Merge pull request #622 from crazy-max/codeql

ci: enable SAST scanning with CodeQL

.github/workflows/ci.yml

@@ -46,7 +46,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -83,7 +83,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -119,7 +119,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -153,7 +153,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -184,7 +184,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -207,7 +207,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -228,7 +228,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -258,7 +258,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -288,7 +288,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -323,7 +323,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver-opts: network=host
@@ -345,7 +345,7 @@ jobs:
             type=sha
       -
         name: Build and push to local registry
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: ./test
           file: ./test/Dockerfile
@@ -371,7 +371,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
       -
@@ -393,7 +393,7 @@ jobs:
             type=sha
       -
         name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
         with:
           files: |
             ./test/docker-bake.hcl
@@ -416,7 +416,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -444,7 +444,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -462,7 +462,7 @@ jobs:
             maintainer=Foo
       -
         name: Build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: ./test
           file: ./test/output.Dockerfile
@@ -507,7 +507,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
       -
@@ -531,7 +531,7 @@ jobs:
           DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
       -
         name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
         with:
           files: |
             ./test/docker-bake.hcl
@@ -548,7 +548,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -574,7 +574,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: latest
       -
@@ -583,7 +583,7 @@ jobs:
         uses: ./
       -
         name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
         with:
           source: .
           files: |
@@ -607,7 +607,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker

.github/workflows/codeql.yml

@@ -0,0 +1,45 @@
+name: codeql
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'releases/v*'
+  pull_request:
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+env:
+  NODE_VERSION: "24"
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+      -
+        name: Enable corepack
+        run: |
+          corepack enable
+          yarn --version
+      -
+        name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+      -
+        name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: javascript-typescript
+          build-mode: none
+      -
+        name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:javascript-typescript"

.github/workflows/test.yml

@@ -20,7 +20,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Test
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
         with:
           source: .
           targets: test

.github/workflows/update-dist.yml

@@ -28,7 +28,7 @@ jobs:
           token: ${{ steps.docker-read-app.outputs.token || github.token }}
       -
         name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
         with:
           source: .
           targets: build

.github/workflows/validate.yml

@@ -15,15 +15,15 @@ jobs:
   prepare:
     runs-on: ubuntu-latest
     outputs:
-      targets: ${{ steps.generate.outputs.targets }}
+      matrix: ${{ steps.generate.outputs.matrix }}
     steps:
       -
         name: Checkout
         uses: actions/checkout@v6
       -
-        name: List targets
+        name: Generate matrix
         id: generate
-        uses: docker/bake-action/subaction/list-targets@v6
+        uses: docker/bake-action/subaction/matrix@v7
         with:
           target: validate
 
@@ -34,10 +34,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: ${{ fromJson(needs.prepare.outputs.targets) }}
+        include: ${{ fromJson(needs.prepare.outputs.matrix) }}
     steps:
       -
         name: Validate
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
         with:
           targets: ${{ matrix.target }}

README.md

@@ -75,27 +75,23 @@ jobs:
   docker:
     runs-on: ubuntu-latest
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v6
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: name/app
       -
         name: Login to DockerHub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       -
         name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
-          context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -129,13 +125,10 @@ jobs:
   docker:
     runs-on: ubuntu-latest
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v6
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             name/app
@@ -147,15 +140,14 @@ jobs:
       -
         name: Login to DockerHub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       -
         name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
-          context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -210,7 +202,7 @@ jobs:
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             name/app
@@ -222,7 +214,7 @@ jobs:
             type=sha
       -
         name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
         with:
           files: |
             ./docker-bake.hcl
@@ -269,7 +261,7 @@ similar to the previous one:
 ```yaml
       -
         name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
         with:
           files: |
             ./docker-bake.hcl
@@ -336,7 +328,7 @@ Alternatively, each output is also exported as an environment variable when `DOC
 So it can be used with our [Docker Build Push action](https://github.com/docker/build-push-action/):
 
 ```yaml
-- uses: docker/build-push-action@v6
+- uses: docker/build-push-action@v7
   with:
     build-args: |
       DOCKER_METADATA_OUTPUT_JSON
@@ -728,7 +720,7 @@ increase this length for larger repositories by setting the
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             name/app
@@ -939,13 +931,13 @@ that you can reuse them further in your workflow using the [`fromJSON` function]
 ```yaml
       -
         name: Docker meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         id: meta
         with:
           images: name/app
       -
         name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -965,7 +957,7 @@ this:
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: name/app
           labels: |
@@ -987,12 +979,12 @@ of the `metadata-action`:
 ```yaml
       -
         name: Docker meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: name/app
       -
         name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           tags: ${{ steps.meta.outputs.tags }}
           annotations: ${{ steps.meta.outputs.annotations }}
@@ -1003,12 +995,12 @@ The same can be done with the [`bake-action`](https://github.com/docker/bake-act
 ```yaml
       -
         name: Docker meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: name/app
       -
         name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
         with:
           files: |
             ./docker-bake.hcl
@@ -1032,14 +1024,14 @@ Please consult the documentation of your registry.
 ```yaml
       -
         name: Docker meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: name/app
         env:
           DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
       -
         name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           tags: ${{ steps.meta.outputs.tags }}
           annotations: ${{ steps.meta.outputs.annotations }}

__tests__/context.test.ts

@@ -79,6 +79,67 @@ describe('getInputs', () => {
         tags: [],
       }
     ],
+    [
+      3,
+      new Map<string, string>([
+        ['labels', 'mylabel=foo#bar\n#comment\nanother=bar'],
+      ]),
+      {
+        context: context.ContextSource.workflow,
+        bakeTarget: 'docker-metadata-action',
+        flavor: [],
+        githubToken: '',
+        images: [],
+        labels: ['mylabel=foo#bar', 'another=bar'],
+        annotations: [],
+        sepLabels: '\n',
+        sepTags: '\n',
+        sepAnnotations: '\n',
+        tags: [],
+      }
+    ],
+    [
+      4,
+      new Map<string, string>([
+        ['annotations', 'org.opencontainers.image.url=https://example.com/path#readme\n#comment\norg.opencontainers.image.source=https://github.com/docker/metadata-action'],
+      ]),
+      {
+        context: context.ContextSource.workflow,
+        bakeTarget: 'docker-metadata-action',
+        flavor: [],
+        githubToken: '',
+        images: [],
+        labels: [],
+        annotations: [
+          'org.opencontainers.image.url=https://example.com/path#readme',
+          'org.opencontainers.image.source=https://github.com/docker/metadata-action'
+        ],
+        sepLabels: '\n',
+        sepTags: '\n',
+        sepAnnotations: '\n',
+        tags: [],
+      }
+    ],
+    [
+      5,
+      new Map<string, string>([
+        ['tags', 'type=raw,value=foo#bar\n#comment'],
+        ['flavor', 'prefix=v#1\n#comment'],
+      ]),
+      {
+        context: context.ContextSource.workflow,
+        bakeTarget: 'docker-metadata-action',
+        flavor: ['prefix=v#1'],
+        githubToken: '',
+        images: [],
+        labels: [],
+        annotations: [],
+        sepLabels: '\n',
+        sepTags: '\n',
+        sepAnnotations: '\n',
+        tags: ['type=raw,value=foo#bar'],
+      }
+    ],
   ];
   test.each(cases)('[%d] given %o as inputs, returns %o', async (num: number, inputs: Map<string, string>, expected: context.Inputs) => {
     inputs.forEach((value: string, name: string) => {

__tests__/meta.test.ts

@@ -3,9 +3,9 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as dotenv from 'dotenv';
 
-import {GitHub} from '@docker/actions-toolkit/lib/github.js';
+import {GitHub} from '@docker/actions-toolkit/lib/github/github.js';
 import {Toolkit} from '@docker/actions-toolkit/lib/toolkit.js';
-import {GitHubRepo} from '@docker/actions-toolkit/lib/types/github.js';
+import {GitHubRepo} from '@docker/actions-toolkit/lib/types/github/github.js';
 
 import {ContextSource, getContext, getInputs, Inputs} from '../src/context.js';
 import type {Context as MetadataContext} from '../src/context.js';

__tests__/setup.unit.ts

@@ -1,32 +1,11 @@
 import fs from 'node:fs';
-import {createRequire} from 'node:module';
 import os from 'node:os';
 import path from 'node:path';
 import {vi} from 'vitest';
 
 const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'docker-metadata-action-'));
 
-process.env = Object.assign({}, process.env, {
+const githubPayload = {
-  TEMP: tmpDir,
-  GITHUB_REPOSITORY: 'docker/metadata-action',
-  RUNNER_TEMP: path.join(tmpDir, 'runner-temp'),
-  RUNNER_TOOL_CACHE: path.join(tmpDir, 'runner-tool-cache')
-});
-
-const require = createRequire(import.meta.url);
-type RequireCacheEntry = NonNullable<(typeof require.cache)[string]>;
-
-const githubMock = {
-  context: {
-    repo: {
-      owner: 'docker',
-      repo: 'actions-toolkit'
-    },
-    ref: 'refs/heads/dev',
-    sha: '5f3331d7f7044c18ca9f12c77d961c4d7cf3276a',
-    runId: 2188748038,
-    runNumber: 15,
-    payload: {
   after: '860c1904a1ce19322e91ac35af1ab07466440c37',
   base_ref: null,
   before: '5f3331d7f7044c18ca9f12c77d961c4d7cf3276a',
@@ -43,11 +22,11 @@ const githubMock = {
         username: 'crazy-max'
       },
       distinct: true,
-          id: '860c1904a1ce19322e91ac35af1ab07466440c37',
+      id: '5f3331d7f7044c18ca9f12c77d961c4d7cf3276a',
       message: 'hello dev',
-          timestamp: '2022-04-19T11:27:24+02:00',
+      timestamp: '2024-11-13T13:42:28Z',
       tree_id: 'd2c60af597e863787d2d27f569e30495b0b92820',
-          url: 'https://github.com/docker/test-docker-action/commit/860c1904a1ce19322e91ac35af1ab07466440c37'
+      url: 'https://github.com/docker/test-docker-action/commit/5f3331d7f7044c18ca9f12c77d961c4d7cf3276a'
     }
   ],
   compare: 'https://github.com/docker/test-docker-action/compare/5f3331d7f704...860c1904a1ce',
@@ -66,11 +45,11 @@ const githubMock = {
       username: 'crazy-max'
     },
     distinct: true,
-        id: '860c1904a1ce19322e91ac35af1ab07466440c37',
+    id: '5f3331d7f7044c18ca9f12c77d961c4d7cf3276a',
     message: 'hello dev',
-        timestamp: '2022-04-19T11:27:24+02:00',
+    timestamp: '2024-11-13T13:42:28Z',
     tree_id: 'd2c60af597e863787d2d27f569e30495b0b92820',
-        url: 'https://github.com/docker/test-docker-action/commit/860c1904a1ce19322e91ac35af1ab07466440c37'
+    url: 'https://github.com/docker/test-docker-action/commit/5f3331d7f7044c18ca9f12c77d961c4d7cf3276a'
   },
   organization: {
     avatar_url: 'https://avatars.githubusercontent.com/u/5429470?v=4',
@@ -220,12 +199,26 @@ const githubMock = {
     type: 'User',
     url: 'https://api.github.com/users/crazy-max'
   }
-    }
+};
-  },
+
-  getOctokit: () => ({
+const githubEventPath = path.join(tmpDir, 'github-event.json');
-    rest: {
+fs.writeFileSync(githubEventPath, JSON.stringify(githubPayload));
-      repos: {
+
-        getCommit: async () => ({
+process.env = Object.assign({}, process.env, {
+  TEMP: tmpDir,
+  GITHUB_REPOSITORY: 'docker/metadata-action',
+  GITHUB_REF: 'refs/heads/dev',
+  GITHUB_RUN_ID: '2188748038',
+  GITHUB_RUN_ATTEMPT: '1',
+  GITHUB_RUN_NUMBER: '15',
+  GITHUB_SHA: '5f3331d7f7044c18ca9f12c77d961c4d7cf3276a',
+  GITHUB_EVENT_PATH: githubEventPath,
+  RUNNER_TEMP: path.join(tmpDir, 'runner-temp'),
+  RUNNER_TOOL_CACHE: path.join(tmpDir, 'runner-tool-cache')
+});
+
+const getCommitMock = vi.hoisted(() =>
+  vi.fn(async () => ({
     data: {
       commit: {
         committer: {
@@ -233,27 +226,27 @@ const githubMock = {
         }
       }
     }
-        })
+  }))
+);
+
+const getOctokitMock = vi.hoisted(() =>
+  vi.fn(() => ({
+    rest: {
+      repos: {
+        getCommit: getCommitMock
       }
     }
-  })
+  }))
+);
+
+vi.mock('@actions/github', async importOriginal => {
+  const actual = await importOriginal<typeof import('@actions/github')>();
+  return {
+    ...actual,
+    context: {
+      ...actual.context,
+      payload: githubPayload
+    },
+    getOctokit: getOctokitMock
   };
-
+});
-vi.mock('@actions/github', () => githubMock);
-
-for (const mod of ['@actions/github', '@docker/actions-toolkit/node_modules/@actions/github']) {
-  try {
-    const resolved = require.resolve(mod);
-    vi.doMock(resolved, () => githubMock);
-    require.cache[resolved] = {
-      id: resolved,
-      filename: resolved,
-      loaded: true,
-      exports: githubMock,
-      children: [],
-      paths: []
-    } as RequireCacheEntry;
-  } catch {
-    // Ignore unresolved optional paths; vi.mock handles module-level mocking.
-  }
-}

action.yml

@@ -66,5 +66,5 @@ outputs:
     description: 'Bake definition file with tags and labels'
 
 runs:
-  using: 'node20'
+  using: 'node24'
   main: 'dist/index.js'

dev.Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-ARG NODE_VERSION=20
+ARG NODE_VERSION=24
 
 FROM node:${NODE_VERSION}-alpine AS base
 RUN apk add --no-cache cpio findutils git rsync

package.json

@@ -26,17 +26,17 @@
   "dependencies": {
     "@actions/core": "^3.0.0",
     "@actions/github": "^9.0.0",
-    "@docker/actions-toolkit": "^0.68.0",
+    "@docker/actions-toolkit": "^0.79.0",
     "@renovate/pep440": "^1.0.0",
     "csv-parse": "^6.1.0",
     "handlebars": "^4.7.8",
     "moment": "^2.30.1",
-    "moment-timezone": "^0.6.0",
+    "moment-timezone": "^0.6.1",
     "semver": "^7.7.4"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.3",
-    "@types/node": "^20.19.35",
+    "@types/node": "^24.11.0",
     "@types/semver": "^7.7.1",
     "@typescript-eslint/eslint-plugin": "^8.56.1",
     "@typescript-eslint/parser": "^8.56.1",

src/context.ts

@@ -2,7 +2,7 @@ import * as core from '@actions/core';
 
 import {Util} from '@docker/actions-toolkit/lib/util.js';
 import {Git} from '@docker/actions-toolkit/lib/git.js';
-import {GitHub} from '@docker/actions-toolkit/lib/github.js';
+import {GitHub} from '@docker/actions-toolkit/lib/github/github.js';
 import {Toolkit} from '@docker/actions-toolkit/lib/toolkit.js';
 
 type GithubContext = typeof GitHub.context;
@@ -28,11 +28,11 @@ export interface Inputs {
 export function getInputs(): Inputs {
   return {
     context: (core.getInput('context') || ContextSource.workflow) as ContextSource,
-    images: Util.getInputList('images', {ignoreComma: true, comment: '#'}),
+    images: Util.getInputList('images', {ignoreComma: true, comment: '#', commentNoInfix: true}),
-    tags: Util.getInputList('tags', {ignoreComma: true, comment: '#'}),
+    tags: Util.getInputList('tags', {ignoreComma: true, comment: '#', commentNoInfix: true}),
-    flavor: Util.getInputList('flavor', {ignoreComma: true, comment: '#'}),
+    flavor: Util.getInputList('flavor', {ignoreComma: true, comment: '#', commentNoInfix: true}),
-    labels: Util.getInputList('labels', {ignoreComma: true, comment: '#'}),
+    labels: Util.getInputList('labels', {ignoreComma: true, comment: '#', commentNoInfix: true}),
-    annotations: Util.getInputList('annotations', {ignoreComma: true, comment: '#'}),
+    annotations: Util.getInputList('annotations', {ignoreComma: true, comment: '#', commentNoInfix: true}),
     sepTags: core.getInput('sep-tags', {trimWhitespace: false}) || `\n`,
     sepLabels: core.getInput('sep-labels', {trimWhitespace: false}) || `\n`,
     sepAnnotations: core.getInput('sep-annotations', {trimWhitespace: false}) || `\n`,

src/meta.ts

@@ -6,7 +6,7 @@ import * as pep440 from '@renovate/pep440';
 import * as semver from 'semver';
 import * as core from '@actions/core';
 import {Context as ToolkitContext} from '@docker/actions-toolkit/lib/context.js';
-import {GitHubRepo} from '@docker/actions-toolkit/lib/types/github.js';
+import {GitHubRepo} from '@docker/actions-toolkit/lib/types/github/github.js';
 
 import {Inputs, Context} from './context.js';
 import * as icl from './image.js';