Merge pull request #759 from crazy-max/fix-provenance-input

Fix provenance input

.github/workflows/ci.yml

@@ -523,6 +523,41 @@ jobs:
           file: ./test/go/Dockerfile
           outputs: type=cacheonly
 
+  provenance:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        attrs:
+          - ''
+          - mode=max
+          - builder-id=foo
+          - false
+          - true
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+        with:
+          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
+          driver-opts: |
+            network=host
+            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
+      -
+        name: Build
+        uses: ./
+        with:
+          context: ./test/go
+          file: ./test/go/Dockerfile
+          target: binary
+          outputs: type=oci,dest=/tmp/build.tar
+          provenance: ${{ matrix.attrs }}
+          cache-from: type=gha,scope=provenance
+          cache-to: type=gha,scope=provenance,mode=max
+
   sbom:
     runs-on: ubuntu-latest
     strategy:

__tests__/context.test.ts

@@ -2,6 +2,7 @@ import {beforeEach, describe, expect, it, jest, test} from '@jest/globals';
 import * as fs from 'fs';
 import * as path from 'path';
 
+import * as buildx from '../src/buildx';
 import * as context from '../src/context';
 
 const pgp = `-----BEGIN PGP PRIVATE KEY BLOCK-----
@@ -127,6 +128,8 @@ jest.spyOn(context, 'tmpNameSync').mockImplementation((): string => {
   return path.join('/tmp/.docker-build-push-jest', '.tmpname-jest').split(path.sep).join(path.posix.sep);
 });
 
+jest.spyOn(buildx, 'satisfiesBuildKitVersion').mockResolvedValueOnce(true);
+
 describe('getArgs', () => {
   beforeEach(() => {
     process.env = Object.keys(process.env).reduce((object, key) => {
@@ -159,7 +162,11 @@ describe('getArgs', () => {
       1,
       '0.4.2',
       new Map<string, string>([
-        ['build-args', 'MY_ARG=val1,val2,val3\nARG=val'],
+        ['build-args', `MY_ARG=val1,val2,val3
+ARG=val
+"MULTILINE=aaaa
+bbbb
+ccc"`],
         ['load', 'false'],
         ['no-cache', 'false'],
         ['push', 'false'],
@@ -169,6 +176,7 @@ describe('getArgs', () => {
         'build',
         '--build-arg', 'MY_ARG=val1,val2,val3',
         '--build-arg', 'ARG=val',
+        '--build-arg', `MULTILINE=aaaa\nbbbb\nccc`,
         '--iidfile', '/tmp/.docker-build-push-jest/iidfile',
         'https://github.com/docker/build-push-action.git#refs/heads/test-jest'
       ]
@@ -517,7 +525,119 @@ nproc=3`],
         '--metadata-file', '/tmp/.docker-build-push-jest/metadata-file',
         'https://github.com/docker/build-push-action.git#refs/heads/test-jest:subdir'
       ]
+    ],
+    [
+      17,
+      '0.8.2',
+      new Map<string, string>([
+        ['context', '.'],
+        ['load', 'false'],
+        ['no-cache', 'false'],
+        ['push', 'false'],
+        ['pull', 'false'],
+        ['provenance', 'true'],
+      ]),
+      [
+        'build',
+        '--iidfile', '/tmp/.docker-build-push-jest/iidfile',
+        '--metadata-file', '/tmp/.docker-build-push-jest/metadata-file',
+        '.'
       ]
+    ],
+    [
+      18,
+      '0.10.0',
+      new Map<string, string>([
+        ['context', '.'],
+        ['load', 'false'],
+        ['no-cache', 'false'],
+        ['push', 'false'],
+        ['pull', 'false'],
+      ]),
+      [
+        'build',
+        '--iidfile', '/tmp/.docker-build-push-jest/iidfile',
+        "--provenance", `mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789`,
+        '--metadata-file', '/tmp/.docker-build-push-jest/metadata-file',
+        '.'
+      ]
+    ],
+    [
+      19,
+      '0.10.0',
+      new Map<string, string>([
+        ['context', '.'],
+        ['load', 'false'],
+        ['no-cache', 'false'],
+        ['push', 'false'],
+        ['pull', 'false'],
+        ['provenance', 'true'],
+      ]),
+      [
+        'build',
+        '--iidfile', '/tmp/.docker-build-push-jest/iidfile',
+        "--provenance", `builder-id=https://github.com/docker/build-push-action/actions/runs/123456789`,
+        '--metadata-file', '/tmp/.docker-build-push-jest/metadata-file',
+        '.'
+      ]
+    ],
+    [
+      20,
+      '0.10.0',
+      new Map<string, string>([
+        ['context', '.'],
+        ['load', 'false'],
+        ['no-cache', 'false'],
+        ['push', 'false'],
+        ['pull', 'false'],
+        ['provenance', 'mode=max'],
+      ]),
+      [
+        'build',
+        '--iidfile', '/tmp/.docker-build-push-jest/iidfile',
+        "--provenance", `mode=max,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789`,
+        '--metadata-file', '/tmp/.docker-build-push-jest/metadata-file',
+        '.'
+      ]
+    ],
+    [
+      21,
+      '0.10.0',
+      new Map<string, string>([
+        ['context', '.'],
+        ['load', 'false'],
+        ['no-cache', 'false'],
+        ['push', 'false'],
+        ['pull', 'false'],
+        ['provenance', 'false'],
+      ]),
+      [
+        'build',
+        '--iidfile', '/tmp/.docker-build-push-jest/iidfile',
+        "--provenance", 'false',
+        '--metadata-file', '/tmp/.docker-build-push-jest/metadata-file',
+        '.'
+      ]
+    ],
+    [
+      22,
+      '0.10.0',
+      new Map<string, string>([
+        ['context', '.'],
+        ['load', 'false'],
+        ['no-cache', 'false'],
+        ['push', 'false'],
+        ['pull', 'false'],
+        ['provenance', 'builder-id=foo'],
+      ]),
+      [
+        'build',
+        '--iidfile', '/tmp/.docker-build-push-jest/iidfile',
+        "--provenance", 'builder-id=foo',
+        '--metadata-file', '/tmp/.docker-build-push-jest/metadata-file',
+        '.'
+      ]
+    ],
   ])(
     '[%d] given %p with %p as inputs, returns %p',
     async (num: number, buildxVersion: string, inputs: Map<string, string>, expected: Array<string>) => {

dev.Dockerfile

@@ -68,6 +68,8 @@ FROM docker/buildx-bin:${BUILDX_VERSION} as buildx
 FROM deps AS test
 ENV RUNNER_TEMP=/tmp/github_runner
 ENV RUNNER_TOOL_CACHE=/tmp/github_tool_cache
+ENV GITHUB_REPOSITORY=docker/build-push-action
+ENV GITHUB_RUN_ID=123456789
 RUN --mount=type=bind,target=.,rw \
   --mount=type=cache,target=/src/node_modules \
   --mount=type=bind,from=docker,source=/usr/local/bin/docker,target=/usr/bin/docker \

dist/index.js

@@ -18,5 +18,5 @@ require('./sourcemap-register.js');(()=>{var __webpack_modules__={5241:function(
  *
  * MIT Licensed
  */
-const s=i(7147);const p=i(2037);const d=i(1017);const l=i(6113);const u={fs:s.constants,os:p.constants};const m=i(4959);const c="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",h=/XXXXXX/,v=3,g=(u.O_CREAT||u.fs.O_CREAT)|(u.O_EXCL||u.fs.O_EXCL)|(u.O_RDWR||u.fs.O_RDWR),_=p.platform()==="win32",w=u.EBADF||u.os.errno.EBADF,b=u.ENOENT||u.os.errno.ENOENT,y=448,E=384,S="exit",T=[],k=s.rmdirSync.bind(s),O=m.sync;let P=false;function tmpName(r,a){const i=_parseArguments(r,a),p=i[0],d=i[1];try{_assertAndSanitizeOptions(p)}catch(r){return d(r)}let l=p.tries;(function _getUniqueName(){try{const r=_generateTmpName(p);s.stat(r,(function(a){if(!a){if(l-- >0)return _getUniqueName();return d(new Error("Could not get a unique tmp filename, max tries reached "+r))}d(null,r)}))}catch(r){d(r)}})()}function tmpNameSync(r){const a=_parseArguments(r),i=a[0];_assertAndSanitizeOptions(i);let p=i.tries;do{const r=_generateTmpName(i);try{s.statSync(r)}catch(a){return r}}while(p-- >0);throw new Error("Could not get a unique tmp filename, max tries reached")}function file(r,a){const i=_parseArguments(r,a),p=i[0],d=i[1];tmpName(p,(function _tmpNameCreated(r,a){if(r)return d(r);s.open(a,g,p.mode||E,(function _fileCreated(r,i){if(r)return d(r);if(p.discardDescriptor){return s.close(i,(function _discardCallback(r){return d(r,a,undefined,_prepareTmpFileRemoveCallback(a,-1,p,false))}))}else{const r=p.discardDescriptor||p.detachDescriptor;d(null,a,i,_prepareTmpFileRemoveCallback(a,r?-1:i,p,false))}}))}))}function fileSync(r){const a=_parseArguments(r),i=a[0];const p=i.discardDescriptor||i.detachDescriptor;const d=tmpNameSync(i);var l=s.openSync(d,g,i.mode||E);if(i.discardDescriptor){s.closeSync(l);l=undefined}return{name:d,fd:l,removeCallback:_prepareTmpFileRemoveCallback(d,p?-1:l,i,true)}}function dir(r,a){const i=_parseArguments(r,a),p=i[0],d=i[1];tmpName(p,(function _tmpNameCreated(r,a){if(r)return d(r);s.mkdir(a,p.mode||y,(function _dirCreated(r){if(r)return d(r);d(null,a,_prepareTmpDirRemoveCallback(a,p,false))}))}))}function dirSync(r){const a=_parseArguments(r),i=a[0];const p=tmpNameSync(i);s.mkdirSync(p,i.mode||y);return{name:p,removeCallback:_prepareTmpDirRemoveCallback(p,i,true)}}function _removeFileAsync(r,a){const _handler=function(r){if(r&&!_isENOENT(r)){return a(r)}a()};if(0<=r[0])s.close(r[0],(function(){s.unlink(r[1],_handler)}));else s.unlink(r[1],_handler)}function _removeFileSync(r){let a=null;try{if(0<=r[0])s.closeSync(r[0])}catch(r){if(!_isEBADF(r)&&!_isENOENT(r))throw r}finally{try{s.unlinkSync(r[1])}catch(r){if(!_isENOENT(r))a=r}}if(a!==null){throw a}}function _prepareTmpFileRemoveCallback(r,a,i,s){const p=_prepareRemoveCallback(_removeFileSync,[a,r],s);const d=_prepareRemoveCallback(_removeFileAsync,[a,r],s,p);if(!i.keep)T.unshift(p);return s?p:d}function _prepareTmpDirRemoveCallback(r,a,i){const p=a.unsafeCleanup?m:s.rmdir.bind(s);const d=a.unsafeCleanup?O:k;const l=_prepareRemoveCallback(d,r,i);const u=_prepareRemoveCallback(p,r,i,l);if(!a.keep)T.unshift(l);return i?l:u}function _prepareRemoveCallback(r,a,i,s){let p=false;return function _cleanupCallback(d){if(!p){const l=s||_cleanupCallback;const u=T.indexOf(l);if(u>=0)T.splice(u,1);p=true;if(i||r===k||r===O){return r(a)}else{return r(a,d||function(){})}}}}function _garbageCollector(){if(!P)return;while(T.length){try{T[0]()}catch(r){}}}function _randomChars(r){let a=[],i=null;try{i=l.randomBytes(r)}catch(a){i=l.pseudoRandomBytes(r)}for(var s=0;s<r;s++){a.push(c[i[s]%c.length])}return a.join("")}function _isBlank(r){return r===null||_isUndefined(r)||!r.trim()}function _isUndefined(r){return typeof r==="undefined"}function _parseArguments(r,a){if(typeof r==="function"){return[{},r]}if(_isUndefined(r)){return[{},a]}const i={};for(const a of Object.getOwnPropertyNames(r)){i[a]=r[a]}return[i,a]}function _generateTmpName(r){const a=r.tmpdir;if(!_isUndefined(r.name))return d.join(a,r.dir,r.name);if(!_isUndefined(r.template))return d.join(a,r.dir,r.template).replace(h,_randomChars(6));const i=[r.prefix?r.prefix:"tmp","-",process.pid,"-",_randomChars(12),r.postfix?"-"+r.postfix:""].join("");return d.join(a,r.dir,i)}function _assertAndSanitizeOptions(r){r.tmpdir=_getTmpDir(r);const a=r.tmpdir;if(!_isUndefined(r.name))_assertIsRelative(r.name,"name",a);if(!_isUndefined(r.dir))_assertIsRelative(r.dir,"dir",a);if(!_isUndefined(r.template)){_assertIsRelative(r.template,"template",a);if(!r.template.match(h))throw new Error(`Invalid template, found "${r.template}".`)}if(!_isUndefined(r.tries)&&isNaN(r.tries)||r.tries<0)throw new Error(`Invalid tries, found "${r.tries}".`);r.tries=_isUndefined(r.name)?r.tries||v:1;r.keep=!!r.keep;r.detachDescriptor=!!r.detachDescriptor;r.discardDescriptor=!!r.discardDescriptor;r.unsafeCleanup=!!r.unsafeCleanup;r.dir=_isUndefined(r.dir)?"":d.relative(a,_resolvePath(r.dir,a));r.template=_isUndefined(r.template)?undefined:d.relative(a,_resolvePath(r.template,a));r.template=_isBlank(r.template)?undefined:d.relative(r.dir,r.template);r.naLine truncated
+const s=i(7147);const p=i(2037);const d=i(1017);const l=i(6113);const u={fs:s.constants,os:p.constants};const m=i(4959);const c="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",h=/XXXXXX/,v=3,g=(u.O_CREAT||u.fs.O_CREAT)|(u.O_EXCL||u.fs.O_EXCL)|(u.O_RDWR||u.fs.O_RDWR),_=p.platform()==="win32",w=u.EBADF||u.os.errno.EBADF,b=u.ENOENT||u.os.errno.ENOENT,y=448,E=384,S="exit",T=[],k=s.rmdirSync.bind(s),O=m.sync;let P=false;function tmpName(r,a){const i=_parseArguments(r,a),p=i[0],d=i[1];try{_assertAndSanitizeOptions(p)}catch(r){return d(r)}let l=p.tries;(function _getUniqueName(){try{const r=_generateTmpName(p);s.stat(r,(function(a){if(!a){if(l-- >0)return _getUniqueName();return d(new Error("Could not get a unique tmp filename, max tries reached "+r))}d(null,r)}))}catch(r){d(r)}})()}function tmpNameSync(r){const a=_parseArguments(r),i=a[0];_assertAndSanitizeOptions(i);let p=i.tries;do{const r=_generateTmpName(i);try{s.statSync(r)}catch(a){return r}}while(p-- >0);throw new Error("Could not get a unique tmp filename, max tries reached")}function file(r,a){const i=_parseArguments(r,a),p=i[0],d=i[1];tmpName(p,(function _tmpNameCreated(r,a){if(r)return d(r);s.open(a,g,p.mode||E,(function _fileCreated(r,i){if(r)return d(r);if(p.discardDescriptor){return s.close(i,(function _discardCallback(r){return d(r,a,undefined,_prepareTmpFileRemoveCallback(a,-1,p,false))}))}else{const r=p.discardDescriptor||p.detachDescriptor;d(null,a,i,_prepareTmpFileRemoveCallback(a,r?-1:i,p,false))}}))}))}function fileSync(r){const a=_parseArguments(r),i=a[0];const p=i.discardDescriptor||i.detachDescriptor;const d=tmpNameSync(i);var l=s.openSync(d,g,i.mode||E);if(i.discardDescriptor){s.closeSync(l);l=undefined}return{name:d,fd:l,removeCallback:_prepareTmpFileRemoveCallback(d,p?-1:l,i,true)}}function dir(r,a){const i=_parseArguments(r,a),p=i[0],d=i[1];tmpName(p,(function _tmpNameCreated(r,a){if(r)return d(r);s.mkdir(a,p.mode||y,(function _dirCreated(r){if(r)return d(r);d(null,a,_prepareTmpDirRemoveCallback(a,p,false))}))}))}function dirSync(r){const a=_parseArguments(r),i=a[0];const p=tmpNameSync(i);s.mkdirSync(p,i.mode||y);return{name:p,removeCallback:_prepareTmpDirRemoveCallback(p,i,true)}}function _removeFileAsync(r,a){const _handler=function(r){if(r&&!_isENOENT(r)){return a(r)}a()};if(0<=r[0])s.close(r[0],(function(){s.unlink(r[1],_handler)}));else s.unlink(r[1],_handler)}function _removeFileSync(r){let a=null;try{if(0<=r[0])s.closeSync(r[0])}catch(r){if(!_isEBADF(r)&&!_isENOENT(r))throw r}finally{try{s.unlinkSync(r[1])}catch(r){if(!_isENOENT(r))a=r}}if(a!==null){throw a}}function _prepareTmpFileRemoveCallback(r,a,i,s){const p=_prepareRemoveCallback(_removeFileSync,[a,r],s);const d=_prepareRemoveCallback(_removeFileAsync,[a,r],s,p);if(!i.keep)T.unshift(p);return s?p:d}function _prepareTmpDirRemoveCallback(r,a,i){const p=a.unsafeCleanup?m:s.rmdir.bind(s);const d=a.unsafeCleanup?O:k;const l=_prepareRemoveCallback(d,r,i);const u=_prepareRemoveCallback(p,r,i,l);if(!a.keep)T.unshift(l);return i?l:u}function _prepareRemoveCallback(r,a,i,s){let p=false;return function _cleanupCallback(d){if(!p){const l=s||_cleanupCallback;const u=T.indexOf(l);if(u>=0)T.splice(u,1);p=true;if(i||r===k||r===O){return r(a)}else{return r(a,d||function(){})}}}}function _garbageCollector(){if(!P)return;while(T.length){try{T[0]()}catch(r){}}}function _randomChars(r){let a=[],i=null;try{i=l.randomBytes(r)}catch(a){i=l.pseudoRandomBytes(r)}for(var s=0;s<r;s++){a.push(c[i[s]%c.length])}return a.join("")}function _isBlank(r){return r===null||_isUndefined(r)||!r.trim()}function _isUndefined(r){return typeof r==="undefined"}function _parseArguments(r,a){if(typeof r==="function"){return[{},r]}if(_isUndefined(r)){return[{},a]}const i={};for(const a of Object.getOwnPropertyNames(r)){i[a]=r[a]}return[i,a]}function _generateTmpName(r){const a=r.tmpdir;if(!_isUndefined(r.name))return d.join(a,r.dir,r.name);if(!_isUndefined(r.template))return d.join(a,r.dir,r.template).replace(h,_randomChars(6));const i=[r.prefix?r.prefix:"tmp","-",process.pid,"-",_randomChars(12),r.postfix?"-"+r.postfix:""].join("");return d.join(a,r.dir,i)}function _assertAndSanitizeOptions(r){r.tmpdir=_getTmpDir(r);const a=r.tmpdir;if(!_isUndefined(r.name))_assertIsRelative(r.name,"name",a);if(!_isUndefined(r.dir))_assertIsRelative(r.dir,"dir",a);if(!_isUndefined(r.template)){_assertIsRelative(r.template,"template",a);if(!r.template.match(h))throw new Error(`Invalid template, found "${r.template}".`)}if(!_isUndefined(r.tries)&&isNaN(r.tries)||r.tries<0)throw new Error(`Invalid tries, found "${r.tries}".`);r.tries=_isUndefined(r.name)?r.tries||v:1;r.keep=!!r.keep;r.detachDescriptor=!!r.detachDescriptor;r.discardDescriptor=!!r.discardDescriptor;r.unsafeCleanup=!!r.unsafeCleanup;r.dir=_isUndefined(r.dir)?"":d.relative(a,_resolvePath(r.dir,a));r.template=_isUndefined(r.template)?undefined:d.relative(a,_resolvePath(r.template,a));r.template=_isBlank(r.template)?undefined:d.relative(r.dir,r.template);r.naLine truncated
 //# sourceMappingURL=index.js.map

dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../webpack:/docker-build-push/node_modules/@actions/core/lib/command.js","../webpack:/docker-build-push/node_modules/@actions/core/lib/core.js","../webpack:/docker-build-push/node_modules/@actions/core/lib/file-command.js","../webpack:/docker-build-push/node_modules/@actions/core/lib/oidc-utils.js","../webpack:/docker-build-push/node_modules/@actions/core/lib/path-utils.js","../webpack:/docker-build-push/node_modules/@actions/core/lib/summary.js","../webpack:/docker-build-push/node_modules/@actions/core/lib/utils.js","../webpack:/docker-build-push/node_modules/@actions/exec/lib/exec.js","../webpack:/docker-build-push/node_modules/@actions/exec/lib/toolrunner.js","../webpack:/docker-build-push/node_modules/@actions/github/lib/context.js","../webpack:/docker-build-push/node_modules/@actions/github/lib/github.js","../webpack:/docker-build-push/node_modules/@actions/github/lib/internal/utils.js","../webpack:/docker-build-push/node_modules/@actions/github/lib/utils.js","../webpack:/docker-build-push/node_modules/@actions/http-client/lib/auth.js","../webpack:/docker-build-push/node_modules/@actions/http-client/lib/index.js","../webpack:/docker-build-push/node_modules/@actions/http-client/lib/proxy.js","../webpack:/docker-build-push/node_modules/@actions/io/lib/io-util.js","../webpack:/docker-build-push/node_modules/@actions/io/lib/io.js","../webpack:/docker-build-push/node_modules/@octokit/auth-token/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/core/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/endpoint/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/graphql/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/graphql/node_modules/@octokit/request-error/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/graphql/node_modules/@octokit/request/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/plugin-paginate-rest/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/plugin-rest-endpoint-methods/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/request/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/request/node_modules/@octokit/request-error/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/request/node_modules/is-plain-object/dist/is-plain-object.js","../webpack:/docker-build-push/node_modules/balanced-match/index.js","../webpack:/docker-build-push/node_modules/before-after-hook/index.js","../webpack:/docker-build-push/node_modules/before-after-hook/lib/add.js","../webpack:/docker-build-push/node_modules/before-after-hook/lib/register.js","../webpack:/docker-build-push/node_modules/before-after-hook/lib/remove.js","../webpack:/docker-build-push/node_modules/brace-expansion/index.js","../webpack:/docker-build-push/node_modules/concat-map/index.js","../webpack:/docker-build-push/node_modules/deprecation/dist-node/index.js","../webpack:/docker-build-push/node_modules/fs.realpath/index.js","../webpack:/docker-build-push/node_modules/fs.realpath/old.js","../webpack:/docker-build-push/node_modules/glob/common.js","../webpack:/docker-build-push/node_modules/glob/glob.js","../webpack:/docker-build-push/node_modules/glob/sync.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars.runtime.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/base.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/ast.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/base.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/code-gen.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/compiler.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/helpers.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/javascript-compiler.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/parser.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/printer.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/visitor.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/whitespace-control.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/decorators.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/decorators/inline.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/exception.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/helpers.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/helpeLine truncated
+{"version":3,"sources":["../webpack:/docker-build-push/node_modules/@actions/core/lib/command.js","../webpack:/docker-build-push/node_modules/@actions/core/lib/core.js","../webpack:/docker-build-push/node_modules/@actions/core/lib/file-command.js","../webpack:/docker-build-push/node_modules/@actions/core/lib/oidc-utils.js","../webpack:/docker-build-push/node_modules/@actions/core/lib/path-utils.js","../webpack:/docker-build-push/node_modules/@actions/core/lib/summary.js","../webpack:/docker-build-push/node_modules/@actions/core/lib/utils.js","../webpack:/docker-build-push/node_modules/@actions/exec/lib/exec.js","../webpack:/docker-build-push/node_modules/@actions/exec/lib/toolrunner.js","../webpack:/docker-build-push/node_modules/@actions/github/lib/context.js","../webpack:/docker-build-push/node_modules/@actions/github/lib/github.js","../webpack:/docker-build-push/node_modules/@actions/github/lib/internal/utils.js","../webpack:/docker-build-push/node_modules/@actions/github/lib/utils.js","../webpack:/docker-build-push/node_modules/@actions/http-client/lib/auth.js","../webpack:/docker-build-push/node_modules/@actions/http-client/lib/index.js","../webpack:/docker-build-push/node_modules/@actions/http-client/lib/proxy.js","../webpack:/docker-build-push/node_modules/@actions/io/lib/io-util.js","../webpack:/docker-build-push/node_modules/@actions/io/lib/io.js","../webpack:/docker-build-push/node_modules/@octokit/auth-token/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/core/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/endpoint/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/graphql/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/graphql/node_modules/@octokit/request-error/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/graphql/node_modules/@octokit/request/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/plugin-paginate-rest/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/plugin-rest-endpoint-methods/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/request/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/request/node_modules/@octokit/request-error/dist-node/index.js","../webpack:/docker-build-push/node_modules/@octokit/request/node_modules/is-plain-object/dist/is-plain-object.js","../webpack:/docker-build-push/node_modules/balanced-match/index.js","../webpack:/docker-build-push/node_modules/before-after-hook/index.js","../webpack:/docker-build-push/node_modules/before-after-hook/lib/add.js","../webpack:/docker-build-push/node_modules/before-after-hook/lib/register.js","../webpack:/docker-build-push/node_modules/before-after-hook/lib/remove.js","../webpack:/docker-build-push/node_modules/brace-expansion/index.js","../webpack:/docker-build-push/node_modules/concat-map/index.js","../webpack:/docker-build-push/node_modules/deprecation/dist-node/index.js","../webpack:/docker-build-push/node_modules/fs.realpath/index.js","../webpack:/docker-build-push/node_modules/fs.realpath/old.js","../webpack:/docker-build-push/node_modules/glob/common.js","../webpack:/docker-build-push/node_modules/glob/glob.js","../webpack:/docker-build-push/node_modules/glob/sync.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars.runtime.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/base.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/ast.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/base.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/code-gen.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/compiler.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/helpers.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/javascript-compiler.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/parser.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/printer.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/visitor.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/compiler/whitespace-control.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/decorators.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/decorators/inline.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/exception.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/helpers.js","../webpack:/docker-build-push/node_modules/handlebars/dist/cjs/handlebars/helpeLine truncated

src/context.ts

@@ -68,6 +68,10 @@ export function tmpNameSync(options?: tmp.TmpNameOptions): string {
   return tmp.tmpNameSync(options);
 }
 
+export function provenanceBuilderID(): string {
+  return `${process.env.GITHUB_SERVER_URL || 'https://github.com'}/${github.context.repo.owner}/${github.context.repo.repo}/actions/runs/${github.context.runId}`;
+}
+
 export async function getInputs(defaultContext: string): Promise<Inputs> {
   return {
     addHosts: await getInputList('add-hosts'),
@@ -88,7 +92,7 @@ export async function getInputs(defaultContext: string): Promise<Inputs> {
     noCacheFilters: await getInputList('no-cache-filters'),
     outputs: await getInputList('outputs', true),
     platforms: await getInputList('platforms'),
-    provenance: core.getInput('provenance'),
+    provenance: getProvenanceInput('provenance'),
     pull: core.getBooleanInput('pull'),
     push: core.getBooleanInput('push'),
     sbom: core.getInput('sbom'),
@@ -162,9 +166,8 @@ async function getBuildArgs(inputs: Inputs, defaultContext: string, context: str
     args.push('--platform', inputs.platforms.join(','));
   }
   if (buildx.satisfies(buildxVersion, '>=0.10.0')) {
-    const prvBuilderID = `${process.env.GITHUB_SERVER_URL || 'https://github.com'}/${github.context.repo.owner}/${github.context.repo.repo}/actions/runs/${github.context.runId}`;
     if (inputs.provenance) {
-      args.push('--provenance', getProvenanceAttrs(inputs.provenance, prvBuilderID));
+      args.push('--provenance', inputs.provenance);
     } else if ((await buildx.satisfiesBuildKitVersion(inputs.builder, '>=0.11.0', standalone)) && !hasDockerExport(inputs)) {
       // if provenance not specified and BuildKit version compatible for
       // attestation, set default provenance. Also needs to make sure user
@@ -172,12 +175,10 @@ async function getBuildArgs(inputs: Inputs, defaultContext: string, context: str
       if (fromPayload('repository.private') !== false) {
         // if this is a private repository, we set the default provenance
         // attributes being set in buildx: https://github.com/docker/buildx/blob/fb27e3f919dcbf614d7126b10c2bc2d0b1927eb6/build/build.go#L603
-        // along the builder-id attribute.
+        args.push('--provenance', getProvenanceAttrs(`mode=min,inline-only=true`));
-        args.push('--provenance', `mode=min,inline-only=true,builder-id=${prvBuilderID}`);
       } else {
-        // for a public repository, we set max provenance mode and the
+        // for a public repository, we set max provenance mode.
-        // builder-id attribute.
+        args.push('--provenance', getProvenanceAttrs(`mode=max`));
-        args.push('--provenance', `mode=max,builder-id=${prvBuilderID}`);
       }
     }
     if (inputs.sbom) {
@@ -298,7 +299,24 @@ function select(obj: any, path: string): any {
   return select(obj[key], path.slice(i + 1));
 }
 
-function getProvenanceAttrs(input: string, builderID: string): string {
+function getProvenanceInput(name: string): string {
+  const input = core.getInput(name);
+  if (!input) {
+    // if input is not set, default values will be set later.
+    return input;
+  }
+  const builderID = provenanceBuilderID();
+  try {
+    return core.getBooleanInput(name) ? `builder-id=${builderID}` : 'false';
+  } catch (err) {
+    // not a valid boolean, so we assume it's a string
+    return getProvenanceAttrs(input);
+  }
+}
+
+function getProvenanceAttrs(input: string): string {
+  const builderID = provenanceBuilderID();
+  // parse attributes from input
   const fields = parse(input, {
     relaxColumnCount: true,
     skipEmptyLines: true