Merge pull request #299 from crazy-max/split-docs

Enhance documentation

.dockerignore

@@ -0,0 +1 @@
+node_modules

.editorconfig

@@ -0,0 +1,15 @@
+# This file is for unifying the coding style for different editors and IDEs.
+# More information at http://editorconfig.org
+
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.md]
+trim_trailing_whitespace = false

.gitattributes

@@ -0,0 +1,2 @@
+/dist/** linguist-generated=true
+/lib/** linguist-generated=true

.github/CODEOWNERS

@@ -0,0 +1 @@
+*	@crazy-max

.github/CONTRIBUTING.md

@@ -0,0 +1,44 @@
+## Contributing
+
+Hi there! We're thrilled that you'd like to contribute to this project. Your help is essential for keeping it great.
+
+Contributions to this project are [released](https://help.github.com/articles/github-terms-of-service/#6-contributions-under-repository-license) to the public under the [project's open source license](LICENSE).
+
+## Submitting a pull request
+
+1. [Fork](https://github.com/docker/build-push-action/fork) and clone the repository
+2. Configure and install the dependencies: `yarn install`
+3. Make sure the tests pass on your machine: `yarn run test`
+4. Create a new branch: `git checkout -b my-branch-name`
+5. Make your change, add tests, and make sure the tests still pass
+6. Run pre-checkin: `yarn run pre-checkin`
+7. Push to your fork and [submit a pull request](https://github.com/docker/build-push-action/compare)
+8. Pat your self on the back and wait for your pull request to be reviewed and merged.
+
+## Container based developer flow
+
+If you don't want to maintain a Node developer environment that fits this project you can use containerized commands instead of invoking yarn directly.
+
+```
+# format code and build javascript artifacts
+docker buildx bake pre-checkin
+
+# validate all code has correctly formatted and built
+docker buildx bake validate
+
+# run tests
+docker buildx bake test
+```
+
+Here are a few things you can do that will increase the likelihood of your pull request being accepted:
+
+- Make sure the `README.md` and any other relevant **documentation are kept up-to-date**.
+- We try to follow [SemVer v2.0.0](https://semver.org/). Randomly breaking public APIs is not an option.
+- Keep your change as focused as possible. If there are multiple changes you would like to make that are not dependent upon each other, consider submitting them as **separate pull requests**.
+- Write a [good commit message](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html).
+
+## Resources
+
+- [How to Contribute to Open Source](https://opensource.guide/how-to-contribute/)
+- [Using Pull Requests](https://help.github.com/articles/about-pull-requests/)
+- [GitHub Help](https://help.github.com)

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,37 @@
+---
+name: Bug report
+about: Create a report to help us improve
+---
+
+### Troubleshooting
+
+Before sumbitting a bug report please read the [Troubleshooting doc](https://github.com/docker/build-push-action/blob/master/TROUBLESHOOTING.md).
+
+### Behaviour
+
+#### Steps to reproduce this issue
+
+1.
+2.
+3.
+
+#### Expected behaviour
+
+> Tell us what should happen
+
+#### Actual behaviour
+
+> Tell us what happens instead
+
+### Configuration
+
+* Repository URL (if public): 
+* Build URL (if public): 
+
+```yml
+# paste your YAML workflow file here and remove sensitive data
+```
+
+### Logs
+
+> Download the [log file of your build](https://help.github.com/en/actions/configuring-and-managing-workflows/managing-a-workflow-run#downloading-logs) and [attach it](https://help.github.com/en/github/managing-your-work-on-github/file-attachments-on-issues-and-pull-requests) to this issue.

.github/SUPPORT.md

@@ -0,0 +1,31 @@
+# Support [![](https://isitmaintained.com/badge/resolution/docker/build-push-action.svg)](https://isitmaintained.com/project/docker/build-push-action)
+
+First, [be a good guy](https://github.com/kossnocorp/etiquette/blob/master/README.md).
+
+## Reporting an issue
+
+Please do a search in [open issues](https://github.com/docker/build-push-action/issues?utf8=%E2%9C%93&q=) to see if the issue or feature request has already been filed.
+
+If you find your issue already exists, make relevant comments and add your [reaction](https://github.com/blog/2119-add-reactions-to-pull-requests-issues-and-comments). Use a reaction in place of a "+1" comment.
+
+:+1: - upvote
+
+:-1: - downvote
+
+If you cannot find an existing issue that describes your bug or feature, submit an issue using the guidelines below.
+
+## Writing good bug reports and feature requests
+
+File a single issue per problem and feature request.
+
+* Do not enumerate multiple bugs or feature requests in the same issue.
+* Do not add your issue as a comment to an existing issue unless it's for the identical input. Many issues look similar, but have different causes.
+
+The more information you can provide, the more likely someone will be successful reproducing the issue and finding a fix.
+
+You are now ready to [create a new issue](https://github.com/docker/build-push-action/issues/new/choose)!
+
+## Closure policy
+
+* Issues that don't have the information requested above (when applicable) will be closed immediately and the poster directed to the support guidelines.
+* Issues that go a week without a response from original poster are subject to closure at our discretion.

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    labels:
+      - ":game_die: dependencies"
+      - ":robot: bot"
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    allow:
+      - dependency-type: "production"
+    labels:
+      - ":game_die: dependencies"
+      - ":robot: bot"

.github/workflows/ci.yml

@@ -0,0 +1,594 @@
+name: ci
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  minimal:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+        with:
+          path: action
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      -
+        name: Build
+        uses: ./action
+        with:
+          file: ./test/Dockerfile
+      -
+        name: Dump context
+        if: always()
+        uses: crazy-max/ghaction-dump-context@v1
+
+  git-context:
+    runs-on: ubuntu-latest
+    services:
+      registry:
+        image: registry:2
+        ports:
+          - 5000:5000
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+        with:
+          path: action
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      -
+        name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v1
+        with:
+          version: latest
+          driver-opts: network=host
+      -
+        name: Build and push
+        id: docker_build
+        uses: ./action
+        with:
+          file: ./test/Dockerfile
+          builder: ${{ steps.buildx.outputs.name }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            localhost:5000/name/app:latest
+            localhost:5000/name/app:1.0.0
+      -
+        name: Inspect
+        run: |
+          docker buildx imagetools inspect localhost:5000/name/app:1.0.0
+      -
+        name: Image digest
+        run: echo ${{ steps.docker_build.outputs.digest }}
+      -
+        name: Check digest
+        run: |
+          if [ -z "${{ steps.docker_build.outputs.digest }}" ]; then
+            echo "::error::Digest should not be empty"
+            exit 1
+          fi
+      -
+        name: Dump context
+        if: always()
+        uses: crazy-max/ghaction-dump-context@v1
+
+  git-context-secret:
+    runs-on: ubuntu-latest
+    services:
+      registry:
+        image: registry:2
+        ports:
+          - 5000:5000
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+        with:
+          path: action
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      -
+        name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v1
+        with:
+          driver-opts: network=host
+      -
+        name: Build and push
+        id: docker_build
+        uses: ./action
+        with:
+          file: ./test/Dockerfile
+          builder: ${{ steps.buildx.outputs.name }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            localhost:5000/name/app:latest
+            localhost:5000/name/app:1.0.0
+          secrets: |
+            GIT_AUTH_TOKEN=${{ github.token }}
+            "MYSECRET=aaaaaaaa
+            bbbbbbb
+            ccccccccc"
+            FOO=bar
+            "EMPTYLINE=aaaa
+
+            bbbb
+            ccc"
+      -
+        name: Inspect
+        run: |
+          docker buildx imagetools inspect localhost:5000/name/app:1.0.0
+      -
+        name: Image digest
+        run: echo ${{ steps.docker_build.outputs.digest }}
+      -
+        name: Check digest
+        run: |
+          if [ -z "${{ steps.docker_build.outputs.digest }}" ]; then
+            echo "::error::Digest should not be empty"
+            exit 1
+          fi
+      -
+        name: Dump context
+        if: always()
+        uses: crazy-max/ghaction-dump-context@v1
+
+  path-context:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        buildx-version:
+          - ""
+          - latest
+    services:
+      registry:
+        image: registry:2
+        ports:
+          - 5000:5000
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      -
+        name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v1
+        with:
+          version: ${{ matrix.buildx-version }}
+          driver-opts: network=host
+      -
+        name: Build and push
+        id: docker_build
+        uses: ./
+        with:
+          context: ./test
+          file: ./test/Dockerfile
+          builder: ${{ steps.buildx.outputs.name }}
+          push: true
+          tags: |
+            localhost:5000/name/app:latest
+            localhost:5000/name/app:1.0.0
+      -
+        name: Inspect
+        run: |
+          docker buildx imagetools inspect localhost:5000/name/app:1.0.0
+      -
+        name: Image digest
+        run: echo ${{ steps.docker_build.outputs.digest }}
+      -
+        name: Check digest
+        run: |
+          if [ -z "${{ steps.docker_build.outputs.digest }}" ]; then
+            echo "::error::Digest should not be empty"
+            exit 1
+          fi
+      -
+        name: Dump context
+        if: always()
+        uses: crazy-max/ghaction-dump-context@v1
+
+  error:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      -
+        name: Build
+        id: docker_build
+        continue-on-error: true
+        uses: ./
+        with:
+          context: ./test
+          file: ./test/Dockerfile
+          platforms: linux/386,linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
+          push: true
+          tags: localhost:5000/name/app:latest
+      -
+        name: Check
+        run: |
+          echo "${{ toJson(steps.docker_build) }}"
+          if [ "${{ steps.docker_build.outcome }}" != "failure" ] || [ "${{ steps.docker_build.conclusion }}" != "success" ]; then
+            echo "::error::Should have failed"
+            exit 1
+          fi
+      -
+        name: Dump context
+        if: always()
+        uses: crazy-max/ghaction-dump-context@v1
+
+  docker-driver:
+    runs-on: ubuntu-latest
+    services:
+      registry:
+        image: registry:2
+        ports:
+          - 5000:5000
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Build
+        id: docker_build
+        uses: ./
+        with:
+          context: ./test
+          file: ./test/Dockerfile
+          push: true
+          tags: localhost:5000/name/app:latest
+      -
+        name: Dump context
+        if: always()
+        uses: crazy-max/ghaction-dump-context@v1
+
+  export-docker:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Build
+        uses: ./
+        with:
+          context: ./test
+          file: ./test/Dockerfile
+          load: true
+          tags: myimage:latest
+      -
+        name: Inspect
+        run: |
+          docker image inspect myimage:latest
+      -
+        name: Dump context
+        if: always()
+        uses: crazy-max/ghaction-dump-context@v1
+
+  multi:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        buildx-version:
+          - ""
+          - latest
+        dockerfile:
+          - multi
+          - multi-sudo
+    services:
+      registry:
+        image: registry:2
+        ports:
+          - 5000:5000
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      -
+        name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v1
+        with:
+          version: ${{ matrix.buildx-version }}
+          driver-opts: network=host
+      -
+        name: Build and push
+        id: docker_build
+        uses: ./
+        with:
+          context: ./test
+          file: ./test/Dockerfile-${{ matrix.dockerfile }}
+          builder: ${{ steps.buildx.outputs.name }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            localhost:5000/name/app:latest
+            localhost:5000/name/app:1.0.0
+      -
+        name: Inspect
+        run: |
+          docker buildx imagetools inspect localhost:5000/name/app:1.0.0
+      -
+        name: Image digest
+        run: echo ${{ steps.docker_build.outputs.digest }}
+      -
+        name: Check digest
+        run: |
+          if [ -z "${{ steps.docker_build.outputs.digest }}" ]; then
+            echo "::error::Digest should not be empty"
+            exit 1
+          fi
+      -
+        name: Dump context
+        if: always()
+        uses: crazy-max/ghaction-dump-context@v1
+
+  registry-cache:
+    runs-on: ubuntu-latest
+    services:
+      registry:
+        image: registry:2
+        ports:
+          - 5000:5000
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      -
+        name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v1
+        with:
+          driver-opts: |
+            network=host
+      -
+        name: Build and push (1)
+        id: docker_build
+        uses: ./
+        with:
+          context: ./test
+          file: ./test/Dockerfile-multi
+          builder: ${{ steps.buildx.outputs.name }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            localhost:5000/name/app:latest
+            localhost:5000/name/app:1.0.0
+          cache-from: type=registry,ref=localhost:5000/name/app
+          cache-to: type=inline
+      -
+        name: Inspect (1)
+        run: |
+          docker buildx imagetools inspect localhost:5000/name/app:latest
+      -
+        name: Image digest (1)
+        run: echo ${{ steps.docker_build.outputs.digest }}
+      -
+        name: Check digest (1)
+        run: |
+          if [ -z "${{ steps.docker_build.outputs.digest }}" ]; then
+            echo "::error::Digest should not be empty"
+            exit 1
+          fi
+      -
+        name: Prune
+        run: |
+          docker buildx prune -a -f --verbose
+      -
+        name: Build and push (2)
+        id: docker_build2
+        uses: ./
+        with:
+          context: ./test
+          file: ./test/Dockerfile-multi
+          builder: ${{ steps.buildx.outputs.name }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            localhost:5000/name/app:latest
+            localhost:5000/name/app:1.0.0
+          cache-from: type=registry,ref=localhost:5000/name/app
+          cache-to: type=inline
+      -
+        name: Inspect (2)
+        run: |
+          docker buildx imagetools inspect localhost:5000/name/app:latest
+      -
+        name: Image digest (2)
+        run: echo ${{ steps.docker_build2.outputs.digest }}
+      -
+        name: Check digest (2)
+        run: |
+          if [ -z "${{ steps.docker_build2.outputs.digest }}" ]; then
+            echo "::error::Digest should not be empty"
+            exit 1
+          fi
+      -
+        name: Compare digests
+        run: |
+          echo Compare "${{ steps.docker_build.outputs.digest }}" with "${{ steps.docker_build2.outputs.digest }}"
+          if [ "${{ steps.docker_build.outputs.digest }}" != "${{ steps.docker_build2.outputs.digest }}" ]; then
+            echo "::error::Digests should be identical"
+            exit 1
+          fi
+      -
+        name: Dump context
+        if: always()
+        uses: crazy-max/ghaction-dump-context@v1
+
+  github-cache-first:
+    runs-on: ubuntu-latest
+    outputs:
+      digest: ${{ steps.docker_build.outputs.digest }}
+    services:
+      registry:
+        image: registry:2
+        ports:
+          - 5000:5000
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      -
+        name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v1
+        with:
+          driver-opts: |
+            network=host
+      -
+        name: Cache Docker layers
+        uses: actions/cache@v2
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-ghcache-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-ghcache-
+      -
+        name: Erase cache
+        run: |
+          rm -rf /tmp/.buildx-cache/*
+      -
+        name: Build and push
+        id: docker_build
+        uses: ./
+        with:
+          context: ./test
+          file: ./test/Dockerfile-multi
+          builder: ${{ steps.buildx.outputs.name }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            localhost:5000/name/app:latest
+            localhost:5000/name/app:1.0.0
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache
+      -
+        name: Inspect
+        run: |
+          docker buildx imagetools inspect localhost:5000/name/app:1.0.0
+      -
+        name: Image digest
+        run: echo ${{ steps.docker_build.outputs.digest }}
+      -
+        name: Check digest
+        run: |
+          if [ -z "${{ steps.docker_build.outputs.digest }}" ]; then
+            echo "::error::Digest should not be empty"
+            exit 1
+          fi
+      -
+        name: Dump context
+        if: always()
+        uses: crazy-max/ghaction-dump-context@v1
+
+  github-cache-hit:
+    runs-on: ubuntu-latest
+    needs: github-cache-first
+    services:
+      registry:
+        image: registry:2
+        ports:
+          - 5000:5000
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      -
+        name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v1
+        with:
+          driver-opts: |
+            network=host
+      -
+        name: Cache Docker layers
+        uses: actions/cache@v2
+        id: cache
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-ghcache-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-ghcache-
+      -
+        name: Build and push
+        id: docker_build
+        uses: ./
+        with:
+          context: ./test
+          file: ./test/Dockerfile-multi
+          builder: ${{ steps.buildx.outputs.name }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            localhost:5000/name/app:latest
+            localhost:5000/name/app:1.0.0
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache
+      -
+        name: Inspect
+        run: |
+          docker buildx imagetools inspect localhost:5000/name/app:1.0.0
+      -
+        name: Image digest
+        run: echo ${{ steps.docker_build.outputs.digest }}
+      -
+        name: Check digest
+        run: |
+          if [ -z "${{ steps.docker_build.outputs.digest }}" ]; then
+            echo "::error::Digest should not be empty"
+            exit 1
+          fi
+      -
+        name: Compare digests
+        run: |
+          echo Compare "${{ needs.github-cache-first.outputs.digest }}" with "${{ steps.docker_build.outputs.digest }}"
+          if [ "${{ needs.github-cache-first.outputs.digest }}" != "${{ steps.docker_build.outputs.digest }}" ]; then
+            echo "::error::Digests should be identical"
+            exit 1
+          fi
+      -
+        name: Cache hit
+        run: echo ${{ steps.cache.outputs.cache-hit }}
+      -
+        name: Dump context
+        if: always()
+        uses: crazy-max/ghaction-dump-context@v1

.github/workflows/e2e.yml

@@ -0,0 +1,105 @@
+name: e2e
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 10 * * *' # everyday at 10am
+  push:
+    branches:
+      - master
+    tags:
+      - v*
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          -
+            registry: ''
+            slug: ghactionstest/ghactionstest
+            username_secret: DOCKERHUB_USERNAME
+            password_secret: DOCKERHUB_TOKEN
+          -
+            registry: ghcr.io
+            slug: ghcr.io/docker-ghactiontest/test
+            username_secret: GHCR_USERNAME
+            password_secret: GHCR_PAT
+          -
+            registry: registry.gitlab.com
+            slug: registry.gitlab.com/test1716/test
+            username_secret: GITLAB_USERNAME
+            password_secret: GITLAB_TOKEN
+          -
+            registry: 175142243308.dkr.ecr.us-east-2.amazonaws.com
+            slug: 175142243308.dkr.ecr.us-east-2.amazonaws.com/sandbox/test-docker-action
+            username_secret: AWS_ACCESS_KEY_ID
+            password_secret: AWS_SECRET_ACCESS_KEY
+          -
+            registry: public.ecr.aws
+            slug: public.ecr.aws/q3b5f1u4/test-docker-action
+            username_secret: AWS_ACCESS_KEY_ID
+            password_secret: AWS_SECRET_ACCESS_KEY
+          -
+            registry: us-east4-docker.pkg.dev
+            slug: us-east4-docker.pkg.dev/sandbox-298914/docker-official-github-actions/test-docker-action
+            username_secret: GAR_USERNAME
+            password_secret: GAR_JSON_KEY
+          -
+            registry: gcr.io
+            slug: gcr.io/sandbox-298914/test-docker-action
+            username_secret: GCR_USERNAME
+            password_secret: GCR_JSON_KEY
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Docker meta
+        id: docker_meta
+        uses: crazy-max/ghaction-docker-meta@v1
+        with:
+          images: ${{ matrix.slug }}
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      -
+        name: Login to Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v1
+        with:
+          registry: ${{ matrix.registry }}
+          username: ${{ secrets[matrix.username_secret] }}
+          password: ${{ secrets[matrix.password_secret] }}
+      -
+        name: Build and push
+        uses: ./
+        with:
+          context: ./test
+          file: ./test/Dockerfile-multi
+          platforms: linux/386,linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64,linux/ppc64le,linux/s390x
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.docker_meta.outputs.tags }}
+          labels: ${{ steps.docker_meta.outputs.labels }}
+          cache-from: type=registry,ref=${{ matrix.slug }}:master
+          cache-to: type=inline
+      -
+        name: Inspect image
+        if: github.event_name != 'pull_request'
+        run: |
+          docker pull ${{ matrix.slug }}:${{ steps.docker_meta.outputs.version }}
+          docker image inspect ${{ matrix.slug }}:${{ steps.docker_meta.outputs.version }}
+      -
+        name: Check manifest
+        if: github.event_name != 'pull_request'
+        run: |
+          docker buildx imagetools inspect ${{ matrix.slug }}:${{ steps.docker_meta.outputs.version }}
+      -
+        name: Dump context
+        if: always()
+        uses: crazy-max/ghaction-dump-context@v1

.github/workflows/example.yml

@@ -0,0 +1,71 @@
+# This workflow is provided just as an usage example and not for repo testing/verification
+name: example
+
+on:
+  schedule:
+    - cron: '0 10 * * 0' # everyday sunday at 10am
+  push:
+    branches:
+      - '**'
+    tags:
+      - 'v*.*.*'
+  pull_request:
+
+env:
+  DOCKER_IMAGE: localhost:5000/name/app
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    services:
+      registry:
+        image: registry:2
+        ports:
+          - 5000:5000
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Docker meta
+        id: docker_meta
+        uses: crazy-max/ghaction-docker-meta@v1
+        with:
+          images: ${{ env.DOCKER_IMAGE }} # list of Docker images to use as base name for tags
+          tag-sha: true # add git short SHA as Docker tag
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+        with:
+          driver-opts: network=host
+      -
+        name: Build and export to Docker client
+        uses: ./
+        with:
+          context: ./test
+          file: ./test/Dockerfile
+          load: true
+          tags: ${{ steps.docker_meta.outputs.tags }}
+          labels: ${{ steps.docker_meta.outputs.labels }}
+      -
+        name: Build and push to local registry
+        uses: ./
+        with:
+          context: ./test
+          file: ./test/Dockerfile
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.docker_meta.outputs.tags }}
+          labels: ${{ steps.docker_meta.outputs.labels }}
+      -
+        name: Inspect image
+        run: |
+          docker image inspect ${{ env.DOCKER_IMAGE }}:${{ steps.docker_meta.outputs.version }}
+      -
+        name: Check manifest
+        if: github.event_name != 'pull_request'
+        run: |
+          docker buildx imagetools inspect ${{ env.DOCKER_IMAGE }}:${{ steps.docker_meta.outputs.version }}
+      -
+        name: Dump context
+        if: always()
+        uses: crazy-max/ghaction-dump-context@v1

.github/workflows/main.yml

@@ -1,37 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches:
-      - master
-    tags:
-      - '*'
-  pull_request:
-
-jobs:
-  build:
-    name: build
-    runs-on: ubuntu-latest
-    timeout-minutes: 3
-    steps:
-
-    - name: Checkout
-      uses: actions/checkout@v2
-    
-    - name: Run local registry
-      run: docker run -d -p 5000:5000 registry:2
-    
-    - name: Build and push image
-      uses: ./
-      env:
-        DOCKER_BUILDKIT: 1
-      with:
-        registry: localhost:5000
-        repository: temp/workflow
-        tags: foo
-      
-    - name: Remove local image
-      run: docker image rm localhost:5000/temp/workflow:foo
-
-    - name: Run image from registry
-      run: docker run localhost:5000/temp/workflow:foo

.github/workflows/test.yml

@@ -0,0 +1,43 @@
+name: test
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  test-containerized:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Validate
+        run: docker buildx bake validate
+      -
+        name: Test
+        run: docker buildx bake test
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Install
+        run: yarn install
+      -
+        name: Test
+        run: yarn run test
+      -
+        name: Upload coverage
+        uses: codecov/codecov-action@v1
+        if: success()
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          file: ./coverage/clover.xml

.github/workflows/virtual-env.yml

@@ -0,0 +1,38 @@
+name: virtual-env
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 10 * * *' # everyday at 10am
+
+jobs:
+  os:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - ubuntu-20.04
+          - ubuntu-18.04
+          - ubuntu-16.04
+    steps:
+      -
+        name: List install packages
+        run: apt list --installed
+      -
+        name: Docker info
+        run: docker info
+      -
+        name: Docker version
+        run: docker version
+      -
+        name: buildx version
+        run: docker buildx version
+      -
+        name: containerd version
+        run: containerd --version
+      -
+        name: Dump context
+        if: always()
+        uses: crazy-max/ghaction-dump-context@v1

.gitignore

@@ -0,0 +1,95 @@
+node_modules
+lib
+
+# Jetbrains
+/.idea
+/*.iml
+
+# Rest of the file pulled from https://github.com/github/gitignore/blob/master/Node.gitignore
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+
+# Diagnostic reports (https://nodejs.org/api/report.html)
+report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
+
+# Runtime data
+pids
+*.pid
+*.seed
+*.pid.lock
+
+# Directory for instrumented libs generated by jscoverage/JSCover
+lib-cov
+
+# Coverage directory used by tools like istanbul
+coverage
+*.lcov
+
+# nyc test coverage
+.nyc_output
+
+# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
+.grunt
+
+# Bower dependency directory (https://bower.io/)
+bower_components
+
+# node-waf configuration
+.lock-wscript
+
+# Compiled binary addons (https://nodejs.org/api/addons.html)
+build/Release
+
+# Dependency directories
+jspm_packages/
+
+# TypeScript v1 declaration files
+typings/
+
+# TypeScript cache
+*.tsbuildinfo
+
+# Optional npm cache directory
+.npm
+
+# Optional eslint cache
+.eslintcache
+
+# Optional REPL history
+.node_repl_history
+
+# Output of 'npm pack'
+*.tgz
+
+# Yarn Integrity file
+.yarn-integrity
+
+# dotenv environment variables file
+.env
+.env.test
+
+# parcel-bundler cache (https://parceljs.org/)
+.cache
+
+# next.js build output
+.next
+
+# nuxt.js build output
+.nuxt
+
+# vuepress build output
+.vuepress/dist
+
+# Serverless directories
+.serverless/
+
+# FuseBox cache
+.fusebox/
+
+# DynamoDB Local files
+.dynamodb/

.prettierrc.json

@@ -0,0 +1,11 @@
+{
+  "printWidth": 120,
+  "tabWidth": 2,
+  "useTabs": false,
+  "semi": true,
+  "singleQuote": true,
+  "trailingComma": "none",
+  "bracketSpacing": false,
+  "arrowParens": "avoid",
+  "parser": "typescript"
+}

Dockerfile

@@ -1,3 +1,52 @@
-FROM alpine:3
+#syntax=docker/dockerfile:1.2
 
-ENTRYPOINT ["echo", "docker github actions"]
+FROM node:12 AS deps
+WORKDIR /src
+COPY package.json yarn.lock ./
+RUN --mount=type=cache,target=/usr/local/share/.cache/yarn \
+  yarn install
+
+FROM scratch AS update-yarn
+COPY --from=deps /src/yarn.lock /
+
+FROM deps AS validate-yarn
+COPY .git .git
+RUN status=$(git status --porcelain -- yarn.lock); if [ -n "$status" ]; then echo $status; exit 1; fi
+
+FROM deps AS base
+COPY . .
+
+FROM base AS build
+RUN yarn build
+
+FROM deps AS test
+COPY --from=docker /usr/local/bin/docker /usr/bin/
+ARG TARGETOS
+ARG TARGETARCH
+ARG BUILDX_VERSION=v0.5.1
+ENV RUNNER_TEMP=/tmp/github_runner
+ENV RUNNER_TOOL_CACHE=/tmp/github_tool_cache
+RUN mkdir -p /usr/local/lib/docker/cli-plugins && \
+  curl -fsSL https://github.com/docker/buildx/releases/download/$BUILDX_VERSION/buildx-$BUILDX_VERSION.$TARGETOS-$TARGETARCH > /usr/local/lib/docker/cli-plugins/docker-buildx && \
+  chmod +x /usr/local/lib/docker/cli-plugins/docker-buildx && \
+  docker buildx version
+COPY . .
+RUN yarn run test
+
+FROM base AS run-format
+RUN yarn run format
+
+FROM scratch AS format
+COPY --from=run-format /src/src/*.ts /src/
+
+FROM base AS validate-format
+RUN yarn run format-check
+
+FROM scratch AS dist
+COPY --from=build /src/dist/ /dist/
+
+FROM build AS validate-build
+RUN status=$(git status --porcelain -- dist); if [ -n "$status" ]; then echo $status; exit 1; fi
+
+FROM base AS dev
+ENTRYPOINT ["bash"]

LICENSE

@@ -188,4 +188,4 @@
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
-   limitations under the License.
+   limitations under the License.

README.md

@@ -1,193 +1,253 @@
-# build-push-action
+[![GitHub release](https://img.shields.io/github/release/docker/build-push-action.svg?style=flat-square)](https://github.com/docker/build-push-action/releases/latest)
+[![GitHub marketplace](https://img.shields.io/badge/marketplace-build--and--push--docker--images-blue?logo=github&style=flat-square)](https://github.com/marketplace/actions/build-and-push-docker-images)
+[![CI workflow](https://img.shields.io/github/workflow/status/docker/build-push-action/ci?label=ci&logo=github&style=flat-square)](https://github.com/docker/build-push-action/actions?workflow=ci)
+[![Test workflow](https://img.shields.io/github/workflow/status/docker/build-push-action/test?label=test&logo=github&style=flat-square)](https://github.com/docker/build-push-action/actions?workflow=test)
+[![Codecov](https://img.shields.io/codecov/c/github/docker/build-push-action?logo=codecov&style=flat-square)](https://codecov.io/gh/docker/build-push-action)
 
-Builds and pushes Docker images and will log in to a Docker registry if required.
+## Upgrade from v1
 
-Suggestions and issues can be posted on the repositories [issues page](https://github.com/docker/build-push-action/issues).
+`v2` of this action includes significant updates and now uses Docker [Buildx](https://github.com/docker/buildx). It's
+also rewritten as a [typescript-action](https://github.com/actions/typescript-action/) to be as close as possible
+of the [GitHub Runner](https://github.com/actions/virtual-environments) during its execution.
 
-[Inputs](#Inputs)
-* [repository](#repository)
-* [username](#username)
-* [password](#password)
-* [registry](#registry)
-* [tags](#tags)
-* [tag_with_ref](#tag_with_ref)
-* [tag_with_sha](#tag_with_sha)
-* [path](#path)
-* [dockerfile](#dockerfile)
-* [target](#target)
-* [always_pull](#always_pull)
-* [build_args](#build_args)
-* [labels](#labels)
-* [add_git_labels](#add_git_labels)
-* [push](#push)
+[Upgrade notes](UPGRADE.md) with many [usage examples](#advanced-usage) have been added to handle most use cases but
+`v1` is still available through [`releases/v1` branch](https://github.com/docker/build-push-action/tree/releases/v1).
 
-[Example usage](#Example-usage)
+## About
 
-## Inputs
+GitHub Action to build and push Docker images with [Buildx](https://github.com/docker/buildx) with full support of the
+features provided by [Moby BuildKit](https://github.com/moby/buildkit) builder toolkit. This includes multi-platform
+build, secrets, remote cache, etc. and different builder deployment/namespacing options.
 
-### `repository`
+> :bulb: See also:
+> * [login](https://github.com/docker/login-action) action
+> * [setup-buildx](https://github.com/docker/setup-buildx-action) action
+> * [setup-qemu](https://github.com/docker/setup-qemu-action) action
 
-**Required** Docker repository to tag the image with.
+![Screenshot](.github/build-push-action.png)
 
-### `username`
+___
 
-Username used to log in to a Docker registry. If not set then no login will occur.
+* [Usage](#usage)
+  * [Git context](#git-context)
+  * [Path context](#path-context)
+* [Advanced usage](#advanced-usage)
+  * [Multi-platform image](docs/advanced/multi-platform.md)
+  * [Secrets](docs/advanced/secrets.md)
+  * [Isolated builders](docs/advanced/isolated-builders.md)
+  * [Push to multi-registries](docs/advanced/push-multi-registries.md)
+  * [Cache](docs/advanced/cache.md)
+    * [Registry cache](docs/advanced/cache.md#registry-cache)
+    * [GitHub cache](docs/advanced/cache.md#github-cache)
+  * [Local registry](docs/advanced/local-registry.md)
+  * [Export image to Docker](docs/advanced/export-docker.md)
+  * [Handle tags and labels](docs/advanced/tags-labels.md)
+  * [Update DockerHub repo description](docs/advanced/dockerhub-desc.md)
+* [Customizing](#customizing)
+  * [inputs](#inputs)
+  * [outputs](#outputs)
+* [Troubleshooting](#troubleshooting)
+* [Keep up-to-date with GitHub Dependabot](#keep-up-to-date-with-github-dependabot)
+* [Limitation](#limitation)
 
-### `password`
+## Usage
 
-Password or personal access token used to log in to a Docker registry. If not set then no login will occur.
+By default, this action uses the [Git context](#git-context) so you don't need to use the
+[`actions/checkout`](https://github.com/actions/checkout/) action to checkout the repository because this will be
+done directly by buildkit. The git reference will be based on the [event that triggered your workflow](https://docs.github.com/en/actions/reference/events-that-trigger-workflows)
+and will result in the following context: `https://github.com/<owner>/<repo>.git#<ref>`.
 
-### `registry`
+Be careful because **any file mutation in the steps that precede the build step will be ignored** since
+the context is based on the git reference. However, you can use the [Path context](#path-context) using the
+[`context` input](#inputs) alongside the [`actions/checkout`](https://github.com/actions/checkout/) action to remove
+this restriction.
 
-Server address of Docker registry. If not set then will default to Docker Hub.
+In the examples below we are using 3 other actions:
 
-### `tags`
+* [`setup-buildx`](https://github.com/docker/setup-buildx-action) action will create and boot a builder using by 
+default the `docker-container` [builder driver](https://github.com/docker/buildx#--driver-driver). This is
+**not required but recommended** using it to be able to build multi-platform images, export cache, etc.
+* [`setup-qemu`](https://github.com/docker/setup-qemu-action) action can be useful if you want
+to add emulation support with QEMU to be able to build against more platforms. 
+* [`login`](https://github.com/docker/setup-qemu-action) action will take care to log in against a Docker registry.
 
-Comma-delimited list of tags. These will be added to the registry/repository to form the image's tags.
-
-Example:
+### Git context
 
 ```yaml
-tags: tag1,tag2
+name: ci
+
+on:
+  push:
+    branches:
+      - 'master'
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      -
+        name: Login to DockerHub
+        uses: docker/login-action@v1 
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: Build and push
+        id: docker_build
+        uses: docker/build-push-action@v2
+        with:
+          push: true
+          tags: user/app:latest
+      -
+        name: Image digest
+        run: echo ${{ steps.docker_build.outputs.digest }}
 ```
 
-### `tag_with_ref`
-
-Boolean value. Defaults to `false`.
-
-Automatically tags the built image with the git reference. The format of the tag depends on the type of git reference with all forward slashes replaced with `-`.
-
-For pushes to a branch the reference will be `refs/heads/{branch-name}` and the tag will be `{branch-name}`. If `{branch-name}` is master then the tag will be `latest`.
-
-For pull requests the reference will be `refs/pull/{pull-request}` and the tag will be `pr-{pull-request}`.
-
-For git tags the reference will be `refs/tags/{git-tag}` and the tag will be `{git-tag}`.
-
-Examples:
-
-|Git Reference|Image tag|
-|---|---|
-|`refs/heads/master`|`latest`|
-|`refs/heads/my/branch`|`my-branch`|
-|`refs/pull/2/merge`|`pr-2-merge`|
-|`refs/tags/v1.0.0`|`v1.0.0`|
-
-### `tag_with_sha`
-
-Boolean value. Defaults to `false`.
-
-Automatically tags the built image with the git short SHA prefixed with `sha-`.
-
-Example:
-
-|Git SHA|Image tag|
-|---|---|
-|`676cae2f85471aeff6776463c72881ebd902dcf9`|`sha-676cae2`|
-
-### `path`
-
-Path to run the docker build from. Defaults to `.`.
-
-### `dockerfile`
-
-Name of the Dockerfile. Defaults to `{path}/Dockerfile`.
-
-### `target`
-
-Sets the target stage to build.
-
-### `always_pull`
-
-Boolean value. Defaults to `false`.
-
-Always attempt to pull a newer version of the image.
-
-### `build_args`
-
-Comma-delimited list of build-time variables.
-
-Example:
+Building from the current repository automatically uses the [GitHub Token](https://help.github.com/en/actions/configuring-and-managing-workflows/authenticating-with-the-github_token)
+so it does not need to be passed. If you want to authenticate against another private repository, you have to use
+a [secret](docs/advanced/secrets.md) named `GIT_AUTH_TOKEN` to be able to authenticate against it with buildx:
 
 ```yaml
-build_args: arg1=value1,arg2=value2
+      -
+        name: Build and push
+        id: docker_build
+        uses: docker/build-push-action@v2
+        with:
+          push: true
+          tags: user/app:latest
+          secrets: |
+            GIT_AUTH_TOKEN=${{ secrets.MYTOKEN }}
 ```
 
-### `labels`
+> :warning: Subdir for Git context is not yet supported ([moby/buildkit#1684](https://github.com/moby/buildkit/issues/1684))
+> but you can use the [path context](#path-context) in the meantime. More info on [Docker docs website](https://docs.docker.com/engine/reference/commandline/build/#git-repositories).
 
-Comma-delimited list of labels to add to the built image.
-
-Example:
+### Path context
 
 ```yaml
-labels: label_name_1=label_value_1,label_name_2=label_value_2
+name: ci
+
+on:
+  push:
+    branches:
+      - 'master'
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      -
+        name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: true
+          tags: user/app:latest
 ```
 
-### `add_git_labels`
+## Advanced usage
 
-Boolean value. Defaults to `false`.
+* [Multi-platform image](docs/advanced/multi-platform.md)
+* [Secrets](docs/advanced/secrets.md)
+* [Isolated builders](docs/advanced/isolated-builders.md)
+* [Push to multi-registries](docs/advanced/push-multi-registries.md)
+* [Cache](docs/advanced/cache.md)
+  * [Registry cache](docs/advanced/cache.md#registry-cache)
+  * [GitHub cache](docs/advanced/cache.md#github-cache)
+* [Local registry](docs/advanced/local-registry.md)
+* [Export image to Docker](docs/advanced/export-docker.md)
+* [Handle tags and labels](docs/advanced/tags-labels.md)
+* [Update DockerHub repo description](docs/advanced/dockerhub-desc.md)
 
-Adds labels with git repository information to the built image based on the standards set out in https://github.com/opencontainers/image-spec/blob/master/annotations.md.
+## Customizing
 
-The labels are:
+### inputs
 
-|Label key|Example value|Description|
-|---|---|---|
-|`org.opencontainers.image.created`|`2020-03-06T23:00:00Z`|Date and time on which the image was built (string, date-time as defined by RFC 3339).|
-|`org.opencontainers.image.source`|`https://github.com/myorg/myrepository`|URL to the GitHub repository.|
-|`org.opencontainers.image.revision`|`676cae2f85471aeff6776463c72881ebd902dcf9`|The full git SHA of this commit.|
+Following inputs can be used as `step.with` keys
 
+> `List` type is a newline-delimited string
+> ```yaml
+> cache-from: |
+>   user/app:cache
+>   type=local,src=path/to/dir
+> ```
 
-### `push`
+> `CSV` type is a comma-delimited string
+> ```yaml
+> tags: name/app:latest,name/app:1.0.0
+> ```
 
-Boolean value. Defaults to `true`.
+| Name                | Type     | Description                        |
+|---------------------|----------|------------------------------------|
+| `builder`           | String   | Builder instance (see [setup-buildx](https://github.com/docker/setup-buildx-action) action) |
+| `context`           | String   | Build's context is the set of files located in the specified [`PATH` or `URL`](https://docs.docker.com/engine/reference/commandline/build/) (default [Git context](#git-context)) |
+| `file`              | String   | Path to the Dockerfile. (default `{context}/Dockerfile`) |
+| `build-args`        | List     | List of build-time variables |
+| `labels`            | List     | List of metadata for an image |
+| `tags`              | List/CSV | List of tags |
+| `pull`              | Bool     | Always attempt to pull a newer version of the image (default `false`) |
+| `target`            | String   | Sets the target stage to build |
+| `allow`             | List/CSV | List of [extra privileged entitlement](https://github.com/docker/buildx#--allowentitlement) (eg. `network.host,security.insecure`) |
+| `no-cache`          | Bool     | Do not use cache when building the image (default `false`) |
+| `platforms`         | List/CSV | List of [target platforms](https://github.com/docker/buildx#---platformvaluevalue) for build |
+| `load`              | Bool     | [Load](https://github.com/docker/buildx#--load) is a shorthand for `--output=type=docker` (default `false`) |
+| `push`              | Bool     | [Push](https://github.com/docker/buildx#--push) is a shorthand for `--output=type=registry` (default `false`) |
+| `outputs`           | List     | List of [output destinations](https://github.com/docker/buildx#-o---outputpath-typetypekeyvalue) (format: `type=local,dest=path`) |
+| `cache-from`        | List     | List of [external cache sources](https://github.com/docker/buildx#--cache-fromnametypetypekeyvalue) (eg. `type=local,src=path/to/dir`) |
+| `cache-to`          | List     | List of [cache export destinations](https://github.com/docker/buildx#--cache-tonametypetypekeyvalue) (eg. `type=local,dest=path/to/dir`) |
+| `secrets`           | List     | List of secrets to expose to the build (eg. `key=string`, `GIT_AUTH_TOKEN=mytoken`) |
+| `secret-files`      | List     | List of secret files to expose to the build (eg. `key=filename`, `MY_SECRET=./secret.txt`) |
+| `ssh`               | List     | List of SSH agent socket or keys to expose to the build |
 
-Whether to push the built image.
+### outputs
 
-## Example usage
+Following outputs are available
 
-The following will build the root Dockerfile, tag the image as `myorg/myrepository:latest`, log in to Docker Hub using GitHub secrets, and push the image to the Docker Hub repository `myorg/myrepository`:
+| Name          | Type    | Description                           |
+|---------------|---------|---------------------------------------|
+| `digest`      | String  | Image content-addressable identifier also called a digest |
+
+## Troubleshooting
+
+See [TROUBLESHOOTING.md](TROUBLESHOOTING.md)
+
+## Keep up-to-date with GitHub Dependabot
+
+Since [Dependabot](https://docs.github.com/en/github/administering-a-repository/keeping-your-actions-up-to-date-with-github-dependabot)
+has [native GitHub Actions support](https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates#package-ecosystem),
+to enable it on your GitHub repo all you need to do is add the `.github/dependabot.yml` file:
 
 ```yaml
-uses: docker/build-push-action@v1
-with:
-  username: ${{ secrets.DOCKER_USERNAME }}
-  password: ${{ secrets.DOCKER_PASSWORD }}
-  repository: myorg/myrepository
-  tags: latest
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
 ```
 
-The following will build the root Dockerfile, tag the image with the git reference and SHA as described above, log in to Docker Hub using GitHub secrets, and push the image to the Docker Hub repository `myorg/myrepository`:
+## Limitation
 
-```yaml
-uses: docker/build-push-action@v1
-with:
-  username: ${{ secrets.DOCKER_USERNAME }}
-  password: ${{ secrets.DOCKER_PASSWORD }}
-  repository: myorg/myrepository
-  tag_with_ref: true
-  tag_with_sha: true
-```
-
-The following will only push the image when the event that kicked off the workflow was a push of a git tag:
-
-```yaml
-uses: docker/build-push-action@v1
-with:
-  username: ${{ secrets.DOCKER_USERNAME }}
-  password: ${{ secrets.DOCKER_PASSWORD }}
-  repository: myorg/myrepository
-  tag_with_ref: true
-  push: ${{ startsWith(github.ref, 'refs/tags/') }}
-```
-
-The following builds the `mytarget` stage and pushes that:
- 
-```yaml
-uses: docker/build-push-action@v1
-with:
-  username: ${{ secrets.DOCKER_USERNAME }}
-  password: ${{ secrets.DOCKER_PASSWORD }}
-  repository: myorg/myrepository
-  tag_with_ref: true
-  target: mytarget
-```
+This action is only available for Linux [virtual environments](https://help.github.com/en/articles/virtual-environments-for-github-actions#supported-virtual-environments-and-hardware-resources).

TROUBLESHOOTING.md

@@ -0,0 +1,73 @@
+# Troubleshooting
+
+* [Cannot push to a registry](#cannot-push-to-a-registry)
+
+## Cannot push to a registry
+
+While pushing to a registry, you may encounter these kinds of issues:
+
+* `failed commit on ref "layer-sha256:...": invalid content digest in response: invalid checksum digest format`
+* `failed commit on ref "layer-sha256:...": no response`
+* `failed commit on ref "manifest-sha256:...": unexpected status: 400 Bad Request`
+* `failed commit on ref "manifest-sha256:...": unexpected status: 401 Unauthorized`
+* `unexpected response: 401 Unauthorized`
+
+These issues are not directly related to this action but are rather linked to [buildx](https://github.com/docker/buildx),
+[buildkit](https://github.com/moby/buildkit), [containerd](https://github.com/containerd/containerd) or the registry
+on which you're pushing your image. The quality of error message depends on the registry and are usually not very informative.
+
+To help you solve this, you should first enable debugging in the
+[setup-buildx action step](https://github.com/docker/setup-buildx-action):
+
+```yaml
+  -
+    name: Set up Docker Buildx
+    uses: docker/setup-buildx-action@v1
+    with:
+      buildkitd-flags: --debug
+```
+
+Next you can test pushing with [containerd action](https://github.com/crazy-max/ghaction-setup-containerd) using the
+following workflow. If it works then open an issue on [buildkit](https://github.com/moby/buildkit) repository.
+
+```yaml
+name: containerd
+
+on:
+  push:
+
+jobs:
+  containerd:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+        with:
+          buildkitd-flags: --debug
+      -
+        name: Set up containerd
+        uses: crazy-max/ghaction-setup-containerd@v1
+      -
+        name: Build Docker image
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          tags: docker.io/user/app:latest
+          outputs: type=oci,dest=/tmp/image.tar
+      -
+        name: Import image in containerd
+        run: |
+          sudo ctr i import --base-name docker.io/user/app --digests --all-platforms /tmp/image.tar
+      -
+        name: Push image with containerd
+        run: |
+          sudo ctr --debug i push --user "${{ secrets.DOCKER_USERNAME }}:${{ secrets.DOCKER_PASSWORD }}" docker.io/user/app:latest
+```

UPGRADE.md

@@ -0,0 +1,147 @@
+# Upgrade notes
+
+## v1 to v2
+
+* Input `path` is now called `context` for consistency with other Docker build tools
+* `path` defaults to current git repository so checkout action is not required in a workflow
+* Rename `dockerfile` input to `file` for consistency with other Docker build tools
+* Rename `always_pull` input to `pull` for consistency with other Docker build tools
+* Add `builder` input to be able to choose a builder instance through our [setup-buildx action](https://github.com/docker/setup-buildx-action)
+* Add [`platforms`](https://github.com/docker/buildx#---platformvaluevalue) input to support multi-platform builds
+* Add [`allow`](https://github.com/docker/buildx#--allowentitlement) input
+* Add [`load`](https://github.com/docker/buildx#--load) input
+* Add [`outputs`](https://github.com/docker/buildx#-o---outputpath-typetypekeyvalue) input
+* Add [`cache-from`](https://github.com/docker/buildx#--cache-fromnametypetypekeyvalue) input (`cache_froms` removed)
+* Add [`cache-to`](https://github.com/docker/buildx#--cache-tonametypetypekeyvalue) input
+* Rename `build_args` input to `build-args` for consistency with other Docker build tools
+* Add `secrets` input
+* Review `tags` input
+* Remove `repository` input. See [Simple workflow](#simple-workflow) for migration
+* Remove `username`, `password` and `registry` inputs. Login support moved to [docker/login-action](https://github.com/docker/login-action) repo
+* Remove `tag_with_sha`, `tag_with_ref`, `add_git_labels` inputs. See [Tags with ref and Git labels](#tags-with-ref-and-git-labels) for migration
+* Handle Git context
+* Add `digest` output
+
+### Simple workflow
+
+```yaml
+# v1
+steps:
+  -
+    name: Checkout code
+    uses: actions/checkout@v2
+  -
+    name: Build and push Docker images
+    uses: docker/build-push-action@v1
+    with:
+      username: ${{ secrets.DOCKER_USERNAME }}
+      password: ${{ secrets.DOCKER_PASSWORD }}
+      repository: myorg/myrepository
+      always_pull: true
+      build_args: arg1=value1,arg2=value2
+      cache_froms: myorg/myrepository:latest
+      tags: latest
+```
+
+```yaml
+# v2
+steps:
+  -
+    name: Checkout code
+    uses: actions/checkout@v2
+  -
+    name: Set up Docker Buildx
+    uses: docker/setup-buildx-action@v1
+  -
+    name: Login to DockerHub
+    uses: docker/login-action@v1
+    with:
+      username: ${{ secrets.DOCKER_USERNAME }}
+      password: ${{ secrets.DOCKER_PASSWORD }}
+  -
+    name: Build and push
+    uses: docker/build-push-action@v2
+    with:
+      context: .
+      pull: true
+      push: true
+      build-args: |
+        arg1=value1
+        arg2=value2
+      cache-from: type=registry,ref=myorg/myrepository:latest
+      cache-to: type=inline
+      tags: myorg/myrepository:latest
+```
+
+### Tags with ref and Git labels
+
+```yaml
+# v1
+steps:
+  -
+    name: Checkout code
+    uses: actions/checkout@v2
+  -
+    name: Build and push Docker images
+    uses: docker/build-push-action@v1
+    with:
+      username: ${{ secrets.DOCKER_USERNAME }}
+      password: ${{ secrets.DOCKER_PASSWORD }}
+      repository: myorg/myrepository
+      push: ${{ github.event_name != 'pull_request' }}
+      tag_with_ref: true
+      tag_with_sha: true
+      add_git_labels: true
+```
+
+```yaml
+# v2
+steps:
+  -
+    name: Checkout
+    uses: actions/checkout@v2
+  -
+    name: Prepare
+    id: prep
+    run: |
+      DOCKER_IMAGE=myorg/myrepository
+      VERSION=edge
+      if [[ $GITHUB_REF == refs/tags/* ]]; then
+        VERSION=${GITHUB_REF#refs/tags/}
+      elif [[ $GITHUB_REF == refs/heads/* ]]; then
+        VERSION=$(echo ${GITHUB_REF#refs/heads/} | sed -r 's#/+#-#g')
+      elif [[ $GITHUB_REF == refs/pull/* ]]; then
+        VERSION=pr-${{ github.event.number }}
+      fi
+      TAGS="${DOCKER_IMAGE}:${VERSION}"
+      if [ "${{ github.event_name }}" = "push" ]; then
+        TAGS="$TAGS,${DOCKER_IMAGE}:sha-${GITHUB_SHA::8}"
+      fi
+      echo ::set-output name=version::${VERSION}
+      echo ::set-output name=tags::${TAGS}
+      echo ::set-output name=created::$(date -u +'%Y-%m-%dT%H:%M:%SZ')
+  -
+    name: Set up Docker Buildx
+    uses: docker/setup-buildx-action@v1
+  -
+    name: Login to DockerHub
+    if: github.event_name != 'pull_request'
+    uses: docker/login-action@v1 
+    with:
+      username: ${{ secrets.DOCKER_USERNAME }}
+      password: ${{ secrets.DOCKER_PASSWORD }}
+  -
+    name: Build and push
+    uses: docker/build-push-action@v2
+    with:
+      context: .
+      push: ${{ github.event_name != 'pull_request' }}
+      tags: ${{ steps.prep.outputs.tags }}
+      labels: |
+        org.opencontainers.image.source=${{ github.event.repository.html_url }}
+        org.opencontainers.image.created=${{ steps.prep.outputs.created }}
+        org.opencontainers.image.revision=${{ github.sha }}
+```
+
+> You can also use the [Docker meta action to handle tags and labels](docs/advanced/tags-labels.md) based on GitHub
+> actions events and Git metadata.

__tests__/buildx.test.ts

@@ -0,0 +1,154 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import * as semver from 'semver';
+
+import * as buildx from '../src/buildx';
+import * as context from '../src/context';
+import * as docker from '../src/docker';
+
+const tmpNameSync = path.join('/tmp/.docker-build-push-jest', '.tmpname-jest').split(path.sep).join(path.posix.sep);
+const digest = 'sha256:bfb45ab72e46908183546477a08f8867fc40cebadd00af54b071b097aed127a9';
+
+jest.spyOn(context, 'tmpDir').mockImplementation((): string => {
+  const tmpDir = path.join('/tmp/.docker-build-push-jest').split(path.sep).join(path.posix.sep);
+  if (!fs.existsSync(tmpDir)) {
+    fs.mkdirSync(tmpDir, {recursive: true});
+  }
+  return tmpDir;
+});
+
+jest.spyOn(context, 'tmpNameSync').mockImplementation((): string => {
+  return tmpNameSync;
+});
+
+describe('getImageID', () => {
+  it('matches', async () => {
+    const imageIDFile = await buildx.getImageIDFile();
+    console.log(`imageIDFile: ${imageIDFile}`);
+    await fs.writeFileSync(imageIDFile, digest);
+    const imageID = await buildx.getImageID();
+    console.log(`imageID: ${imageID}`);
+    expect(imageID).toEqual(digest);
+  });
+});
+
+describe('isLocalOrTarExporter', () => {
+  // prettier-ignore
+  test.each([
+    [
+      [
+        'type=registry,ref=user/app',
+      ],
+      false
+    ],
+    [
+      [
+        'type=docker',
+      ],
+      false
+    ],
+    [
+      [
+        'type=local,dest=./release-out'
+      ],
+      true
+    ],
+    [
+      [
+        'type=tar,dest=/tmp/image.tar'
+      ],
+      true
+    ],
+    [
+      [
+        'type=docker',
+        'type=tar,dest=/tmp/image.tar'
+      ],
+      true
+    ],
+    [
+      [
+        '"type=tar","dest=/tmp/image.tar"'
+      ],
+      true
+    ],
+    [
+      [
+        '" type= local" , dest=./release-out'
+      ],
+      true
+    ],
+    [
+      [
+        '.'
+      ],
+      true
+    ],
+  ])(
+    'given %p returns %p',
+    async (outputs: Array<string>, expected: boolean) => {
+      expect(buildx.isLocalOrTarExporter(outputs)).toEqual(expected);
+    }
+  );
+});
+
+describe('getVersion', () => {
+  async function isDaemonRunning() {
+    return await docker.isDaemonRunning();
+  }
+  (isDaemonRunning() ? it : it.skip)(
+    'valid',
+    async () => {
+      const version = await buildx.getVersion();
+      console.log(`version: ${version}`);
+      expect(semver.valid(version)).not.toBeNull();
+    },
+    100000
+  );
+});
+
+describe('parseVersion', () => {
+  test.each([
+    ['github.com/docker/buildx 0.4.1+azure bda4882a65349ca359216b135896bddc1d92461c', '0.4.1'],
+    ['github.com/docker/buildx v0.4.1 bda4882a65349ca359216b135896bddc1d92461c', '0.4.1'],
+    ['github.com/docker/buildx v0.4.2 fb7b670b764764dc4716df3eba07ffdae4cc47b2', '0.4.2']
+  ])('given %p', async (stdout, expected) => {
+    expect(await buildx.parseVersion(stdout)).toEqual(expected);
+  });
+});
+
+describe('getSecret', () => {
+  test.each([
+    ['A_SECRET=abcdef0123456789', false, 'A_SECRET', 'abcdef0123456789', false],
+    ['GIT_AUTH_TOKEN=abcdefghijklmno=0123456789', false, 'GIT_AUTH_TOKEN', 'abcdefghijklmno=0123456789', false],
+    ['MY_KEY=c3RyaW5nLXdpdGgtZXF1YWxzCg==', false, 'MY_KEY', 'c3RyaW5nLXdpdGgtZXF1YWxzCg==', false],
+    ['aaaaaaaa', false, '', '', true],
+    ['aaaaaaaa=', false, '', '', true],
+    ['=bbbbbbb', false, '', '', true],
+    [
+      `foo=${path.join(__dirname, 'fixtures', 'secret.txt').split(path.sep).join(path.posix.sep)}`,
+      true,
+      'foo',
+      'bar',
+      false
+    ],
+    [`notfound=secret`, true, '', '', true]
+  ])('given %p key and %p secret', async (kvp, file, exKey, exValue, invalid) => {
+    try {
+      let secret: string;
+      if (file) {
+        secret = await buildx.getSecretFile(kvp);
+      } else {
+        secret = await buildx.getSecretString(kvp);
+      }
+      expect(true).toBe(!invalid);
+      console.log(`secret: ${secret}`);
+      expect(secret).toEqual(`id=${exKey},src=${tmpNameSync}`);
+      const secretValue = await fs.readFileSync(tmpNameSync, 'utf-8');
+      console.log(`secretValue: ${secretValue}`);
+      expect(secretValue).toEqual(exValue);
+    } catch (err) {
+      expect(true).toBe(invalid);
+    }
+  });
+});

__tests__/context.test.ts

@@ -0,0 +1,562 @@
+import * as fs from 'fs';
+import * as path from 'path';
+
+import * as context from '../src/context';
+
+const pgp = `-----BEGIN PGP PRIVATE KEY BLOCK-----
+
+lQdGBF6tzaABEACjFbX7PFEG6vDPN2MPyxYW7/3o/sonORj4HXUFjFxxJxktJ3x3
+N1ayHPJ1lqIeoiY7jVbq0ZdEVGkd3YsKG9ZMdZkzGzY6PQPC/+M8OnzOiOPwUdWc
++Tdhh115LvVz0MMKYiab6Sn9cgxj9On3LCQKpjvMDpPo9Ttf6v2GQIw8h2ACvdzQ
+71LtIELS/I+dLbfZiwpUu2fhQT13EJkEnYMOYwM5jNUd66P9itUc7MrOWjkicrKP
+oF1dQaCM+tuKuxvD8WLdiwU5x60NoGkJHHUehKQXl2dVzjpqEqHKEBJt9tfJ9lpE
+YIisgwB8o3pes0fgCehjW2zI95/o9+ayJ6nl4g5+mSvWRXEu66h71nwM0Yuvquk8
+3me7qhYfDrDdCwcxS5BS1hwakTgUQLD99FZjbx1j8sq96I65O0GRdyU2PR8KIjwu
+JrkTH4ZlKxK3FQghUhFoA5GkiDb+eClmRMSni5qg+81T4XChmUkEprA3eWCHL+Ma
+xRNNxLS+r6hH9HG5JBxpV3iaTI9HHpnQKhEeaLXqsUTDZliN9hP7Ywo8bpUB8j2d
+oWYwDV4dPyMKr6Fb8RDCh2q5gJGbVp8w/NmmBTeL+IP2fFggJkRfyumv3Ul7x66L
+tBFQ4rYo4JUUrGweSTneG6REIgxH66hIrNl6Vo/D1ZyknTe1dMOu/BTkkQARAQAB
+/gcDAqra8KO+h3bfyu90vxTL1ro4x/x9il7VBcWlIR4cBP7Imgxv+T4hwPIu8P1x
+lOlxLNWegFOV0idoTy1o3VLLBev/F+IlspX4A+2XEIddR6nZnKFi0Lv2L4TKgE9E
+VJJTszmviDIRLMLN9dWzDfA8hj5tR5Inot92CHRF414AS22JHvlhbFSLQnjqsN+C
+n1cQpNOJhkxsSfZsxjnFa/70y/u8v0o8mzyLZmk9HpzRHGzoz8IfpLp8OTqBR9u6
+zzoKLy16zZO55OKbj7h8uVZvDUq9l8iDICpqWMdZqBJIl56MBexYKgYxh3YO/8v2
+oXli+8Xuaq5QLiCN3yT7IbKoYzplnFfaJwFiMh7R1iPLXaYAZ0qdRijlbtseTK1m
+oHNkwUbxVzjkh4LfE8UpmMwZn5ZjWni3230SoiXuKy0OHkGvwGvWWAL1mEuoYuUI
+mFMcH5MnixP8oQYZKDj2IR/yEeOpdU6B/tr3Tk1NidLf7pUMqG7Ff1NU6dAUeBpa
+9xahITMjHvrhgMISY4IYZep5cEnVw8lQTpUJtW/ePMzrFhu3sA7oNdj9joW/VMfz
+H7MHwwavtICsYqoqV3lnjX4EC9dW6o8PTUg2u956dmtK7KAyUK/+w2aLNGT28ChN
+jhRYHvHzB9Kw5asqI/lTM49eqslBqYQMTTjdBphkYuSZQzNMf291j/ZmoLhD1A1a
+S8tUnNygKV4D1cJYgSXfzhFoU8ib/0SPo+KqQ+CzGS+wxXg6WNBA6wepTjpnVVx3
+4JADP8IJcDC3P0iwAreWjSy15F1cvemFFB0SLNUkyZGzsxtKzbM1+8khl68+eazC
+LzRj0rxfIF5znWjX1QFhKxCk6eF0IWDY0+b3DBkmChME9YDXJ3TthcqA7JgcX4JI
+M4/wdqhgerJYOmj+i2Q0M+Bu02icOJYMwTMMsDVl7XGHkaCuRgZ54eZAUH7JFwUm
+1Ct3tcaqiTMmz0ngHVqBTauzgqKDvzwdVqdfg05H364nJMay/3omR6GayIb5CwSo
+xdNVwG3myPPradT9MP09mDr4ys2zcnQmCkvTVBF6cMZ1Eh6PQQ8CyQWv0zkaBnqj
+JrM1hRpgW4ZlRosSIjCaaJjolN5QDcXBM9TbW9ww+ZYstazN2bV1ZQ7BEjlHQPa1
+BhzMsvqkbETHsIpDNF52gZKn3Q9eIX05BeadzpHUb5/XOheIHVIdhSaTlgl/qQW5
+hQgPGSzSV6KhXEY7aevTdvOgq++WiELkjfz2f2lQFesTjFoQWEvxVDUmLxHtEhaN
+DOuh4H3mX5Opn3pLQmqWVhJTbFdx+g5qQd0NCW4mDaTFWTRLFLZQsSJxDSeg9xrY
+gmaii8NhMZRwquADW+6iU6KfraBhngi7HRz4TfqPr9ma/KUY464cqim1fnwXejyx
+jsb5YHR9R66i+F6P/ysF5w+QuVdDt1fnf9GLay0r6qxpA8ft2vGPcDs4806Huj+7
+Aq5VeJaNkCuh3GR3xVnCFAz/7AtkO6xKuZm8B3q904UuMdSmkhWbaobIuF/B2B6S
+eawIXQHEOplK3ic26d8Ckf4gbjeORfELcMAEi5nGXpTThCdmxQApCLxAYYnTfQT1
+xhlDwT9xPEabo98mIwJJsAU5VsTDYW+qfo4qIx8gYoSKc9Xu3yVh3n+9k43Gcm5V
+9lvK1slijf+TzODZt/jsmkF8mPjXyP5KOI+xQp/m4PxW3pp57YrYj/Rnwga+8DKX
+jMsW7mLAAZ/e+PY6z/s3x1Krfk+Bb5Ph4mI0zjw5weQdtyEToRgveda0GEpvZSBU
+ZXN0ZXIgPGpvZUBmb28uYmFyPokCNgQQAQgAIAUCXq3NoAYLCQcIAwIEFQgKAgQW
+AgEAAhkBAhsDAh4BAAoJEH2FHrctc72gxtQP/AulaClIcn/kDt43mhYnyLglPfbo
+AqPlU26chXolBg0Wo0frFY3aIs5SrcWEf8aR4XLwCFGyi3vya0CUxjghN5tZBYqo
+vswbT00zP3ohxxlJFCRRR9bc7OZXCgTddtfVf6EKrUAzIkbWyAhaJnwJy/1UGpSw
+SEO/KpastrVKf3sv1wqOeFQ4DFyjaNda+xv3dVWS8db7KogqJiPFZXrQK3FKVIxS
+fxRSmKaYN7//d+xwVAEY++RrnL/o8B2kV6N68cCpQWJELyYnJzis9LBcWd/3wiYh
+efTyY+ePKUjcB+kEZnyJfLc7C2hll2e7UJ0fxv+k8vHReRhrNWmGRXsjNRxiw3U0
+hfvxD/C8nyqAbeTHp4XDX78Tc3XCysAqIYboIL+RyewDMjjLj5vzUYAdUdtyNaD7
+C6M2R6pN1GAt52CJmC/Z6F7W7GFGoYOdEkVdMQDsjCwScyEUNlGj9Zagw5M2EgSe
+6gaHgMgTzsMzCc4W6WV5RcS55cfDNOXtxPsMJTt4FmXrjl11prBzpMfpU5a9zxDZ
+oi54ZZ8VPE6jsT4Lzw3sni3c83wm28ArM20AzZ1vh7fk3Sfd0u4Yaz7s9JlEm5+D
+34tEyli28+QjCQc18EfQUiJqiYEJRxJXJ3esvMHfYi45pV/Eh5DgRW1305fUJV/6
++rGpg0NejsHoZdZPnQdGBF6tzaABEAC4mVXTkVk6Kdfa4r5zlzsoIrR27laUlMkb
+OBMt+aokqS+BEbmTnMg6xIAmcUT5uvGAc8S/WhrPoYfc15fTUyHIz8ZbDoAg0LO6
+0Io4VkAvNJNEnsSV9VdLBh/XYlc4K49JqKyWTL4/FJFAGbsmHY3b+QU90AS6FYRv
+KeBAoiyebrjx0vmzb8E8h3xthVLN+AfMlR1ickY62zvnpkbncSMY/skur1D2KfbF
+3sFprty2pEtjFcyB5+18l2IyyHGOlEUw1PZdOAV4/Myh1EZRgYBPs80lYTJALCVF
+IdOakH33WJCImtNZB0AbDTABG+JtMjQGscOa0qzf1Y/7tlhgCrynBBdaIJTx95TD
+21BUHcHOu5yTIS6Ulysxfkv611+BiOKHgdq7DVGP78VuzA7bCjlP1+vHqIt3cnIa
+t2tEyuZ/XF4uc3/i4g0uP9r7AmtET7Z6SKECWjpVv+UEgLx5Cv+ql+LSKYQMvU9a
+i3B1F9fatn3FSLVYrL4aRxu4TSw9POb0/lgDNmN3lGQOsjGCZPibkHjgPEVxKuiq
+9Oi38/VTQ0ZKAmHwBTq1WTZIrPrCW0/YMQ6yIJZulwQ9Yx1cgzYzEfg04fPXlXMi
+vkvNpKbYIICzqj0/DVztz9wgpW6mnd0A2VX2dqbMM0fJUCHA6pj8AvXY4R+9Q4rj
+eWRK9ycInQARAQAB/gcDApjt7biRO0PEyrrAiUwDMsJL4/CVMu11qUWEPjKe2Grh
+ZTW3N+m3neKPRULu+LUtndUcEdVWUCoDzAJ7MwihZtV5vKST/5Scd2inonOaJqoA
+nS3wnEMN/Sc93HAZiZnFx3NKjQVNCwbuEs45mXkkcjLm2iadrTL8fL4acsu5IsvD
+LbDwVOPeNnHKl6Hr20e39fK0FuJEyH49JM6U3B1/8385sJB8+E24+hvSF81aMddh
+Ne4Bc3ZYiYaKxe1quPNKC0CQhAZiT7LsMfkInXr0hY1I+kISNXEJ1dPYOEWiv0Ze
+jD5Pupn34okKNEeBCx+dK8BmUCi6Jgs7McUA7hN0D/YUS++5fuR55UQq2j8Ui0tS
+P8GDr86upH3PgEL0STh9fYfJ7TesxurwonWjlmmT62Myl4Pr+RmpS6PXOnhtcADm
+eGLpzhTveFj4JBLMpyYHgBTqcs12zfprATOpsI/89kmQoGCZpG6+AbfSHqNNPdy2
+eqUCBhOZlIIda1z/cexmU3f/gBqyflFf8fkvmlO4AvI8aMH3OpgHdWnzh+AB51xj
+kmdD/oWel9v7Dz4HoZUfwFaLZ0fE3P9voD8e+sCwqQwVqRY4L/BOYPD5noVOKgOj
+ABNKu5uKrobj6rFUi6DTUCjFGcmoF1Sc06xFNaagUNggRbmlC/dz22RWdDUYv5ra
+N6TxIDkGC0cK6ujyK0nes3DN0aHjgwWuMXDYkN3UckiebI4Cv/eF9jvUKOSiIcy1
+RtxdazZS4dYg2LBMeJKVkPi5elsNyw2812nEY3du/nEkQYXfYgWOF27OR+g4Y9Yw
+1BiqJ1TTjbQnd/khOCrrbzDH1mw00+1XVsT6wjObuYqqxPPS87UrqmMf6OdoYfPm
+zEOnNLBnsJ5VQM3A3pcT40RfdBrZRO8LjGhzKTreyq3C+jz0RLa5HNE8GgOhGyck
+ME4h+RhXlE8KGM+tTo6PA1NJSrEt+8kZzxjP4rIEn0aVthCkNXK12inuXtnHm0ao
+iLUlQOsfPFEnzl0TUPd7+z7j/wB+XiKU/AyEUuB0mvdxdKtqXvajahOyhLjzHQhz
+ZnNlgANGtiqcSoJmkJ8yAvhrtQX51fQLftxbArRW1RYk/5l+Gy3azR+gUC17M6JN
+jrUYxn0zlAxDGFH7gACHUONwVekcuEffHzgu2lk7MyO1Y+lPnwabqjG0eWWHuU00
+hskJlXyhj7DeR12bwjYkyyjG62GvOH02g3OMvUgNGH+K321Dz539csCh/xwtg7Wt
+U3YAphU7htQ1dPDfk1IRs7DQo2L+ZTE57vmL5m0l6fTataEWBPUXkygfQFUJOM6Q
+yY76UEZww1OSDujNeY171NSTzXCVkUeAdAMXgjaHXWLK2QUQUoXbYX/Kr7Vvt9Fu
+Jh6eGjjp7dSjQ9+DW8CAB8vxd93gsQQGWYjmGu8khkEmx6OdZhmSbDbe915LQTb9
+sPhk2s5/Szsvr5W2JJ2321JI6KXBJMZvPC5jEBWmRzOYkRd2vloft+CSMfXF+Zfd
+nYtc6R3dvb9vcjo+a9wFtfcoDsO0MaPSM+9GB25MamdatmGX6iLOy9Re1UABwUi/
+VhTWNkP5uzqx0sDwHEIa2rYOwxpIZDwwjM3oOASCW1DDBQ0BI9KNjfIeL3ubx2mS
+2x8hFU9qSK4umoDNbzOqGPSlkdbiPcNjF2ZcSN1qQZiYdwLL5dw6APNyBVjxTN1J
+gkCdJ/HwAY+r93Lbl5g8gz8d0vJEyfn//34sn9u+toSTw55GcG9Ks1kSKIeDNh0h
+MiPm3HmJAh8EGAEIAAkFAl6tzaACGwwACgkQfYUety1zvaBV9hAAgliX36pXJ59g
+3I9/4R68e/fGg0FMM6D+01yCeiKApOYRrJ0cYKn7ITDYmHhlGGpBAie90UsqX12h
+hdLP7LoQx7sjTyzQt6JmpA8krIwi2ON7FKBkdYb8IYx4mE/5vKnYT4/SFnwTmnZY
++m+NzK2U/qmhq8JyO8gozdAKJUcgz49IVv2Ij0tQ4qaPbyPwQxIDyKnT758nJhB1
+jTqo+oWtER8q3okzIlqcArqn5rDaNJx+DRYL4E/IddyHQAiUWUka8usIUqeW5reu
+zoPUE2CCfOJSGArkqHQQqMx0WEzjQTwAPaHrQbera4SbiV/o4CLCV/u5p1Qnig+Q
+iUsakmlD299t//125LIQEa5qzd9hRC7u1uJS7VdW8eGIEcZ0/XT/sr+z23z0kpZH
+D3dXPX0BwM4IP9xu31CNg10x0rKwjbxy8VaskFEelpqpu+gpAnxqMd1evpeUHcOd
+r5RgPgkNFfba9Nbxf7uEX+HOmsOM+kdtSmdGIvsBZjVnW31nnoDMp49jG4OynjrH
+cRuoM9sxdr6UDqb22CZ3/e0YN4UaZM3YDWMVaP/QBVgvIFcdByqNWezpd9T4ZUII
+MZlaV1uRnHg6B/zTzhIdMM80AXz6Uv6kw4S+Lt7HlbrnMT7uKLuvzH7cle0hcIUa
+PejgXO0uIRolYQ3sz2tMGhx1MfBqH64=
+=WbwB
+-----END PGP PRIVATE KEY BLOCK-----`;
+
+jest.spyOn(context, 'defaultContext').mockImplementation((): string => {
+  return 'https://github.com/docker/build-push-action.git#test-jest';
+});
+
+jest.spyOn(context, 'tmpDir').mockImplementation((): string => {
+  const tmpDir = path.join('/tmp/.docker-build-push-jest').split(path.sep).join(path.posix.sep);
+  if (!fs.existsSync(tmpDir)) {
+    fs.mkdirSync(tmpDir, {recursive: true});
+  }
+  return tmpDir;
+});
+
+jest.spyOn(context, 'tmpNameSync').mockImplementation((): string => {
+  return path.join('/tmp/.docker-build-push-jest', '.tmpname-jest').split(path.sep).join(path.posix.sep);
+});
+
+describe('getArgs', () => {
+  beforeEach(() => {
+    process.env = Object.keys(process.env).reduce((object, key) => {
+      if (!key.startsWith('INPUT_')) {
+        object[key] = process.env[key];
+      }
+      return object;
+    }, {});
+  });
+
+  // prettier-ignore
+  test.each([
+    [
+      '0.4.1',
+      new Map<string, string>([
+        ['context', '.'],
+      ]),
+      [
+        'buildx',
+        'build',
+        '--iidfile', '/tmp/.docker-build-push-jest/iidfile',
+        '.'
+      ]
+    ],
+    [
+      '0.4.2',
+      new Map<string, string>([
+        ['build-args', 'MY_ARG=val1,val2,val3\nARG=val'],
+      ]),
+      [
+        'buildx',
+        'build',
+        '--build-arg', 'MY_ARG=val1,val2,val3',
+        '--build-arg', 'ARG=val',
+        '--iidfile', '/tmp/.docker-build-push-jest/iidfile',
+        'https://github.com/docker/build-push-action.git#test-jest'
+      ]
+    ],
+    [
+      '0.4.2',
+      new Map<string, string>([
+        ['tags', 'name/app:7.4, name/app:latest'],
+      ]),
+      [
+        'buildx',
+        'build',
+        '--tag', 'name/app:7.4',
+        '--tag', 'name/app:latest',
+        '--iidfile', '/tmp/.docker-build-push-jest/iidfile',
+        'https://github.com/docker/build-push-action.git#test-jest'
+      ]
+    ],
+    [
+      '0.4.2',
+      new Map<string, string>([
+        ['context', '.'],
+        ['labels', 'org.opencontainers.image.title=buildkit\norg.opencontainers.image.description=concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit'],
+        ['outputs', 'type=local,dest=./release-out']
+      ]),
+      [
+        'buildx',
+        'build',
+        '--label', 'org.opencontainers.image.title=buildkit',
+        '--label', 'org.opencontainers.image.description=concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit',
+        '--output', 'type=local,dest=./release-out',
+        '.'
+      ]
+    ],
+    [
+      '0.4.1',
+      new Map<string, string>([
+        ['context', '.'],
+        ['platforms', 'linux/amd64,linux/arm64']
+      ]),
+      [
+        'buildx',
+        'build',
+        '--platform', 'linux/amd64,linux/arm64',
+        '.'
+      ]
+    ],
+    [
+      '0.4.1',
+      new Map<string, string>([
+        ['context', '.']
+      ]),
+      [
+        'buildx',
+        'build',
+        '--iidfile', '/tmp/.docker-build-push-jest/iidfile',
+        '.'
+      ]
+    ],
+    [
+      '0.4.2',
+      new Map<string, string>([
+        ['context', '.'],
+        ['secrets', 'GIT_AUTH_TOKEN=abcdefghijklmno=0123456789'],
+      ]),
+      [
+        'buildx',
+        'build',
+        '--iidfile', '/tmp/.docker-build-push-jest/iidfile',
+        '--secret', 'id=GIT_AUTH_TOKEN,src=/tmp/.docker-build-push-jest/.tmpname-jest',
+        '.'
+      ]
+    ],
+    [
+      '0.4.2',
+      new Map<string, string>([
+        ['github-token', 'abcdefghijklmno0123456789'],
+        ['outputs', '.']
+      ]),
+      [
+        'buildx',
+        'build',
+        '--output', '.',
+        '--secret', 'id=GIT_AUTH_TOKEN,src=/tmp/.docker-build-push-jest/.tmpname-jest',
+        'https://github.com/docker/build-push-action.git#test-jest'
+      ]
+    ],
+    [
+      '0.4.2',
+      new Map<string, string>([
+        ['context', 'https://github.com/docker/build-push-action.git#heads/master'],
+        ['tag', 'localhost:5000/name/app:latest'],
+        ['platforms', 'linux/amd64,linux/arm64'],
+        ['secrets', 'GIT_AUTH_TOKEN=abcdefghijklmno=0123456789'],
+        ['file', './test/Dockerfile'],
+        ['builder', 'builder-git-context-2'],
+        ['push', 'true']
+      ]),
+      [
+        'buildx',
+        'build',
+        '--platform', 'linux/amd64,linux/arm64',
+        '--iidfile', '/tmp/.docker-build-push-jest/iidfile',
+        '--secret', 'id=GIT_AUTH_TOKEN,src=/tmp/.docker-build-push-jest/.tmpname-jest',
+        '--file', './test/Dockerfile',
+        '--builder', 'builder-git-context-2',
+        '--push',
+        'https://github.com/docker/build-push-action.git#heads/master'
+      ]
+    ],
+    [
+      '0.4.2',
+      new Map<string, string>([
+        ['context', 'https://github.com/docker/build-push-action.git#heads/master'],
+        ['tag', 'localhost:5000/name/app:latest'],
+        ['platforms', 'linux/amd64,linux/arm64'],
+        ['secrets', `GIT_AUTH_TOKEN=abcdefghi,jklmno=0123456789
+"MYSECRET=aaaaaaaa
+bbbbbbb
+ccccccccc"
+FOO=bar
+"EMPTYLINE=aaaa
+
+bbbb
+ccc"`],
+        ['file', './test/Dockerfile'],
+        ['builder', 'builder-git-context-2'],
+        ['push', 'true']
+      ]),
+      [
+        'buildx',
+        'build',
+        '--platform', 'linux/amd64,linux/arm64',
+        '--iidfile', '/tmp/.docker-build-push-jest/iidfile',
+        '--secret', 'id=GIT_AUTH_TOKEN,src=/tmp/.docker-build-push-jest/.tmpname-jest',
+        '--secret', 'id=MYSECRET,src=/tmp/.docker-build-push-jest/.tmpname-jest',
+        '--secret', 'id=FOO,src=/tmp/.docker-build-push-jest/.tmpname-jest',
+        '--secret', 'id=EMPTYLINE,src=/tmp/.docker-build-push-jest/.tmpname-jest',
+        '--file', './test/Dockerfile',
+        '--builder', 'builder-git-context-2',
+        '--push',
+        'https://github.com/docker/build-push-action.git#heads/master'
+      ]
+    ],
+    [
+      '0.4.2',
+      new Map<string, string>([
+        ['context', 'https://github.com/docker/build-push-action.git#heads/master'],
+        ['tag', 'localhost:5000/name/app:latest'],
+        ['platforms', 'linux/amd64,linux/arm64'],
+        ['secrets', `GIT_AUTH_TOKEN=abcdefghi,jklmno=0123456789
+MYSECRET=aaaaaaaa
+bbbbbbb
+ccccccccc
+FOO=bar
+EMPTYLINE=aaaa
+
+bbbb
+ccc`],
+        ['file', './test/Dockerfile'],
+        ['builder', 'builder-git-context-2'],
+        ['push', 'true']
+      ]),
+      [
+        'buildx',
+        'build',
+        '--platform', 'linux/amd64,linux/arm64',
+        '--iidfile', '/tmp/.docker-build-push-jest/iidfile',
+        '--secret', 'id=GIT_AUTH_TOKEN,src=/tmp/.docker-build-push-jest/.tmpname-jest',
+        '--secret', 'id=MYSECRET,src=/tmp/.docker-build-push-jest/.tmpname-jest',
+        '--secret', 'id=FOO,src=/tmp/.docker-build-push-jest/.tmpname-jest',
+        '--secret', 'id=EMPTYLINE,src=/tmp/.docker-build-push-jest/.tmpname-jest',
+        '--file', './test/Dockerfile',
+        '--builder', 'builder-git-context-2',
+        '--push',
+        'https://github.com/docker/build-push-action.git#heads/master'
+      ]
+    ],
+    [
+      '0.5.1',
+      new Map<string, string>([
+        ['context', 'https://github.com/docker/build-push-action.git#heads/master'],
+        ['tag', 'localhost:5000/name/app:latest'],
+        ['secret-files', `MY_SECRET=${path.join(__dirname, 'fixtures', 'secret.txt').split(path.sep).join(path.posix.sep)}`],
+        ['file', './test/Dockerfile'],
+        ['builder', 'builder-git-context-2'],
+        ['push', 'true']
+      ]),
+      [
+        'buildx',
+        'build',
+        '--iidfile', '/tmp/.docker-build-push-jest/iidfile',
+        '--secret', 'id=MY_SECRET,src=/tmp/.docker-build-push-jest/.tmpname-jest',
+        '--file', './test/Dockerfile',
+        '--builder', 'builder-git-context-2',
+        '--push',
+        'https://github.com/docker/build-push-action.git#heads/master'
+      ]
+    ]
+  ])(
+    'given %p with %p as inputs, returns %p',
+    async (buildxVersion: string, inputs: Map<string, any>, expected: Array<string>) => {
+      await inputs.forEach((value: string, name: string) => {
+        setInput(name, value);
+      });
+      const defContext = context.defaultContext();
+      const inp = await context.getInputs(defContext);
+      console.log(inp);
+      const res = await context.getArgs(inp, defContext, buildxVersion);
+      console.log(res);
+      expect(res).toEqual(expected);
+    }
+  );
+});
+
+describe('getInputList', () => {
+  it('single line correctly', async () => {
+    await setInput('foo', 'bar');
+    const res = await context.getInputList('foo');
+    console.log(res);
+    expect(res).toEqual(['bar']);
+  });
+
+  it('multiline correctly', async () => {
+    setInput('foo', 'bar\nbaz');
+    const res = await context.getInputList('foo');
+    console.log(res);
+    expect(res).toEqual(['bar', 'baz']);
+  });
+
+  it('empty lines correctly', async () => {
+    setInput('foo', 'bar\n\nbaz');
+    const res = await context.getInputList('foo');
+    console.log(res);
+    expect(res).toEqual(['bar', 'baz']);
+  });
+
+  it('comma correctly', async () => {
+    setInput('foo', 'bar,baz');
+    const res = await context.getInputList('foo');
+    console.log(res);
+    expect(res).toEqual(['bar', 'baz']);
+  });
+
+  it('empty result correctly', async () => {
+    setInput('foo', 'bar,baz,');
+    const res = await context.getInputList('foo');
+    console.log(res);
+    expect(res).toEqual(['bar', 'baz']);
+  });
+
+  it('different new lines correctly', async () => {
+    setInput('foo', 'bar\r\nbaz');
+    const res = await context.getInputList('foo');
+    console.log(res);
+    expect(res).toEqual(['bar', 'baz']);
+  });
+
+  it('different new lines and comma correctly', async () => {
+    setInput('foo', 'bar\r\nbaz,bat');
+    const res = await context.getInputList('foo');
+    console.log(res);
+    expect(res).toEqual(['bar', 'baz', 'bat']);
+  });
+
+  it('multiline and ignoring comma correctly', async () => {
+    setInput('cache-from', 'user/app:cache\ntype=local,src=path/to/dir');
+    const res = await context.getInputList('cache-from', true);
+    console.log(res);
+    expect(res).toEqual(['user/app:cache', 'type=local,src=path/to/dir']);
+  });
+
+  it('different new lines and ignoring comma correctly', async () => {
+    setInput('cache-from', 'user/app:cache\r\ntype=local,src=path/to/dir');
+    const res = await context.getInputList('cache-from', true);
+    console.log(res);
+    expect(res).toEqual(['user/app:cache', 'type=local,src=path/to/dir']);
+  });
+
+  it('multiline values', async () => {
+    setInput(
+      'secrets',
+      `GIT_AUTH_TOKEN=abcdefgh,ijklmno=0123456789
+"MYSECRET=aaaaaaaa
+bbbbbbb
+ccccccccc"
+FOO=bar`
+    );
+    const res = await context.getInputList('secrets', true);
+    console.log(res);
+    expect(res).toEqual([
+      'GIT_AUTH_TOKEN=abcdefgh,ijklmno=0123456789',
+      `MYSECRET=aaaaaaaa
+bbbbbbb
+ccccccccc`,
+      'FOO=bar'
+    ]);
+  });
+
+  it('multiline values with empty lines', async () => {
+    setInput(
+      'secrets',
+      `GIT_AUTH_TOKEN=abcdefgh,ijklmno=0123456789
+"MYSECRET=aaaaaaaa
+bbbbbbb
+ccccccccc"
+FOO=bar
+"EMPTYLINE=aaaa
+
+bbbb
+ccc"`
+    );
+    const res = await context.getInputList('secrets', true);
+    console.log(res);
+    expect(res).toEqual([
+      'GIT_AUTH_TOKEN=abcdefgh,ijklmno=0123456789',
+      `MYSECRET=aaaaaaaa
+bbbbbbb
+ccccccccc`,
+      'FOO=bar',
+      `EMPTYLINE=aaaa
+
+bbbb
+ccc`
+    ]);
+  });
+
+  it('multiline values without quotes', async () => {
+    setInput(
+      'secrets',
+      `GIT_AUTH_TOKEN=abcdefgh,ijklmno=0123456789
+MYSECRET=aaaaaaaa
+bbbbbbb
+ccccccccc
+FOO=bar`
+    );
+    const res = await context.getInputList('secrets', true);
+    console.log(res);
+    expect(res).toEqual([
+      'GIT_AUTH_TOKEN=abcdefgh,ijklmno=0123456789',
+      'MYSECRET=aaaaaaaa',
+      'bbbbbbb',
+      'ccccccccc',
+      'FOO=bar'
+    ]);
+  });
+
+  it('large multiline values', async () => {
+    setInput(
+      'secrets',
+      `"GPG_KEY=${pgp}"
+FOO=bar`
+    );
+    const res = await context.getInputList('secrets', true);
+    console.log(res);
+    expect(res).toEqual([`GPG_KEY=${pgp}`, 'FOO=bar']);
+  });
+
+  it('multiline values escape quotes', async () => {
+    setInput(
+      'secrets',
+      `GIT_AUTH_TOKEN=abcdefgh,ijklmno=0123456789
+"MYSECRET=aaaaaaaa
+bbbb""bbb
+ccccccccc"
+FOO=bar`
+    );
+    const res = await context.getInputList('secrets', true);
+    console.log(res);
+    expect(res).toEqual([
+      'GIT_AUTH_TOKEN=abcdefgh,ijklmno=0123456789',
+      `MYSECRET=aaaaaaaa
+bbbb\"bbb
+ccccccccc`,
+      'FOO=bar'
+    ]);
+  });
+});
+
+describe('asyncForEach', () => {
+  it('executes async tasks sequentially', async () => {
+    const testValues = [1, 2, 3, 4, 5];
+    const results: number[] = [];
+
+    await context.asyncForEach(testValues, async value => {
+      results.push(value);
+    });
+
+    expect(results).toEqual(testValues);
+  });
+});
+
+// See: https://github.com/actions/toolkit/blob/master/packages/core/src/core.ts#L67
+function getInputName(name: string): string {
+  return `INPUT_${name.replace(/ /g, '_').toUpperCase()}`;
+}
+
+function setInput(name: string, value: string): void {
+  process.env[getInputName(name)] = value;
+}

__tests__/fixtures/secret.txt

@@ -0,0 +1 @@
+bar

action.yml

@@ -1,63 +1,83 @@
+# https://help.github.com/en/articles/metadata-syntax-for-github-actions
 name: Build and push Docker images
-description: Builds and pushes Docker images and will log in to a Docker registry if required
-author: Docker
+description: Build and push Docker images with Buildx
+author: docker
 branding:
   icon: 'anchor'
   color: 'blue'
-runs:
-  using: docker
-  image: docker://docker/github-actions:v1.0
-  args:
-    - build-push
+
 inputs:
-  username:
-    description: Username used to log in to a Docker registry. If not set then no login will occur
+  builder:
+    description: "Builder instance"
     required: false
-  password:
-    description: Password or personal access token used to log in to a Docker registry. If not set then no login will occur
+  context:
+    description: "Build's context is the set of files located in the specified PATH or URL"
     required: false
-  registry:
-    description: Server address of Docker registry. If not set then will default to Docker Hub
+  file:
+    description: "Path to the Dockerfile"
     required: false
-  repository:
-    description: Docker repository to tag the image with
-    required: true
-  tags:
-    description: Comma-delimited list of tags. These will be added to the registry/repository to form the image's tags
-    required: false
-  tag_with_ref:
-    description: Automatically tags the built image with the git reference as per the readme
-    required: false
-    default: false
-  tag_with_sha:
-    description: Automatically tags the built image with the git short SHA as per the readme
-    required: false
-    default: false
-  path:
-    description: Path to run docker build from
-    required: false
-    default: "."
-  dockerfile:
-    description: Name of the Dockerfile (Default is 'path/Dockerfile')
-    required: false
-  target:
-    description: Sets the target stage to build
-    required: false
-  always_pull:
-    description: Always attempt to pull a newer version of the image
-    required: false
-    default: false
-  build_args:
-    description: Comma-delimited list of build-time variables
+  build-args:
+    description: "List of build-time variables"
     required: false
   labels:
-    description: Comma-delimited list of labels to add to the built image
+    description: "List of metadata for an image"
     required: false
-  add_git_labels:
-    description: Adds labels with git repository information to the built image
+  tags:
+    description: "List of tags"
     required: false
-    default: false
+  pull:
+    description: "Always attempt to pull a newer version of the image"
+    required: false
+    default: 'false'
+  target:
+    description: "Sets the target stage to build"
+    required: false
+  allow:
+    description: "List of extra privileged entitlement (eg. network.host,security.insecure)"
+    required: false
+  no-cache:
+    description: "Do not use cache when building the image"
+    required: false
+    default: 'false'
+  platforms:
+    description: "List of target platforms for build"
+    required: false
+  load:
+    description: "Load is a shorthand for --output=type=docker"
+    required: false
+    default: 'false'
   push:
-    description: Whether to push the image
+    description: "Push is a shorthand for --output=type=registry"
     required: false
-    default: true
+    default: 'false'
+  outputs:
+    description: "List of output destinations (format: type=local,dest=path)"
+    required: false
+  cache-from:
+    description: "List of external cache sources for buildx (eg. user/app:cache, type=local,src=path/to/dir)"
+    required: false
+  cache-to:
+    description: "List of cache export destinations for buildx (eg. user/app:cache, type=local,dest=path/to/dir)"
+    required: false
+  secrets:
+    description: "List of secrets to expose to the build (eg. key=string, GIT_AUTH_TOKEN=mytoken)"
+    required: false
+  secret-files:
+    description: "List of secret files to expose to the build (eg. key=filename, MY_SECRET=./secret.txt)"
+    required: false
+  ssh:
+    description: "List of SSH agent socket or keys to expose to the build"
+    required: false
+  github-token:
+    description: "GitHub Token used to authenticate against a repository for Git context"
+    default: ${{ github.token }}
+    required: false
+
+outputs:
+  digest:
+    description: 'Image content-addressable identifier also called a digest'
+
+runs:
+  using: 'node12'
+  main: 'dist/index.js'
+  post: 'dist/index.js'

docker-bake.hcl

@@ -0,0 +1,42 @@
+group "default" {
+  targets = ["build"]
+}
+
+group "pre-checkin" {
+  targets = ["update-yarn", "format", "build"]
+}
+
+group "validate" {
+	targets = ["validate-format", "validate-build", "validate-yarn"]
+}
+
+target "update-yarn" {
+  target = "update-yarn"
+  output = ["."]
+}
+
+target "build" {
+  target = "dist"
+  output = ["."]
+}
+
+target "test" {
+  target = "test"
+}
+
+target "format" {
+  target = "format"
+  output = ["."]
+}
+
+target "validate-format" {
+  target = "validate-format"
+}
+
+target "validate-build" {
+  target = "validate-build"
+}
+
+target "validate-yarn" {
+	target = "validate-yarn"
+}

docs/advanced/cache.md

@@ -0,0 +1,107 @@
+# Cache
+
+* [Registry cache](#registry-cache)
+* [GitHub cache](#github-cache)
+
+> More info about buildx cache: https://github.com/docker/buildx#--cache-fromnametypetypekeyvalue
+
+## Registry cache
+
+You can import/export cache from a cache manifest or (special) image configuration on the registry.
+
+```yaml
+name: ci
+
+on:
+  push:
+    branches:
+      - 'master'
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      -
+        name: Login to DockerHub
+        uses: docker/login-action@v1 
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: true
+          tags: user/app:latest
+          cache-from: type=registry,ref=user/app:latest
+          cache-to: type=inline
+```
+
+## GitHub cache
+
+> :warning: At the moment caches are copied over the existing cache so it [keeps growing](https://github.com/docker/build-push-action/issues/252).
+> The `Move cache` step is used as a temporary fix (see https://github.com/moby/buildkit/issues/1896).
+
+> :rocket: There is a new cache backend using GitHub cache being developed that will lighten your workflow.
+> More info: https://github.com/docker/buildx/pull/535
+
+You can leverage [GitHub cache](https://docs.github.com/en/actions/configuring-and-managing-workflows/caching-dependencies-to-speed-up-workflows)
+using [actions/cache](https://github.com/actions/cache) with this action:
+
+```yaml
+name: ci
+
+on:
+  push:
+    branches:
+      - 'master'
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      -
+        name: Cache Docker layers
+        uses: actions/cache@v2
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-
+      -
+        name: Login to DockerHub
+        uses: docker/login-action@v1 
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: true
+          tags: user/app:latest
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache-new
+      -
+        # Temp fix
+        # https://github.com/docker/build-push-action/issues/252
+        # https://github.com/moby/buildkit/issues/1896
+        name: Move cache
+        run: |
+          rm -rf /tmp/.buildx-cache
+          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
+```

docs/advanced/dockerhub-desc.md

@@ -0,0 +1,48 @@
+# Update DockerHub repo description
+
+You can update the [DockerHub repository description](https://docs.docker.com/docker-hub/repos/) using
+a third party action called [DockerHub Description](https://github.com/peter-evans/dockerhub-description)
+with this action:
+
+```yaml
+name: ci
+
+on:
+  push:
+    branches:
+      - 'master'
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      -
+        name: Login to DockerHub
+        uses: docker/login-action@v1 
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: true
+          tags: user/app:latest
+      -
+        name: Update repo description
+        uses: peter-evans/dockerhub-description@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+          repository: user/app
+```

docs/advanced/export-docker.md

@@ -0,0 +1,35 @@
+# Export image to Docker
+
+You may want your build result to be available in the Docker client through `docker images` to be able to use it
+in another step of your workflow:
+
+```yaml
+name: ci
+
+on:
+  push:
+    branches:
+      - 'master'
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      -
+        name: Build
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          load: true
+          tags: myimage:latest
+      -
+        name: Inspect
+        run: |
+          docker image inspect myimage:latest
+```

docs/advanced/isolated-builders.md

@@ -0,0 +1,44 @@
+# Isolated builders
+
+```yaml
+name: ci
+
+on:
+  push:
+    branches:
+      - 'master'
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        uses: docker/setup-buildx-action@v1
+        id: builder1
+      -
+        uses: docker/setup-buildx-action@v1
+        id: builder2
+      -
+        name: Builder 1 name
+        run: echo ${{ steps.builder1.outputs.name }}
+      -
+        name: Builder 2 name
+        run: echo ${{ steps.builder2.outputs.name }}
+      -
+        name: Build against builder1
+        uses: docker/build-push-action@v2
+        with:
+          builder: ${{ steps.builder1.outputs.name }}
+          context: .
+          target: mytarget1
+      -
+        name: Build against builder2
+        uses: docker/build-push-action@v2
+        with:
+          builder: ${{ steps.builder2.outputs.name }}
+          context: .
+          target: mytarget2
+```

docs/advanced/local-registry.md

@@ -0,0 +1,44 @@
+# Local registry
+
+For testing purposes you may need to create a [local registry](https://hub.docker.com/_/registry) to push images into:
+
+```yaml
+name: ci
+
+on:
+  push:
+    branches:
+      - 'master'
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    services:
+      registry:
+        image: registry:2
+        ports:
+          - 5000:5000
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+        with:
+          driver-opts: network=host
+      -
+        name: Build and push to local registry
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: true
+          tags: localhost:5000/name/app:latest
+      -
+        name: Inspect
+        run: |
+          docker buildx imagetools inspect localhost:5000/name/app:latest
+```

docs/advanced/multi-platform.md

@@ -0,0 +1,44 @@
+# Multi-platform image
+
+You can build multi-platform images using the [`platforms` input](../../README.md#inputs) as described below.
+
+> :bulb: List of available platforms will be displayed and available through our [setup-buildx](https://github.com/docker/setup-buildx-action#about) action.
+
+> :bulb: If you want support for more platforms, you can use QEMU with our [setup-qemu](https://github.com/docker/setup-qemu-action) action.
+
+```yaml
+name: ci
+
+on:
+  push:
+    branches:
+      - 'master'
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      -
+        name: Login to DockerHub
+        uses: docker/login-action@v1 
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: user/app:latest
+```

docs/advanced/push-multi-registries.md

@@ -0,0 +1,57 @@
+# Push to multi-registries
+
+* [Docker Hub and GHCR](#docker-hub-and-ghcr)
+
+## Docker Hub and GHCR
+
+The following workflow will connect you to [DockerHub](https://github.com/docker/login-action#dockerhub)
+and [GitHub Container Registry](https://github.com/docker/login-action#github-container-registry) and push the
+image to these registries.
+
+```yaml
+name: ci
+
+on:
+  push:
+    branches:
+      - 'master'
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      -
+        name: Login to DockerHub
+        uses: docker/login-action@v1 
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: Login to GitHub Container Registry
+        uses: docker/login-action@v1 
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.CR_PAT }}
+      -
+        name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            user/app:latest
+            user/app:1.0.0
+            ghcr.io/user/app:latest
+            ghcr.io/user/app:1.0.0
+```

docs/advanced/secrets.md

@@ -0,0 +1,84 @@
+# Secrets
+
+In the following example we will expose and use the [GITHUB_TOKEN secret](https://docs.github.com/en/actions/reference/authentication-in-a-workflow#about-the-github_token-secret)
+as provided by GitHub in your workflow.
+
+First let's create our `Dockerfile` to use our secret:
+
+```Dockerfile
+#syntax=docker/dockerfile:1.2
+
+FROM alpine
+RUN --mount=type=secret,id=github_token \
+  cat /run/secrets/github_token
+```
+
+As you can see we have named our secret `github_token`. Here is the workflow you can use to expose this secret using
+the [`secrets` input](../../README.md#inputs):
+
+```yaml
+name: ci
+
+on:
+  push:
+    branches:
+      - 'master'
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      -
+        name: Build
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          tags: user/app:latest
+          secrets: |
+            "github_token=${{ secrets.GITHUB_TOKEN }}"
+```
+
+> :bulb: You can also expose a secret file to the build with [`secret-files`](../../README.md#inputs) input:
+> ```yaml
+> secret-files: |
+>   "MY_SECRET=./secret.txt"
+> ```
+
+If you're using [GitHub secrets](https://docs.github.com/en/actions/reference/encrypted-secrets) and need to handle
+multi-line value, you will need to place the key-value pair between quotes:
+
+```yaml
+secrets: |
+  "MYSECRET=${{ secrets.GPG_KEY }}"
+  GIT_AUTH_TOKEN=abcdefghi,jklmno=0123456789
+  "MYSECRET=aaaaaaaa
+  bbbbbbb
+  ccccccccc"
+  FOO=bar
+  "EMPTYLINE=aaaa
+  
+  bbbb
+  ccc"
+  "JSON_SECRET={""key1"":""value1"",""key2"":""value2""}"
+```
+
+| Key                | Value                                            |
+|--------------------|--------------------------------------------------|
+| `MYSECRET`         | `***********************` |
+| `GIT_AUTH_TOKEN`   | `abcdefghi,jklmno=0123456789` |
+| `MYSECRET`         | `aaaaaaaa\nbbbbbbb\nccccccccc` |
+| `FOO`              | `bar` |
+| `EMPTYLINE`        | `aaaa\n\nbbbb\nccc` |
+| `JSON_SECRET`      | `{"key1":"value1","key2":"value2"}` |
+
+> :bulb: All quote signs need to be doubled for escaping.

docs/advanced/tags-labels.md

@@ -0,0 +1,70 @@
+# Handle tags and labels
+
+If you come from [`v1`](https://github.com/docker/build-push-action/tree/releases/v1#readme) and want an
+"automatic" tag management and [OCI Image Format Specification](https://github.com/opencontainers/image-spec/blob/master/annotations.md)
+for labels, you can do it in a dedicated step. The following workflow will use the [Docker meta action](https://github.com/crazy-max/ghaction-docker-meta)
+to handle tags and labels based on GitHub actions events and Git metadata.
+
+```yaml
+name: ci
+
+on:
+  schedule:
+    - cron: '0 10 * * *' # everyday at 10am
+  push:
+    branches:
+      - '**'
+    tags:
+      - 'v*.*.*'
+  pull_request:
+    branches:
+      - 'master'
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v2
+      -
+        name: Docker meta
+        id: docker_meta
+        uses: crazy-max/ghaction-docker-meta@v1
+        with:
+          # list of Docker images to use as base name for tags
+          images: |
+            name/app
+            ghcr.io/username/app
+          # add git short SHA as Docker tag
+          tag-sha: true
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      -
+        name: Login to DockerHub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v1 
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: Login to GHCR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v1
+        with:
+          registry: ghcr.io
+          username: ${{ secrets.GHCR_USERNAME }}
+          password: ${{ secrets.GHCR_TOKEN }}
+      -
+        name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.docker_meta.outputs.tags }}
+          labels: ${{ steps.docker_meta.outputs.labels }}
+```

jest.config.js

@@ -0,0 +1,12 @@
+module.exports = {
+  clearMocks: false,
+  moduleFileExtensions: ['js', 'ts'],
+  setupFiles: ["dotenv/config"],
+  testEnvironment: 'node',
+  testMatch: ['**/*.test.ts'],
+  testRunner: 'jest-circus/runner',
+  transform: {
+    '^.+\\.ts$': 'ts-jest'
+  },
+  verbose: false
+}

package.json

@@ -0,0 +1,53 @@
+{
+  "name": "docker-build-push",
+  "description": "Build and push Docker images",
+  "main": "lib/main.js",
+  "scripts": {
+    "build": "tsc && ncc build",
+    "format": "prettier --write **/*.ts",
+    "format-check": "prettier --check **/*.ts",
+    "test": "jest --coverage",
+    "pre-checkin": "yarn run format && yarn run build"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/docker/build-push-action.git"
+  },
+  "keywords": [
+    "actions",
+    "docker",
+    "build",
+    "push"
+  ],
+  "author": "Docker",
+  "contributors": [
+    {
+      "name": "CrazyMax",
+      "url": "https://crazymax.dev"
+    }
+  ],
+  "license": "Apache-2.0",
+  "dependencies": {
+    "@actions/core": "^1.2.6",
+    "@actions/exec": "^1.0.4",
+    "@actions/github": "^4.0.0",
+    "csv-parse": "^4.15.1",
+    "semver": "^7.3.4",
+    "tmp": "^0.2.1"
+  },
+  "devDependencies": {
+    "@types/csv-parse": "^1.2.2",
+    "@types/jest": "^26.0.3",
+    "@types/node": "^14.0.14",
+    "@types/tmp": "^0.2.0",
+    "@vercel/ncc": "^0.23.0",
+    "dotenv": "^8.2.0",
+    "jest": "^26.1.0",
+    "jest-circus": "^26.1.0",
+    "jest-runtime": "^26.1.0",
+    "prettier": "^2.0.5",
+    "ts-jest": "^26.1.1",
+    "typescript": "^3.9.5",
+    "typescript-formatter": "^7.2.2"
+  }
+}

src/buildx.ts

@@ -0,0 +1,106 @@
+import csvparse from 'csv-parse/lib/sync';
+import fs from 'fs';
+import path from 'path';
+import * as semver from 'semver';
+
+import * as context from './context';
+import * as exec from './exec';
+
+export async function getImageIDFile(): Promise<string> {
+  return path.join(context.tmpDir(), 'iidfile').split(path.sep).join(path.posix.sep);
+}
+
+export async function getImageID(): Promise<string | undefined> {
+  const iidFile = await getImageIDFile();
+  if (!fs.existsSync(iidFile)) {
+    return undefined;
+  }
+  return fs.readFileSync(iidFile, {encoding: 'utf-8'});
+}
+
+export async function getSecretString(kvp: string): Promise<string> {
+  return getSecret(kvp, false);
+}
+
+export async function getSecretFile(kvp: string): Promise<string> {
+  return getSecret(kvp, true);
+}
+
+export async function getSecret(kvp: string, file: boolean): Promise<string> {
+  const delimiterIndex = kvp.indexOf('=');
+  const key = kvp.substring(0, delimiterIndex);
+  let value = kvp.substring(delimiterIndex + 1);
+  if (key.length == 0 || value.length == 0) {
+    throw new Error(`${kvp} is not a valid secret`);
+  }
+
+  if (file) {
+    if (!fs.existsSync(value)) {
+      throw new Error(`secret file ${value} not found`);
+    }
+    value = fs.readFileSync(value, {encoding: 'utf-8'});
+  }
+
+  const secretFile = context.tmpNameSync({
+    tmpdir: context.tmpDir()
+  });
+  fs.writeFileSync(secretFile, value);
+
+  return `id=${key},src=${secretFile}`;
+}
+
+export function isLocalOrTarExporter(outputs: string[]): Boolean {
+  for (let output of csvparse(outputs.join(`\n`), {
+    delimiter: ',',
+    trim: true,
+    columns: false,
+    relaxColumnCount: true
+  })) {
+    // Local if no type is defined
+    // https://github.com/docker/buildx/blob/d2bf42f8b4784d83fde17acb3ed84703ddc2156b/build/output.go#L29-L43
+    if (output.length == 1 && !output[0].startsWith('type=')) {
+      return true;
+    }
+    for (let [key, value] of output.map(chunk => chunk.split('=').map(item => item.trim()))) {
+      if (key == 'type' && (value == 'local' || value == 'tar')) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
+export function hasGitAuthToken(secrets: string[]): Boolean {
+  for (let secret of secrets) {
+    if (secret.startsWith('GIT_AUTH_TOKEN=')) {
+      return true;
+    }
+  }
+  return false;
+}
+
+export async function isAvailable(): Promise<Boolean> {
+  return await exec.exec(`docker`, ['buildx'], true).then(res => {
+    if (res.stderr != '' && !res.success) {
+      return false;
+    }
+    return res.success;
+  });
+}
+
+export async function getVersion(): Promise<string> {
+  return await exec.exec(`docker`, ['buildx', 'version'], true).then(res => {
+    if (res.stderr != '' && !res.success) {
+      throw new Error(res.stderr);
+    }
+    return parseVersion(res.stdout);
+  });
+}
+
+export async function parseVersion(stdout: string): Promise<string> {
+  const matches = /\sv?([0-9.]+)/.exec(stdout);
+  if (!matches) {
+    throw new Error(`Cannot parse Buildx version`);
+  }
+  return semver.clean(matches[1]);
+}

src/context.ts

@@ -0,0 +1,202 @@
+import csvparse from 'csv-parse/lib/sync';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import * as semver from 'semver';
+import * as tmp from 'tmp';
+
+import * as core from '@actions/core';
+import * as github from '@actions/github';
+
+import * as buildx from './buildx';
+
+let _defaultContext, _tmpDir: string;
+
+export interface Inputs {
+  context: string;
+  file: string;
+  buildArgs: string[];
+  labels: string[];
+  tags: string[];
+  pull: boolean;
+  target: string;
+  allow: string[];
+  noCache: boolean;
+  builder: string;
+  platforms: string[];
+  load: boolean;
+  push: boolean;
+  outputs: string[];
+  cacheFrom: string[];
+  cacheTo: string[];
+  secrets: string[];
+  secretFiles: string[];
+  githubToken: string;
+  ssh: string[];
+}
+
+export function defaultContext(): string {
+  if (!_defaultContext) {
+    _defaultContext = `https://github.com/${github.context.repo.owner}/${
+      github.context.repo.repo
+    }.git#${github.context?.ref?.replace(/^refs\//, '')}`;
+  }
+  return _defaultContext;
+}
+
+export function tmpDir(): string {
+  if (!_tmpDir) {
+    _tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'docker-build-push-')).split(path.sep).join(path.posix.sep);
+  }
+  return _tmpDir;
+}
+
+export function tmpNameSync(options?: tmp.TmpNameOptions): string {
+  return tmp.tmpNameSync(options);
+}
+
+export async function getInputs(defaultContext: string): Promise<Inputs> {
+  return {
+    context: core.getInput('context') || defaultContext,
+    file: core.getInput('file'),
+    buildArgs: await getInputList('build-args', true),
+    labels: await getInputList('labels', true),
+    tags: await getInputList('tags'),
+    pull: /true/i.test(core.getInput('pull')),
+    target: core.getInput('target'),
+    allow: await getInputList('allow'),
+    noCache: /true/i.test(core.getInput('no-cache')),
+    builder: core.getInput('builder'),
+    platforms: await getInputList('platforms'),
+    load: /true/i.test(core.getInput('load')),
+    push: /true/i.test(core.getInput('push')),
+    outputs: await getInputList('outputs', true),
+    cacheFrom: await getInputList('cache-from', true),
+    cacheTo: await getInputList('cache-to', true),
+    secrets: await getInputList('secrets', true),
+    secretFiles: await getInputList('secret-files', true),
+    githubToken: core.getInput('github-token'),
+    ssh: await getInputList('ssh')
+  };
+}
+
+export async function getArgs(inputs: Inputs, defaultContext: string, buildxVersion: string): Promise<Array<string>> {
+  let args: Array<string> = ['buildx'];
+  args.push.apply(args, await getBuildArgs(inputs, defaultContext, buildxVersion));
+  args.push.apply(args, await getCommonArgs(inputs));
+  args.push(inputs.context);
+  return args;
+}
+
+async function getBuildArgs(inputs: Inputs, defaultContext: string, buildxVersion: string): Promise<Array<string>> {
+  let args: Array<string> = ['build'];
+  await asyncForEach(inputs.buildArgs, async buildArg => {
+    args.push('--build-arg', buildArg);
+  });
+  await asyncForEach(inputs.labels, async label => {
+    args.push('--label', label);
+  });
+  await asyncForEach(inputs.tags, async tag => {
+    args.push('--tag', tag);
+  });
+  if (inputs.target) {
+    args.push('--target', inputs.target);
+  }
+  if (inputs.allow.length > 0) {
+    args.push('--allow', inputs.allow.join(','));
+  }
+  if (inputs.platforms.length > 0) {
+    args.push('--platform', inputs.platforms.join(','));
+  }
+  await asyncForEach(inputs.outputs, async output => {
+    args.push('--output', output);
+  });
+  if (
+    !buildx.isLocalOrTarExporter(inputs.outputs) &&
+    (inputs.platforms.length == 0 || semver.satisfies(buildxVersion, '>=0.4.2'))
+  ) {
+    args.push('--iidfile', await buildx.getImageIDFile());
+  }
+  await asyncForEach(inputs.cacheFrom, async cacheFrom => {
+    args.push('--cache-from', cacheFrom);
+  });
+  await asyncForEach(inputs.cacheTo, async cacheTo => {
+    args.push('--cache-to', cacheTo);
+  });
+  await asyncForEach(inputs.secrets, async secret => {
+    try {
+      args.push('--secret', await buildx.getSecretString(secret));
+    } catch (err) {
+      core.warning(err.message);
+    }
+  });
+  await asyncForEach(inputs.secretFiles, async secretFile => {
+    try {
+      args.push('--secret', await buildx.getSecretFile(secretFile));
+    } catch (err) {
+      core.warning(err.message);
+    }
+  });
+  if (inputs.githubToken && !buildx.hasGitAuthToken(inputs.secrets) && inputs.context == defaultContext) {
+    args.push('--secret', await buildx.getSecretString(`GIT_AUTH_TOKEN=${inputs.githubToken}`));
+  }
+  await asyncForEach(inputs.ssh, async ssh => {
+    args.push('--ssh', ssh);
+  });
+  if (inputs.file) {
+    args.push('--file', inputs.file);
+  }
+  return args;
+}
+
+async function getCommonArgs(inputs: Inputs): Promise<Array<string>> {
+  let args: Array<string> = [];
+  if (inputs.noCache) {
+    args.push('--no-cache');
+  }
+  if (inputs.builder) {
+    args.push('--builder', inputs.builder);
+  }
+  if (inputs.pull) {
+    args.push('--pull');
+  }
+  if (inputs.load) {
+    args.push('--load');
+  }
+  if (inputs.push) {
+    args.push('--push');
+  }
+  return args;
+}
+
+export async function getInputList(name: string, ignoreComma?: boolean): Promise<string[]> {
+  let res: Array<string> = [];
+
+  const items = core.getInput(name);
+  if (items == '') {
+    return res;
+  }
+
+  for (let output of (await csvparse(items, {
+    columns: false,
+    relaxColumnCount: true,
+    skipLinesWithEmptyValues: true
+  })) as Array<string[]>) {
+    if (output.length == 1) {
+      res.push(output[0]);
+      continue;
+    } else if (!ignoreComma) {
+      res.push(...output);
+      continue;
+    }
+    res.push(output.join(','));
+  }
+
+  return res.filter(item => item).map(pat => pat.trim());
+}
+
+export const asyncForEach = async (array, callback) => {
+  for (let index = 0; index < array.length; index++) {
+    await callback(array[index], index, array);
+  }
+};

src/docker.ts

@@ -0,0 +1,7 @@
+import * as exec from './exec';
+
+export async function isDaemonRunning(): Promise<boolean> {
+  return await exec.exec(`docker`, ['version', '--format', '{{.Server.Os}}'], true).then(res => {
+    return !res.stdout.includes(' ') && res.success;
+  });
+}

src/exec.ts

@@ -0,0 +1,34 @@
+import * as aexec from '@actions/exec';
+import {ExecOptions} from '@actions/exec';
+
+export interface ExecResult {
+  success: boolean;
+  stdout: string;
+  stderr: string;
+}
+
+export const exec = async (command: string, args: string[] = [], silent?: boolean): Promise<ExecResult> => {
+  let stdout: string = '';
+  let stderr: string = '';
+
+  const options: ExecOptions = {
+    silent: silent,
+    ignoreReturnCode: true
+  };
+  options.listeners = {
+    stdout: (data: Buffer) => {
+      stdout += data.toString();
+    },
+    stderr: (data: Buffer) => {
+      stderr += data.toString();
+    }
+  };
+
+  const returnCode: number = await aexec.exec(command, args, options);
+
+  return {
+    success: returnCode === 0,
+    stdout: stdout.trim(),
+    stderr: stderr.trim()
+  };
+};

src/main.ts

@@ -0,0 +1,56 @@
+import * as fs from 'fs';
+import * as os from 'os';
+import * as buildx from './buildx';
+import * as context from './context';
+import * as exec from './exec';
+import * as stateHelper from './state-helper';
+import * as core from '@actions/core';
+
+async function run(): Promise<void> {
+  try {
+    if (os.platform() !== 'linux') {
+      throw new Error(`Only supported on linux platform`);
+    }
+
+    if (!(await buildx.isAvailable())) {
+      throw new Error(`Buildx is required. See https://github.com/docker/setup-buildx-action to set up buildx.`);
+    }
+    stateHelper.setTmpDir(context.tmpDir());
+
+    const buildxVersion = await buildx.getVersion();
+    core.info(`📣 Buildx version: ${buildxVersion}`);
+
+    const defContext = context.defaultContext();
+    let inputs: context.Inputs = await context.getInputs(defContext);
+
+    core.info(`🏃 Starting build...`);
+    const args: string[] = await context.getArgs(inputs, defContext, buildxVersion);
+    await exec.exec('docker', args).then(res => {
+      if (res.stderr != '' && !res.success) {
+        throw new Error(`buildx call failed with: ${res.stderr.match(/(.*)\s*$/)![0]}`);
+      }
+    });
+
+    const imageID = await buildx.getImageID();
+    if (imageID) {
+      core.info('🛒 Extracting digest...');
+      core.info(`${imageID}`);
+      core.setOutput('digest', imageID);
+    }
+  } catch (error) {
+    core.setFailed(error.message);
+  }
+}
+
+async function cleanup(): Promise<void> {
+  if (stateHelper.tmpDir.length > 0) {
+    core.info(`🚿 Removing temp folder ${stateHelper.tmpDir}`);
+    fs.rmdirSync(stateHelper.tmpDir, {recursive: true});
+  }
+}
+
+if (!stateHelper.IsPost) {
+  run();
+} else {
+  cleanup();
+}

src/state-helper.ts

@@ -0,0 +1,12 @@
+import * as core from '@actions/core';
+
+export const IsPost = !!process.env['STATE_isPost'];
+export const tmpDir = process.env['STATE_tmpDir'] || '';
+
+export function setTmpDir(tmpDir: string) {
+  core.saveState('tmpDir', tmpDir);
+}
+
+if (!IsPost) {
+  core.saveState('isPost', 'true');
+}

test/Dockerfile

@@ -0,0 +1,3 @@
+FROM alpine
+
+RUN echo "Hello world!"

test/Dockerfile-multi

@@ -0,0 +1,8 @@
+FROM --platform=$BUILDPLATFORM golang:alpine AS build
+
+ARG TARGETPLATFORM
+ARG BUILDPLATFORM
+RUN echo "I am running on $BUILDPLATFORM, building for $TARGETPLATFORM" > /log
+
+FROM alpine
+COPY --from=build /log /log

test/Dockerfile-multi-sudo

@@ -0,0 +1,22 @@
+FROM --platform=$BUILDPLATFORM golang:alpine AS build
+
+ARG TARGETPLATFORM
+ARG BUILDPLATFORM
+RUN echo "I am running on $BUILDPLATFORM, building for $TARGETPLATFORM" > /log
+
+RUN apk --update --no-cache add \
+    shadow \
+    sudo \
+  && addgroup -g 1200 buildx \
+  && adduser -u 1200 -G buildx -s /sbin/nologin -D buildx \
+  && echo 'buildx ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers \
+  && rm -rf /tmp/* /var/cache/apk/*
+
+USER buildx
+RUN sudo chown buildx. /log
+USER root
+
+FROM alpine
+
+COPY --from=build /log /log
+RUN ls -al /log

tsconfig.json

@@ -0,0 +1,21 @@
+{
+  "compilerOptions": {
+    "target": "es6",
+    "module": "commonjs",
+    "lib": [
+      "es6",
+      "dom"
+    ],
+    "newLine": "lf",
+    "outDir": "./lib",
+    "rootDir": "./src",
+    "strict": true,
+    "noImplicitAny": false,
+    "esModuleInterop": true,
+    "sourceMap": true
+  },
+  "exclude": [
+    "node_modules",
+    "**/*.test.ts"
+  ]
+}