alextab93/buildx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
4,110 Commits 1 Branch 1 Tag
0491d7c7b9d2f5f85fa5435291d5198907899aea
Commit Graph
4110 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tonis Tiigi 0491d7c7b9 policy: add default policy for buildkit-syft-scanner images 
Extends the builtin default policy to verify docker-github-builder
signatures on docker/buildkit-syft-scanner images. Tags `latest` and
1.10+ require a signature from the docker/buildkit-syft-scanner source
repository; older tags pass through unchanged. Factors the shared ref
matching logic into sig_ref_matches for dockerfile and introduces a
syft-scanner variant that uses the plain refs/tags/ prefix.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-04-20 16:46:05 -07:00
Tonis Tiigi 0e50635195 policy: add builtin default source policy 
Embed an opt-in default source policy for Docker-managed frontend images.
Load it ahead of user policies when enabled, and cover behavior with table-
driven policy tests for signed, unsigned, floating, and labs tags.

Makes sure if there is any attack against the docker/dockerfile
releases, or they accidentally point to worng images, these are automatically detected.

In a future release these should become opt-out.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-04-20 16:32:39 -07:00
CrazyMaxandGitHub 0cc24edee5 Merge pull request #3801 from docker/dependabot/github_actions/docker/github-builder/dot-github/workflows/bake.yml-1.6.0 
build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.5.0 to 1.6.0
 2026-04-20 15:41:15 +02:00
CrazyMaxandGitHub 4c6e2585a4 Merge pull request #3804 from docker/dependabot/github_actions/github/codeql-action-4.35.2 
build(deps): bump github/codeql-action from 4.35.1 to 4.35.2
 2026-04-20 15:40:51 +02:00
dependabot[bot]andGitHub a05c9c122b build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/c10b8064de6f491fea524254123dbe5e09572f13...95e58e9a2cdfd71adc6e0353d5c52f41a045d225)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-17 18:34:17 +00:00
dependabot[bot]andGitHub cf33414b72 build(deps): bump docker/github-builder/.github/workflows/bake.yml 
Bumps [docker/github-builder/.github/workflows/bake.yml](https://github.com/docker/github-builder) from 1.5.0 to 1.6.0.
- [Release notes](https://github.com/docker/github-builder/releases)
- [Commits](https://github.com/docker/github-builder/compare/2497a7d1e7d8683af4949c9d6d62012bc16ed59c...7d2a02426d4b989616ba5aaee4e879afd4134b0d)

---
updated-dependencies:
- dependency-name: docker/github-builder/.github/workflows/bake.yml
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-16 18:34:30 +00:00
Tõnis TiigiandGitHub 6160c9bcb9 Merge pull request #3726 from crazy-max/buildkit-git-cli 
gitutil: migrate to BuildKit GitCLI API
 2026-04-15 09:52:53 -07:00
CrazyMaxandGitHub adec11dea3 Merge pull request #3799 from crazy-max/fix-zizmor 
ci(zizmor): enable secrets-outside-env
 2026-04-15 16:36:45 +02:00
CrazyMax 8e43476e89 ci(zizmor): enable secrets-outside-env 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-04-15 16:12:55 +02:00
CrazyMaxandGitHub 6525a8f5da Merge pull request #3798 from crazy-max/fix-labeler-workflow 
ci: scope labeler concurrency to the pull request
 2026-04-15 12:10:45 +02:00
CrazyMaxandGitHub 33b7311705 Merge pull request #3796 from docker/dependabot/github_actions/docker/bake-action-7.1.0 
build(deps): bump docker/bake-action from 7.0.0 to 7.1.0
 2026-04-14 10:31:03 +02:00
CrazyMaxandGitHub 1c56abfeb3 Merge pull request #3797 from docker/dependabot/github_actions/softprops/action-gh-release-2.6.2 
build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0
 2026-04-14 10:30:28 +02:00
CrazyMax ee3fc2e4a0 ci: scope labeler concurrency to the pull request 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-04-14 09:55:14 +02:00
CrazyMaxandGitHub c062d2dcf1 Merge pull request #3794 from docker/dependabot/github_actions/actions/upload-artifact-7.0.1 
build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
 2026-04-14 09:53:07 +02:00
CrazyMaxandGitHub 51d374bd4b Merge pull request #3795 from docker/dependabot/github_actions/peter-evans/create-pull-request-8.1.1 
build(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1
 2026-04-14 09:49:06 +02:00
CrazyMaxandGitHub ac8f715ce1 Merge pull request #3789 from crazy-max/bake-hosts-order 
bake: sort extra-hosts before generating build options
 2026-04-14 09:48:18 +02:00
dependabot[bot]andGitHub 306eb5f49d build(deps): bump softprops/action-gh-release from 2.6.1 to 2.6.2 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.6.1 to 2.6.2.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](https://github.com/softprops/action-gh-release/compare/153bb8e04406b158c6c84fc1615b65b24149a1fe...b4309332981a82ec1c5618f44dd2e27cc8bfbfda)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 2.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-13 19:41:47 +00:00
dependabot[bot]andGitHub 1a318bc87b build(deps): bump docker/bake-action from 7.0.0 to 7.1.0 
Bumps [docker/bake-action](https://github.com/docker/bake-action) from 7.0.0 to 7.1.0.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](https://github.com/docker/bake-action/compare/82490499d2e5613fcead7e128237ef0b0ea210f7...a66e1c87e2eca0503c343edf1d208c716d54b8a8)

---
updated-dependencies:
- dependency-name: docker/bake-action
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-13 19:41:40 +00:00
dependabot[bot]andGitHub fdceafbf77 build(deps): bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 8.1.0 to 8.1.1.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](https://github.com/peter-evans/create-pull-request/compare/c0f553fe549906ede9cf27b5156039d195d2ece0...5f6978faf089d4d20b00c7766989d076bb2fc7f1)

---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
  dependency-version: 8.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-13 19:41:18 +00:00
dependabot[bot]andGitHub 61b3803162 build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-13 19:41:12 +00:00
CrazyMax 09f288c71e bake: sort extra-hosts before generating build options 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-04-09 15:53:24 +02:00
CrazyMax 4f89a2407a gitutil: use BuildKit urlutil.RedactCredentials for remote URLs 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-04-09 15:04:37 +02:00
CrazyMax 720f91fdd4 gitutil: migrate to BuildKit GitCLI API 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-04-09 14:57:38 +02:00
CrazyMax 3124b3c839 vendor: update buildkit to a243ce438aee 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-04-09 14:40:14 +02:00
CrazyMaxandGitHub 43fe71eaba Merge pull request #3785 from docker/dependabot/github_actions/crazy-max-dot-github-f0991e81fd 
build(deps): bump the crazy-max-dot-github group with 2 updates
 2026-04-09 10:02:56 +02:00
CrazyMaxandGitHub b1b5f8d4d6 Merge pull request #3786 from docker/dependabot/github_actions/crazy-max/dot-github-1.6.0 
build(deps): bump crazy-max/.github from 1.3.0 to 1.6.0
 2026-04-09 10:02:38 +02:00
Tõnis TiigiandGitHub a5ea0512e7 Merge pull request #3778 from thaJeztah/bump_cli2 
vendor: github.com/docker/cli v29.4.0
 2026-04-08 14:51:17 -07:00
Tõnis TiigiandGitHub c421c14ab6 Merge pull request #3784 from crazy-max/fix-container-wsl-local 
driver: only mount WSL libraries for local docker-container endpoints
 2026-04-08 12:16:12 -07:00
dependabot[bot]andGitHub 09d30f9a60 build(deps): bump crazy-max/.github from 1.3.0 to 1.6.0 
Bumps [crazy-max/.github](https://github.com/crazy-max/.github) from 1.3.0 to 1.6.0.
- [Release notes](https://github.com/crazy-max/.github/releases)
- [Commits](https://github.com/crazy-max/.github/compare/bb328ea508cd6a89d0865555ddbeb148e5724aed...d89fe92d808a15e2b2ed5cdb62db7c172c31410d)

---
updated-dependencies:
- dependency-name: crazy-max/.github
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-08 18:33:51 +00:00
dependabot[bot]andGitHub fec2ec758f build(deps): bump the crazy-max-dot-github group with 2 updates 
Bumps the crazy-max-dot-github group with 2 updates: [crazy-max/.github/.github/workflows/pr-assign-author.yml](https://github.com/crazy-max/.github) and [crazy-max/.github/.github/workflows/zizmor.yml](https://github.com/crazy-max/.github).


Updates `crazy-max/.github/.github/workflows/pr-assign-author.yml` from 1.3.0 to 1.6.0
- [Release notes](https://github.com/crazy-max/.github/releases)
- [Commits](https://github.com/crazy-max/.github/compare/bb328ea508cd6a89d0865555ddbeb148e5724aed...d89fe92d808a15e2b2ed5cdb62db7c172c31410d)

Updates `crazy-max/.github/.github/workflows/zizmor.yml` from 1.3.0 to 1.6.0
- [Release notes](https://github.com/crazy-max/.github/releases)
- [Commits](https://github.com/crazy-max/.github/compare/bb328ea508cd6a89d0865555ddbeb148e5724aed...d89fe92d808a15e2b2ed5cdb62db7c172c31410d)

---
updated-dependencies:
- dependency-name: crazy-max/.github/.github/workflows/pr-assign-author.yml
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: crazy-max-dot-github
- dependency-name: crazy-max/.github/.github/workflows/zizmor.yml
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: crazy-max-dot-github
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-08 18:33:44 +00:00
CrazyMax 48fd4cb3cc driver: only mount WSL libraries for local docker-container endpoints 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2026-04-08 09:39:11 +02:00
CrazyMaxandGitHub d61060eb95 Merge pull request #3781 from docker/dependabot/github_actions/docker/login-action-4.1.0 
build(deps): bump docker/login-action from 4.0.0 to 4.1.0
 2026-04-07 17:01:01 +02:00
CrazyMaxandGitHub 07f3eee98e Merge pull request #3782 from docker/dependabot/github_actions/docker/github-builder/dot-github/workflows/bake.yml-1.5.0 
build(deps): bump docker/github-builder/.github/workflows/bake.yml from 1.4.0 to 1.5.0
 2026-04-07 17:00:44 +02:00
Sebastiaan van Stijn 0b0843233b vendor: github.com/docker/cli v29.4.0 
full diff: https://github.com/docker/cli/compare/v29.3.1...v29.4.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-04-07 11:52:07 +02:00
dependabot[bot]andGitHub e246d3ec7e build(deps): bump docker/github-builder/.github/workflows/bake.yml 
Bumps [docker/github-builder/.github/workflows/bake.yml](https://github.com/docker/github-builder) from 1.4.0 to 1.5.0.
- [Release notes](https://github.com/docker/github-builder/releases)
- [Commits](https://github.com/docker/github-builder/compare/70313223e2665c3211b454b3fea6534624e78d64...2497a7d1e7d8683af4949c9d6d62012bc16ed59c)

---
updated-dependencies:
- dependency-name: docker/github-builder/.github/workflows/bake.yml
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-06 18:33:52 +00:00
dependabot[bot]andGitHub abe28f0203 build(deps): bump docker/login-action from 4.0.0 to 4.1.0 
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.0.0 to 4.1.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/b45d80f862d83dbcd57f89517bcf500b2ab88fb2...4907a6ddec9925e35a0a9e82d7399ccc52663121)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-06 18:33:24 +00:00
Sebastiaan van Stijn 2da27cedb5 vendor: github.com/mattn/go-runewidth v0.0.22 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-04-04 01:41:02 +02:00
Sebastiaan van Stijn eaac97ea66 vendor: golang.org/x/net v0.52.0 
full diff: https://cs.opensource.google/go/x/net/+/refs/tags/v0.50.0...refs/tags/v0.52.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-04-04 01:41:02 +02:00
Sebastiaan van Stijn df41850e26 vendor: golang.org/x/time v0.15.0 
full diff: https://cs.opensource.google/go/x/time/+/refs/tags/v0.14.0...refs/tags/v0.15.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-04-04 01:41:02 +02:00
Sebastiaan van Stijn db4fa7c158 vendor: golang.org/x/text v0.35.0 
full diff: https://cs.opensource.google/go/x/text/+/refs/tags/v0.34.0...refs/tags/v0.35.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-04-04 01:41:02 +02:00
Sebastiaan van Stijn 2700871d66 vendor: golang.org/x/mod v0.34.0 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-04-04 01:41:02 +02:00
Sebastiaan van Stijn 3ad8f0891a vendor: golang.org/x/sync v0.20.0 
full diff: https://cs.opensource.google/go/x/sync/+/refs/tags/v0.19.0...refs/tags/v0.20.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-04-04 01:41:02 +02:00
Sebastiaan van Stijn 63b4d001aa vendor: go.opentelemetry.io/otel v1.42.0, otel/contrib v1.67.0 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-04-04 01:41:01 +02:00
Tõnis TiigiandGitHub b180175396 Merge pull request #3779 from thaJeztah/bump_moby 
vendor: moby/client v0.4.0, moby/api v1.54.1
 2026-04-03 11:36:47 -07:00
Jonathan A. SternbergandGitHub 530dc0bdae Merge pull request #3770 from jsternberg/containerd-source-date-epoch 
commands: micro optimization for source date epoch
 2026-04-03 11:06:29 -05:00
Jonathan A. Sternberg d781c83cec commands: micro optimization for source date epoch 
Avoids the call to `os.Getenv` when it is unnecessary because it would
be overwritten anyway.

Removes the comments about moving environment variable parsing to a
method for use by library consumers. That method exists in containerd
and this set of code doesn't actually perform any parsing since the
parsing of this time is done within buildkit and not on the client.

Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
 2026-04-03 10:02:50 -05:00
Sebastiaan van Stijn 3b630c6437 vendor: moby/client v0.4.0, moby/api v1.54.1 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2026-04-03 16:05:48 +02:00
CrazyMaxandGitHub 6bde7f2320 Merge pull request #3775 from glours/bump-compose-go-v2.10.2 
bump compose-go to version v2.10.2
 2026-04-03 15:20:22 +02:00
Guillaume Lours 8a01076b67 bump compose-go to version v2.10.2 
Signed-off-by: Guillaume Lours <glours@users.noreply.github.com>
 2026-04-03 12:15:27 +02:00
CrazyMaxandGitHub 182f1f4107 Merge pull request #3769 from tonistiigi/pgp-test-flaky-fix 
policy: fix flaky HTTP PGP test
 2026-04-02 09:50:19 +02:00