBuildOutputs[key]);
              if (output.imageDigest) {
                digests.push(output.imageDigest);
              }
            }
            if (digests.length === 0) {
              throw new Error('No image digests found from build outputs');
            }
            
            for (const imageName of inpImageNames) {
              let createArgs = ['buildx', 'imagetools', 'create'];
              for (const tag of inpTagNames) {
                createArgs.push('-t', `${imageName}:${tag}`);
              }
              for (const digest of digests) {
                createArgs.push(digest);
              }
              await exec.getExecOutput('docker', createArgs, {
                ignoreReturnCode: true
              }).then(res => {
                if (res.stderr.length > 0 && res.exitCode != 0) {
                  throw new Error(res.stderr);
                }
              });
            }
      -
        name: Set outputs
        id: set
        uses: actions/github-script@v8
        env:
          INPUT_BUILD-OUTPUTS: ${{ toJSON(needs.build.outputs) }}
        with:
          script: |
            const inpBuildOutputs = JSON.parse(core.getInput('build-outputs'));
            const verifyCommands = [];
            for (const key of Object.keys(inpBuildOutputs)) {
              const output = JSON.parse(inpBuildOutputs[key]);
              if (output.verifyCommands) {
                verifyCommands.push(output.verifyCommands);
              }
            }
            core.setOutput('cosign-verify-commands', verifyCommands.join('\n'));