.github/workflows/publish.yml

@@ -1,21 +0,0 @@
-name: publish
-
-on:
-  release:
-    types:
-      - published
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-      packages: write
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-      -
-        name: Publish
-        uses: actions/publish-immutable-action@v0.0.4

.github/workflows/test.yml

@@ -15,14 +15,17 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
       -
         name: Test
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v4
         with:
           targets: test
       -
         name: Upload coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v4
         with:
-          files: ./coverage/clover.xml
+          file: ./coverage/clover.xml
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/validate.yml

@@ -15,17 +15,16 @@ jobs:
   prepare:
     runs-on: ubuntu-latest
     outputs:
-      targets: ${{ steps.generate.outputs.targets }}
+      targets: ${{ steps.targets.outputs.matrix }}
     steps:
       -
         name: Checkout
         uses: actions/checkout@v4
       -
-        name: List targets
-        id: generate
-        uses: docker/bake-action/subaction/list-targets@v6
-        with:
-          target: validate
+        name: Targets matrix
+        id: targets
+        run: |
+          echo "matrix=$(docker buildx bake validate --print | jq -cr '.group.validate.targets')" >> $GITHUB_OUTPUT
 
   validate:
     runs-on: ubuntu-latest
@@ -36,8 +35,11 @@ jobs:
       matrix:
         target: ${{ fromJson(needs.prepare.outputs.targets) }}
     steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
       -
         name: Validate
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v4
         with:
           targets: ${{ matrix.target }}

README.md

@@ -51,7 +51,7 @@ jobs:
         name: Login to Docker Hub
         uses: docker/login-action@v3
         with:
-          username: ${{ vars.DOCKERHUB_USERNAME }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 ```
 
@@ -105,7 +105,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: registry.gitlab.com
-          username: ${{ vars.GITLAB_USERNAME }}
+          username: ${{ secrets.GITLAB_USERNAME }}
           password: ${{ secrets.GITLAB_PASSWORD }}
 ```
 
@@ -136,7 +136,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: <registry-name>.azurecr.io
-          username: ${{ vars.AZURE_CLIENT_ID }}
+          username: ${{ secrets.AZURE_CLIENT_ID }}
           password: ${{ secrets.AZURE_CLIENT_SECRET }}
 ```
 
@@ -199,7 +199,8 @@ jobs:
 Use a service account with permission to push to GCR and [configure access control](https://cloud.google.com/container-registry/docs/access-control).
 Download the key for the service account as a JSON file. Save the contents of
 the file [as a secret](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
-named `GCR_JSON_KEY` in your GitHub repository. Set the username to `_json_key`.
+named `GCR_JSON_KEY` in your GitHub repository. Set the username to `_json_key`,
+or `_json_key_base64` if you use a base64-encoded key.
 
 ```yaml
 name: ci
@@ -301,7 +302,7 @@ jobs:
 
 ### AWS Elastic Container Registry (ECR)
 
-Use an IAM user with the ability to [push to ECR with `AmazonEC2ContainerRegistryPowerUser` managed policy for example](https://docs.aws.amazon.com/AmazonECR/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonEC2ContainerRegistryPowerUser).
+Use an IAM user with the ability to [push to ECR with `AmazonEC2ContainerRegistryPowerUser` managed policy for example](https://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr_managed_policies.html#AmazonEC2ContainerRegistryPowerUser).
 Download the access keys and save them as `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` [as secrets](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
 in your GitHub repo.
 
@@ -321,7 +322,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: <aws-account-number>.dkr.ecr.<region>.amazonaws.com
-          username: ${{ vars.AWS_ACCESS_KEY_ID }}
+          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
           password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
 ```
 
@@ -344,7 +345,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: <aws-account-number>.dkr.ecr.<region>.amazonaws.com
-          username: ${{ vars.AWS_ACCESS_KEY_ID }}
+          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
           password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         env:
           AWS_ACCOUNT_IDS: 012345678910,023456789012
@@ -370,7 +371,7 @@ jobs:
         name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          aws-access-key-id: ${{ vars.AWS_ACCESS_KEY_ID }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: <region>
       -
@@ -405,7 +406,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: public.ecr.aws
-          username: ${{ vars.AWS_ACCESS_KEY_ID }}
+          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
           password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         env:
           AWS_REGION: <region>
@@ -439,7 +440,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: <region>.ocir.io
-          username: ${{ vars.OCI_USERNAME }}
+          username: ${{ secrets.OCI_USERNAME }}
           password: ${{ secrets.OCI_TOKEN }}
 ```
 
@@ -466,7 +467,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: quay.io
-          username: ${{ vars.QUAY_USERNAME }}
+          username: ${{ secrets.QUAY_USERNAME }}
           password: ${{ secrets.QUAY_ROBOT_TOKEN }}
 ```
 
@@ -490,7 +491,7 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: registry.digitalocean.com
-          username: ${{ vars.DIGITALOCEAN_USERNAME }}
+          username: ${{ secrets.DIGITALOCEAN_USERNAME }}
           password: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
 ```
 

__tests__/docker.test.ts

@@ -2,15 +2,14 @@ import {expect, jest, test} from '@jest/globals';
 import * as path from 'path';
 
 import {loginStandard, logout} from '../src/docker';
-
-import {Docker} from '@docker/actions-toolkit/lib/docker/docker';
+import {Exec} from '@docker/actions-toolkit/lib/exec';
 
 process.env['RUNNER_TEMP'] = path.join(__dirname, 'runner');
 
 test('loginStandard calls exec', async () => {
   // eslint-disable-next-line @typescript-eslint/ban-ts-comment
   // @ts-ignore
-  const execSpy = jest.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
+  const execSpy = jest.spyOn(Exec, 'getExecOutput').mockImplementation(async () => {
     return {
       exitCode: expect.any(Number),
       stdout: expect.any(Function),
@@ -24,13 +23,7 @@ test('loginStandard calls exec', async () => {
 
   await loginStandard(registry, username, password);
 
-  expect(execSpy).toHaveBeenCalledTimes(1);
-  const callfunc = execSpy.mock.calls[0];
-  if (callfunc && callfunc[1]) {
-    // we don't want to check env opt
-    callfunc[1].env = undefined;
-  }
-  expect(execSpy).toHaveBeenCalledWith(['login', '--password-stdin', '--username', username, registry], {
+  expect(execSpy).toHaveBeenCalledWith(`docker`, ['login', '--password-stdin', '--username', username, registry], {
     input: Buffer.from(password),
     silent: true,
     ignoreReturnCode: true
@@ -40,7 +33,7 @@ test('loginStandard calls exec', async () => {
 test('logout calls exec', async () => {
   // eslint-disable-next-line @typescript-eslint/ban-ts-comment
   // @ts-ignore
-  const execSpy = jest.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
+  const execSpy = jest.spyOn(Exec, 'getExecOutput').mockImplementation(async () => {
     return {
       exitCode: expect.any(Number),
       stdout: expect.any(Function),
@@ -52,13 +45,7 @@ test('logout calls exec', async () => {
 
   await logout(registry);
 
-  expect(execSpy).toHaveBeenCalledTimes(1);
-  const callfunc = execSpy.mock.calls[0];
-  if (callfunc && callfunc[1]) {
-    // we don't want to check env opt
-    callfunc[1].env = undefined;
-  }
-  expect(execSpy).toHaveBeenCalledWith(['logout', registry], {
+  expect(execSpy).toHaveBeenCalledWith(`docker`, ['logout', registry], {
     ignoreReturnCode: true
   });
 });

docker-bake.hcl

@@ -1,9 +1,3 @@
-target "_common" {
-  args = {
-    BUILDKIT_CONTEXT_KEEP_GIT_DIR = 1
-  }
-}
-
 group "default" {
   targets = ["build"]
 }
@@ -17,49 +11,42 @@ group "validate" {
 }
 
 target "build" {
-  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "build-update"
   output = ["."]
 }
 
 target "build-validate" {
-  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "build-validate"
   output = ["type=cacheonly"]
 }
 
 target "format" {
-  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "format-update"
   output = ["."]
 }
 
 target "lint" {
-  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "lint"
   output = ["type=cacheonly"]
 }
 
 target "vendor" {
-  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "vendor-update"
   output = ["."]
 }
 
 target "vendor-validate" {
-  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "vendor-validate"
   output = ["type=cacheonly"]
 }
 
 target "test" {
-  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "test-coverage"
   output = ["./coverage"]

package.json

@@ -25,12 +25,12 @@
   "license": "Apache-2.0",
   "packageManager": "yarn@3.6.3",
   "dependencies": {
-    "@actions/core": "^1.11.1",
-    "@aws-sdk/client-ecr": "^3.766.0",
-    "@aws-sdk/client-ecr-public": "^3.758.0",
-    "@docker/actions-toolkit": "^0.57.0",
+    "@actions/core": "^1.10.1",
+    "@aws-sdk/client-ecr": "^3.583.0",
+    "@aws-sdk/client-ecr-public": "^3.583.0",
+    "@docker/actions-toolkit": "^0.24.0",
     "http-proxy-agent": "^7.0.2",
-    "https-proxy-agent": "^7.0.6"
+    "https-proxy-agent": "^7.0.4"
   },
   "devDependencies": {
     "@types/node": "^20.12.12",

src/docker.ts

@@ -1,7 +1,6 @@
 import * as aws from './aws';
 import * as core from '@actions/core';
-
-import {Docker} from '@docker/actions-toolkit/lib/docker/docker';
+import {Exec} from '@docker/actions-toolkit/lib/exec';
 
 export async function login(registry: string, username: string, password: string, ecr: string): Promise<void> {
   if (/true/i.test(ecr) || (ecr == 'auto' && aws.isECR(registry))) {
@@ -12,7 +11,7 @@ export async function login(registry: string, username: string, password: string
 }
 
 export async function logout(registry: string): Promise<void> {
-  await Docker.getExecOutput(['logout', registry], {
+  await Exec.getExecOutput('docker', ['logout', registry], {
     ignoreReturnCode: true
   }).then(res => {
     if (res.stderr.length > 0 && res.exitCode != 0) {
@@ -41,7 +40,7 @@ export async function loginStandard(registry: string, username: string, password
   } else {
     core.info(`Logging into Docker Hub...`);
   }
-  await Docker.getExecOutput(loginArgs, {
+  await Exec.getExecOutput('docker', loginArgs, {
     ignoreReturnCode: true,
     silent: true,
     input: Buffer.from(password)
@@ -58,7 +57,7 @@ export async function loginECR(registry: string, username: string, password: str
   const regDatas = await aws.getRegistriesData(registry, username, password);
   for (const regData of regDatas) {
     core.info(`Logging into ${regData.registry}...`);
-    await Docker.getExecOutput(['login', '--password-stdin', '--username', regData.username, regData.registry], {
+    await Exec.getExecOutput('docker', ['login', '--password-stdin', '--username', regData.username, regData.registry], {
       ignoreReturnCode: true,
       silent: true,
       input: Buffer.from(regData.password)