Merge pull request #622 from crazy-max/codeql

ci: enable SAST scanning with CodeQL

.github/workflows/ci.yml

@@ -46,7 +46,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -83,7 +83,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -119,7 +119,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -153,7 +153,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -184,7 +184,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -207,7 +207,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -228,7 +228,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -258,7 +258,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -288,7 +288,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -323,7 +323,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver-opts: network=host
@@ -345,7 +345,7 @@ jobs:
             type=sha
       -
         name: Build and push to local registry
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: ./test
           file: ./test/Dockerfile
@@ -371,7 +371,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
       -
@@ -393,7 +393,7 @@ jobs:
             type=sha
       -
         name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
         with:
           files: |
             ./test/docker-bake.hcl
@@ -416,7 +416,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -444,7 +444,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -462,7 +462,7 @@ jobs:
             maintainer=Foo
       -
         name: Build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: ./test
           file: ./test/output.Dockerfile
@@ -507,7 +507,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
       -
@@ -531,7 +531,7 @@ jobs:
           DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
       -
         name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
         with:
           files: |
             ./test/docker-bake.hcl
@@ -548,7 +548,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -574,7 +574,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: latest
       -
@@ -583,7 +583,7 @@ jobs:
         uses: ./
       -
         name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
         with:
           source: .
           files: |
@@ -607,7 +607,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker

.github/workflows/codeql.yml

@@ -0,0 +1,45 @@
+name: codeql
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'releases/v*'
+  pull_request:
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+env:
+  NODE_VERSION: "24"
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+      -
+        name: Enable corepack
+        run: |
+          corepack enable
+          yarn --version
+      -
+        name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+      -
+        name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: javascript-typescript
+          build-mode: none
+      -
+        name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:javascript-typescript"

.github/workflows/test.yml

@@ -20,7 +20,7 @@ jobs:
         uses: actions/checkout@v6
       -
         name: Test
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
         with:
           source: .
           targets: test

.github/workflows/update-dist.yml

@@ -28,7 +28,7 @@ jobs:
           token: ${{ steps.docker-read-app.outputs.token || github.token }}
       -
         name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
         with:
           source: .
           targets: build

.github/workflows/validate.yml

@@ -15,15 +15,15 @@ jobs:
   prepare:
     runs-on: ubuntu-latest
     outputs:
-      targets: ${{ steps.generate.outputs.targets }}
+      matrix: ${{ steps.generate.outputs.matrix }}
     steps:
       -
         name: Checkout
         uses: actions/checkout@v6
       -
-        name: List targets
+        name: Generate matrix
         id: generate
-        uses: docker/bake-action/subaction/list-targets@v6
+        uses: docker/bake-action/subaction/matrix@v7
         with:
           target: validate
 
@@ -34,10 +34,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: ${{ fromJson(needs.prepare.outputs.targets) }}
+        include: ${{ fromJson(needs.prepare.outputs.matrix) }}
     steps:
       -
         name: Validate
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
         with:
           targets: ${{ matrix.target }}

README.md

@@ -75,27 +75,23 @@ jobs:
   docker:
     runs-on: ubuntu-latest
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v6
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: name/app
       -
         name: Login to DockerHub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       -
         name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
-          context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -129,13 +125,10 @@ jobs:
   docker:
     runs-on: ubuntu-latest
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v6
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             name/app
@@ -147,15 +140,14 @@ jobs:
       -
         name: Login to DockerHub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       -
         name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
-          context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -210,7 +202,7 @@ jobs:
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             name/app
@@ -222,7 +214,7 @@ jobs:
             type=sha
       -
         name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
         with:
           files: |
             ./docker-bake.hcl
@@ -269,7 +261,7 @@ similar to the previous one:
 ```yaml
       -
         name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
         with:
           files: |
             ./docker-bake.hcl
@@ -336,7 +328,7 @@ Alternatively, each output is also exported as an environment variable when `DOC
 So it can be used with our [Docker Build Push action](https://github.com/docker/build-push-action/):
 
 ```yaml
-- uses: docker/build-push-action@v6
+- uses: docker/build-push-action@v7
   with:
     build-args: |
       DOCKER_METADATA_OUTPUT_JSON
@@ -728,7 +720,7 @@ increase this length for larger repositories by setting the
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             name/app
@@ -939,13 +931,13 @@ that you can reuse them further in your workflow using the [`fromJSON` function]
 ```yaml
       -
         name: Docker meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         id: meta
         with:
           images: name/app
       -
         name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -965,7 +957,7 @@ this:
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: name/app
           labels: |
@@ -987,12 +979,12 @@ of the `metadata-action`:
 ```yaml
       -
         name: Docker meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: name/app
       -
         name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           tags: ${{ steps.meta.outputs.tags }}
           annotations: ${{ steps.meta.outputs.annotations }}
@@ -1003,12 +995,12 @@ The same can be done with the [`bake-action`](https://github.com/docker/bake-act
 ```yaml
       -
         name: Docker meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: name/app
       -
         name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
         with:
           files: |
             ./docker-bake.hcl
@@ -1032,14 +1024,14 @@ Please consult the documentation of your registry.
 ```yaml
       -
         name: Docker meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: name/app
         env:
           DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
       -
         name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           tags: ${{ steps.meta.outputs.tags }}
           annotations: ${{ steps.meta.outputs.annotations }}

__tests__/context.test.ts

@@ -79,6 +79,67 @@ describe('getInputs', () => {
         tags: [],
       }
     ],
+    [
+      3,
+      new Map<string, string>([
+        ['labels', 'mylabel=foo#bar\n#comment\nanother=bar'],
+      ]),
+      {
+        context: context.ContextSource.workflow,
+        bakeTarget: 'docker-metadata-action',
+        flavor: [],
+        githubToken: '',
+        images: [],
+        labels: ['mylabel=foo#bar', 'another=bar'],
+        annotations: [],
+        sepLabels: '\n',
+        sepTags: '\n',
+        sepAnnotations: '\n',
+        tags: [],
+      }
+    ],
+    [
+      4,
+      new Map<string, string>([
+        ['annotations', 'org.opencontainers.image.url=https://example.com/path#readme\n#comment\norg.opencontainers.image.source=https://github.com/docker/metadata-action'],
+      ]),
+      {
+        context: context.ContextSource.workflow,
+        bakeTarget: 'docker-metadata-action',
+        flavor: [],
+        githubToken: '',
+        images: [],
+        labels: [],
+        annotations: [
+          'org.opencontainers.image.url=https://example.com/path#readme',
+          'org.opencontainers.image.source=https://github.com/docker/metadata-action'
+        ],
+        sepLabels: '\n',
+        sepTags: '\n',
+        sepAnnotations: '\n',
+        tags: [],
+      }
+    ],
+    [
+      5,
+      new Map<string, string>([
+        ['tags', 'type=raw,value=foo#bar\n#comment'],
+        ['flavor', 'prefix=v#1\n#comment'],
+      ]),
+      {
+        context: context.ContextSource.workflow,
+        bakeTarget: 'docker-metadata-action',
+        flavor: ['prefix=v#1'],
+        githubToken: '',
+        images: [],
+        labels: [],
+        annotations: [],
+        sepLabels: '\n',
+        sepTags: '\n',
+        sepAnnotations: '\n',
+        tags: ['type=raw,value=foo#bar'],
+      }
+    ],
   ];
   test.each(cases)('[%d] given %o as inputs, returns %o', async (num: number, inputs: Map<string, string>, expected: context.Inputs) => {
     inputs.forEach((value: string, name: string) => {

__tests__/meta.test.ts

@@ -3,9 +3,9 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as dotenv from 'dotenv';
 
-import {GitHub} from '@docker/actions-toolkit/lib/github.js';
+import {GitHub} from '@docker/actions-toolkit/lib/github/github.js';
 import {Toolkit} from '@docker/actions-toolkit/lib/toolkit.js';
-import {GitHubRepo} from '@docker/actions-toolkit/lib/types/github.js';
+import {GitHubRepo} from '@docker/actions-toolkit/lib/types/github/github.js';
 
 import {ContextSource, getContext, getInputs, Inputs} from '../src/context.js';
 import type {Context as MetadataContext} from '../src/context.js';

__tests__/setup.unit.ts

@@ -1,259 +1,252 @@
 import fs from 'node:fs';
-import {createRequire} from 'node:module';
 import os from 'node:os';
 import path from 'node:path';
 import {vi} from 'vitest';
 
 const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'docker-metadata-action-'));
 
+const githubPayload = {
+  after: '860c1904a1ce19322e91ac35af1ab07466440c37',
+  base_ref: null,
+  before: '5f3331d7f7044c18ca9f12c77d961c4d7cf3276a',
+  commits: [
+    {
+      author: {
+        email: 'crazy-max@users.noreply.github.com',
+        name: 'CrazyMax',
+        username: 'crazy-max'
+      },
+      committer: {
+        email: 'crazy-max@users.noreply.github.com',
+        name: 'CrazyMax',
+        username: 'crazy-max'
+      },
+      distinct: true,
+      id: '5f3331d7f7044c18ca9f12c77d961c4d7cf3276a',
+      message: 'hello dev',
+      timestamp: '2024-11-13T13:42:28Z',
+      tree_id: 'd2c60af597e863787d2d27f569e30495b0b92820',
+      url: 'https://github.com/docker/test-docker-action/commit/5f3331d7f7044c18ca9f12c77d961c4d7cf3276a'
+    }
+  ],
+  compare: 'https://github.com/docker/test-docker-action/compare/5f3331d7f704...860c1904a1ce',
+  created: false,
+  deleted: false,
+  forced: false,
+  head_commit: {
+    author: {
+      email: 'crazy-max@users.noreply.github.com',
+      name: 'CrazyMax',
+      username: 'crazy-max'
+    },
+    committer: {
+      email: 'crazy-max@users.noreply.github.com',
+      name: 'CrazyMax',
+      username: 'crazy-max'
+    },
+    distinct: true,
+    id: '5f3331d7f7044c18ca9f12c77d961c4d7cf3276a',
+    message: 'hello dev',
+    timestamp: '2024-11-13T13:42:28Z',
+    tree_id: 'd2c60af597e863787d2d27f569e30495b0b92820',
+    url: 'https://github.com/docker/test-docker-action/commit/5f3331d7f7044c18ca9f12c77d961c4d7cf3276a'
+  },
+  organization: {
+    avatar_url: 'https://avatars.githubusercontent.com/u/5429470?v=4',
+    description: 'Docker helps developers bring their ideas to life by conquering the complexity of app development.',
+    events_url: 'https://api.github.com/orgs/docker/events',
+    hooks_url: 'https://api.github.com/orgs/docker/hooks',
+    id: 5429470,
+    issues_url: 'https://api.github.com/orgs/docker/issues',
+    login: 'docker',
+    members_url: 'https://api.github.com/orgs/docker/members{/member}',
+    node_id: 'MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=',
+    public_members_url: 'https://api.github.com/orgs/docker/public_members{/member}',
+    repos_url: 'https://api.github.com/orgs/docker/repos',
+    url: 'https://api.github.com/orgs/docker'
+  },
+  pusher: {
+    email: 'github@crazymax.dev',
+    name: 'crazy-max'
+  },
+  ref: 'refs/heads/dev',
+  repository: {
+    allow_forking: true,
+    archive_url: 'https://api.github.com/repos/docker/test-docker-action/{archive_format}{/ref}',
+    archived: false,
+    assignees_url: 'https://api.github.com/repos/docker/test-docker-action/assignees{/user}',
+    blobs_url: 'https://api.github.com/repos/docker/test-docker-action/git/blobs{/sha}',
+    branches_url: 'https://api.github.com/repos/docker/test-docker-action/branches{/branch}',
+    clone_url: 'https://github.com/docker/test-docker-action.git',
+    collaborators_url: 'https://api.github.com/repos/docker/test-docker-action/collaborators{/collaborator}',
+    comments_url: 'https://api.github.com/repos/docker/test-docker-action/comments{/number}',
+    commits_url: 'https://api.github.com/repos/docker/test-docker-action/commits{/sha}',
+    compare_url: 'https://api.github.com/repos/docker/test-docker-action/compare/{base}...{head}',
+    contents_url: 'https://api.github.com/repos/docker/test-docker-action/contents/{+path}',
+    contributors_url: 'https://api.github.com/repos/docker/test-docker-action/contributors',
+    created_at: 1596792180,
+    default_branch: 'master',
+    deployments_url: 'https://api.github.com/repos/docker/test-docker-action/deployments',
+    description: 'Test "Docker" Actions',
+    disabled: false,
+    downloads_url: 'https://api.github.com/repos/docker/test-docker-action/downloads',
+    events_url: 'https://api.github.com/repos/docker/test-docker-action/events',
+    fork: false,
+    forks: 1,
+    forks_count: 1,
+    forks_url: 'https://api.github.com/repos/docker/test-docker-action/forks',
+    full_name: 'docker/test-docker-action',
+    git_commits_url: 'https://api.github.com/repos/docker/test-docker-action/git/commits{/sha}',
+    git_refs_url: 'https://api.github.com/repos/docker/test-docker-action/git/refs{/sha}',
+    git_tags_url: 'https://api.github.com/repos/docker/test-docker-action/git/tags{/sha}',
+    git_url: 'git://github.com/docker/test-docker-action.git',
+    has_downloads: true,
+    has_issues: true,
+    has_pages: false,
+    has_projects: true,
+    has_wiki: true,
+    homepage: '',
+    hooks_url: 'https://api.github.com/repos/docker/test-docker-action/hooks',
+    html_url: 'https://github.com/docker/test-docker-action',
+    id: 285789493,
+    is_template: false,
+    issue_comment_url: 'https://api.github.com/repos/docker/test-docker-action/issues/comments{/number}',
+    issue_events_url: 'https://api.github.com/repos/docker/test-docker-action/issues/events{/number}',
+    issues_url: 'https://api.github.com/repos/docker/test-docker-action/issues{/number}',
+    keys_url: 'https://api.github.com/repos/docker/test-docker-action/keys{/key_id}',
+    labels_url: 'https://api.github.com/repos/docker/test-docker-action/labels{/name}',
+    language: 'JavaScript',
+    languages_url: 'https://api.github.com/repos/docker/test-docker-action/languages',
+    license: {
+      key: 'mit',
+      name: 'MIT License',
+      node_id: 'MDc6TGljZW5zZTEz',
+      spdx_id: 'MIT',
+      url: 'https://api.github.com/licenses/mit'
+    },
+    master_branch: 'master',
+    merges_url: 'https://api.github.com/repos/docker/test-docker-action/merges',
+    milestones_url: 'https://api.github.com/repos/docker/test-docker-action/milestones{/number}',
+    mirror_url: null,
+    name: 'test-docker-action',
+    node_id: 'MDEwOlJlcG9zaXRvcnkyODU3ODk0OTM=',
+    notifications_url: 'https://api.github.com/repos/docker/test-docker-action/notifications{?since,all,participating}',
+    open_issues: 6,
+    open_issues_count: 6,
+    organization: 'docker',
+    owner: {
+      avatar_url: 'https://avatars.githubusercontent.com/u/5429470?v=4',
+      email: 'info@docker.com',
+      events_url: 'https://api.github.com/users/docker/events{/privacy}',
+      followers_url: 'https://api.github.com/users/docker/followers',
+      following_url: 'https://api.github.com/users/docker/following{/other_user}',
+      gists_url: 'https://api.github.com/users/docker/gists{/gist_id}',
+      gravatar_id: '',
+      html_url: 'https://github.com/docker',
+      id: 5429470,
+      login: 'docker',
+      name: 'docker',
+      node_id: 'MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=',
+      organizations_url: 'https://api.github.com/users/docker/orgs',
+      received_events_url: 'https://api.github.com/users/docker/received_events',
+      repos_url: 'https://api.github.com/users/docker/repos',
+      site_admin: false,
+      starred_url: 'https://api.github.com/users/docker/starred{/owner}{/repo}',
+      subscriptions_url: 'https://api.github.com/users/docker/subscriptions',
+      type: 'Organization',
+      url: 'https://api.github.com/users/docker'
+    },
+    private: true,
+    pulls_url: 'https://api.github.com/repos/docker/test-docker-action/pulls{/number}',
+    pushed_at: 1650360446,
+    releases_url: 'https://api.github.com/repos/docker/test-docker-action/releases{/id}',
+    size: 796,
+    ssh_url: 'git@github.com:docker/test-docker-action.git',
+    stargazers: 0,
+    stargazers_count: 0,
+    stargazers_url: 'https://api.github.com/repos/docker/test-docker-action/stargazers',
+    statuses_url: 'https://api.github.com/repos/docker/test-docker-action/statuses/{sha}',
+    subscribers_url: 'https://api.github.com/repos/docker/test-docker-action/subscribers',
+    subscription_url: 'https://api.github.com/repos/docker/test-docker-action/subscription',
+    svn_url: 'https://github.com/docker/test-docker-action',
+    tags_url: 'https://api.github.com/repos/docker/test-docker-action/tags',
+    teams_url: 'https://api.github.com/repos/docker/test-docker-action/teams',
+    topics: [],
+    trees_url: 'https://api.github.com/repos/docker/test-docker-action/git/trees{/sha}',
+    updated_at: '2022-04-19T09:05:09Z',
+    url: 'https://github.com/docker/test-docker-action',
+    visibility: 'private',
+    watchers: 0,
+    watchers_count: 0
+  },
+  sender: {
+    avatar_url: 'https://avatars.githubusercontent.com/u/1951866?v=4',
+    events_url: 'https://api.github.com/users/crazy-max/events{/privacy}',
+    followers_url: 'https://api.github.com/users/crazy-max/followers',
+    following_url: 'https://api.github.com/users/crazy-max/following{/other_user}',
+    gists_url: 'https://api.github.com/users/crazy-max/gists{/gist_id}',
+    gravatar_id: '',
+    html_url: 'https://github.com/crazy-max',
+    id: 1951866,
+    login: 'crazy-max',
+    node_id: 'MDQ6VXNlcjE5NTE4NjY=',
+    organizations_url: 'https://api.github.com/users/crazy-max/orgs',
+    received_events_url: 'https://api.github.com/users/crazy-max/received_events',
+    repos_url: 'https://api.github.com/users/crazy-max/repos',
+    site_admin: false,
+    starred_url: 'https://api.github.com/users/crazy-max/starred{/owner}{/repo}',
+    subscriptions_url: 'https://api.github.com/users/crazy-max/subscriptions',
+    type: 'User',
+    url: 'https://api.github.com/users/crazy-max'
+  }
+};
+
+const githubEventPath = path.join(tmpDir, 'github-event.json');
+fs.writeFileSync(githubEventPath, JSON.stringify(githubPayload));
+
 process.env = Object.assign({}, process.env, {
   TEMP: tmpDir,
   GITHUB_REPOSITORY: 'docker/metadata-action',
+  GITHUB_REF: 'refs/heads/dev',
+  GITHUB_RUN_ID: '2188748038',
+  GITHUB_RUN_ATTEMPT: '1',
+  GITHUB_RUN_NUMBER: '15',
+  GITHUB_SHA: '5f3331d7f7044c18ca9f12c77d961c4d7cf3276a',
+  GITHUB_EVENT_PATH: githubEventPath,
   RUNNER_TEMP: path.join(tmpDir, 'runner-temp'),
   RUNNER_TOOL_CACHE: path.join(tmpDir, 'runner-tool-cache')
 });
 
-const require = createRequire(import.meta.url);
+const getCommitMock = vi.hoisted(() =>
-type RequireCacheEntry = NonNullable<(typeof require.cache)[string]>;
+  vi.fn(async () => ({
-
+    data: {
-const githubMock = {
+      commit: {
-  context: {
-    repo: {
-      owner: 'docker',
-      repo: 'actions-toolkit'
-    },
-    ref: 'refs/heads/dev',
-    sha: '5f3331d7f7044c18ca9f12c77d961c4d7cf3276a',
-    runId: 2188748038,
-    runNumber: 15,
-    payload: {
-      after: '860c1904a1ce19322e91ac35af1ab07466440c37',
-      base_ref: null,
-      before: '5f3331d7f7044c18ca9f12c77d961c4d7cf3276a',
-      commits: [
-        {
-          author: {
-            email: 'crazy-max@users.noreply.github.com',
-            name: 'CrazyMax',
-            username: 'crazy-max'
-          },
-          committer: {
-            email: 'crazy-max@users.noreply.github.com',
-            name: 'CrazyMax',
-            username: 'crazy-max'
-          },
-          distinct: true,
-          id: '860c1904a1ce19322e91ac35af1ab07466440c37',
-          message: 'hello dev',
-          timestamp: '2022-04-19T11:27:24+02:00',
-          tree_id: 'd2c60af597e863787d2d27f569e30495b0b92820',
-          url: 'https://github.com/docker/test-docker-action/commit/860c1904a1ce19322e91ac35af1ab07466440c37'
-        }
-      ],
-      compare: 'https://github.com/docker/test-docker-action/compare/5f3331d7f704...860c1904a1ce',
-      created: false,
-      deleted: false,
-      forced: false,
-      head_commit: {
-        author: {
-          email: 'crazy-max@users.noreply.github.com',
-          name: 'CrazyMax',
-          username: 'crazy-max'
-        },
         committer: {
-          email: 'crazy-max@users.noreply.github.com',
+          date: '2024-11-13T13:42:28Z'
-          name: 'CrazyMax',
+        }
-          username: 'crazy-max'
-        },
-        distinct: true,
-        id: '860c1904a1ce19322e91ac35af1ab07466440c37',
-        message: 'hello dev',
-        timestamp: '2022-04-19T11:27:24+02:00',
-        tree_id: 'd2c60af597e863787d2d27f569e30495b0b92820',
-        url: 'https://github.com/docker/test-docker-action/commit/860c1904a1ce19322e91ac35af1ab07466440c37'
-      },
-      organization: {
-        avatar_url: 'https://avatars.githubusercontent.com/u/5429470?v=4',
-        description: 'Docker helps developers bring their ideas to life by conquering the complexity of app development.',
-        events_url: 'https://api.github.com/orgs/docker/events',
-        hooks_url: 'https://api.github.com/orgs/docker/hooks',
-        id: 5429470,
-        issues_url: 'https://api.github.com/orgs/docker/issues',
-        login: 'docker',
-        members_url: 'https://api.github.com/orgs/docker/members{/member}',
-        node_id: 'MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=',
-        public_members_url: 'https://api.github.com/orgs/docker/public_members{/member}',
-        repos_url: 'https://api.github.com/orgs/docker/repos',
-        url: 'https://api.github.com/orgs/docker'
-      },
-      pusher: {
-        email: 'github@crazymax.dev',
-        name: 'crazy-max'
-      },
-      ref: 'refs/heads/dev',
-      repository: {
-        allow_forking: true,
-        archive_url: 'https://api.github.com/repos/docker/test-docker-action/{archive_format}{/ref}',
-        archived: false,
-        assignees_url: 'https://api.github.com/repos/docker/test-docker-action/assignees{/user}',
-        blobs_url: 'https://api.github.com/repos/docker/test-docker-action/git/blobs{/sha}',
-        branches_url: 'https://api.github.com/repos/docker/test-docker-action/branches{/branch}',
-        clone_url: 'https://github.com/docker/test-docker-action.git',
-        collaborators_url: 'https://api.github.com/repos/docker/test-docker-action/collaborators{/collaborator}',
-        comments_url: 'https://api.github.com/repos/docker/test-docker-action/comments{/number}',
-        commits_url: 'https://api.github.com/repos/docker/test-docker-action/commits{/sha}',
-        compare_url: 'https://api.github.com/repos/docker/test-docker-action/compare/{base}...{head}',
-        contents_url: 'https://api.github.com/repos/docker/test-docker-action/contents/{+path}',
-        contributors_url: 'https://api.github.com/repos/docker/test-docker-action/contributors',
-        created_at: 1596792180,
-        default_branch: 'master',
-        deployments_url: 'https://api.github.com/repos/docker/test-docker-action/deployments',
-        description: 'Test "Docker" Actions',
-        disabled: false,
-        downloads_url: 'https://api.github.com/repos/docker/test-docker-action/downloads',
-        events_url: 'https://api.github.com/repos/docker/test-docker-action/events',
-        fork: false,
-        forks: 1,
-        forks_count: 1,
-        forks_url: 'https://api.github.com/repos/docker/test-docker-action/forks',
-        full_name: 'docker/test-docker-action',
-        git_commits_url: 'https://api.github.com/repos/docker/test-docker-action/git/commits{/sha}',
-        git_refs_url: 'https://api.github.com/repos/docker/test-docker-action/git/refs{/sha}',
-        git_tags_url: 'https://api.github.com/repos/docker/test-docker-action/git/tags{/sha}',
-        git_url: 'git://github.com/docker/test-docker-action.git',
-        has_downloads: true,
-        has_issues: true,
-        has_pages: false,
-        has_projects: true,
-        has_wiki: true,
-        homepage: '',
-        hooks_url: 'https://api.github.com/repos/docker/test-docker-action/hooks',
-        html_url: 'https://github.com/docker/test-docker-action',
-        id: 285789493,
-        is_template: false,
-        issue_comment_url: 'https://api.github.com/repos/docker/test-docker-action/issues/comments{/number}',
-        issue_events_url: 'https://api.github.com/repos/docker/test-docker-action/issues/events{/number}',
-        issues_url: 'https://api.github.com/repos/docker/test-docker-action/issues{/number}',
-        keys_url: 'https://api.github.com/repos/docker/test-docker-action/keys{/key_id}',
-        labels_url: 'https://api.github.com/repos/docker/test-docker-action/labels{/name}',
-        language: 'JavaScript',
-        languages_url: 'https://api.github.com/repos/docker/test-docker-action/languages',
-        license: {
-          key: 'mit',
-          name: 'MIT License',
-          node_id: 'MDc6TGljZW5zZTEz',
-          spdx_id: 'MIT',
-          url: 'https://api.github.com/licenses/mit'
-        },
-        master_branch: 'master',
-        merges_url: 'https://api.github.com/repos/docker/test-docker-action/merges',
-        milestones_url: 'https://api.github.com/repos/docker/test-docker-action/milestones{/number}',
-        mirror_url: null,
-        name: 'test-docker-action',
-        node_id: 'MDEwOlJlcG9zaXRvcnkyODU3ODk0OTM=',
-        notifications_url: 'https://api.github.com/repos/docker/test-docker-action/notifications{?since,all,participating}',
-        open_issues: 6,
-        open_issues_count: 6,
-        organization: 'docker',
-        owner: {
-          avatar_url: 'https://avatars.githubusercontent.com/u/5429470?v=4',
-          email: 'info@docker.com',
-          events_url: 'https://api.github.com/users/docker/events{/privacy}',
-          followers_url: 'https://api.github.com/users/docker/followers',
-          following_url: 'https://api.github.com/users/docker/following{/other_user}',
-          gists_url: 'https://api.github.com/users/docker/gists{/gist_id}',
-          gravatar_id: '',
-          html_url: 'https://github.com/docker',
-          id: 5429470,
-          login: 'docker',
-          name: 'docker',
-          node_id: 'MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=',
-          organizations_url: 'https://api.github.com/users/docker/orgs',
-          received_events_url: 'https://api.github.com/users/docker/received_events',
-          repos_url: 'https://api.github.com/users/docker/repos',
-          site_admin: false,
-          starred_url: 'https://api.github.com/users/docker/starred{/owner}{/repo}',
-          subscriptions_url: 'https://api.github.com/users/docker/subscriptions',
-          type: 'Organization',
-          url: 'https://api.github.com/users/docker'
-        },
-        private: true,
-        pulls_url: 'https://api.github.com/repos/docker/test-docker-action/pulls{/number}',
-        pushed_at: 1650360446,
-        releases_url: 'https://api.github.com/repos/docker/test-docker-action/releases{/id}',
-        size: 796,
-        ssh_url: 'git@github.com:docker/test-docker-action.git',
-        stargazers: 0,
-        stargazers_count: 0,
-        stargazers_url: 'https://api.github.com/repos/docker/test-docker-action/stargazers',
-        statuses_url: 'https://api.github.com/repos/docker/test-docker-action/statuses/{sha}',
-        subscribers_url: 'https://api.github.com/repos/docker/test-docker-action/subscribers',
-        subscription_url: 'https://api.github.com/repos/docker/test-docker-action/subscription',
-        svn_url: 'https://github.com/docker/test-docker-action',
-        tags_url: 'https://api.github.com/repos/docker/test-docker-action/tags',
-        teams_url: 'https://api.github.com/repos/docker/test-docker-action/teams',
-        topics: [],
-        trees_url: 'https://api.github.com/repos/docker/test-docker-action/git/trees{/sha}',
-        updated_at: '2022-04-19T09:05:09Z',
-        url: 'https://github.com/docker/test-docker-action',
-        visibility: 'private',
-        watchers: 0,
-        watchers_count: 0
-      },
-      sender: {
-        avatar_url: 'https://avatars.githubusercontent.com/u/1951866?v=4',
-        events_url: 'https://api.github.com/users/crazy-max/events{/privacy}',
-        followers_url: 'https://api.github.com/users/crazy-max/followers',
-        following_url: 'https://api.github.com/users/crazy-max/following{/other_user}',
-        gists_url: 'https://api.github.com/users/crazy-max/gists{/gist_id}',
-        gravatar_id: '',
-        html_url: 'https://github.com/crazy-max',
-        id: 1951866,
-        login: 'crazy-max',
-        node_id: 'MDQ6VXNlcjE5NTE4NjY=',
-        organizations_url: 'https://api.github.com/users/crazy-max/orgs',
-        received_events_url: 'https://api.github.com/users/crazy-max/received_events',
-        repos_url: 'https://api.github.com/users/crazy-max/repos',
-        site_admin: false,
-        starred_url: 'https://api.github.com/users/crazy-max/starred{/owner}{/repo}',
-        subscriptions_url: 'https://api.github.com/users/crazy-max/subscriptions',
-        type: 'User',
-        url: 'https://api.github.com/users/crazy-max'
       }
     }
-  },
+  }))
-  getOctokit: () => ({
+);
+
+const getOctokitMock = vi.hoisted(() =>
+  vi.fn(() => ({
     rest: {
       repos: {
-        getCommit: async () => ({
+        getCommit: getCommitMock
-          data: {
-            commit: {
-              committer: {
-                date: '2024-11-13T13:42:28Z'
-              }
-            }
-          }
-        })
       }
     }
-  })
+  }))
-};
+);
 
-vi.mock('@actions/github', () => githubMock);
+vi.mock('@actions/github', async importOriginal => {
-
+  const actual = await importOriginal<typeof import('@actions/github')>();
-for (const mod of ['@actions/github', '@docker/actions-toolkit/node_modules/@actions/github']) {
+  return {
-  try {
+    ...actual,
-    const resolved = require.resolve(mod);
+    context: {
-    vi.doMock(resolved, () => githubMock);
+      ...actual.context,
-    require.cache[resolved] = {
+      payload: githubPayload
-      id: resolved,
+    },
-      filename: resolved,
+    getOctokit: getOctokitMock
-      loaded: true,
+  };
-      exports: githubMock,
+});
-      children: [],
-      paths: []
-    } as RequireCacheEntry;
-  } catch {
-    // Ignore unresolved optional paths; vi.mock handles module-level mocking.
-  }
-}

action.yml

@@ -66,5 +66,5 @@ outputs:
     description: 'Bake definition file with tags and labels'
 
 runs:
-  using: 'node20'
+  using: 'node24'
   main: 'dist/index.js'

dev.Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-ARG NODE_VERSION=20
+ARG NODE_VERSION=24
 
 FROM node:${NODE_VERSION}-alpine AS base
 RUN apk add --no-cache cpio findutils git rsync

package.json

@@ -26,17 +26,17 @@
   "dependencies": {
     "@actions/core": "^3.0.0",
     "@actions/github": "^9.0.0",
-    "@docker/actions-toolkit": "^0.68.0",
+    "@docker/actions-toolkit": "^0.79.0",
     "@renovate/pep440": "^1.0.0",
     "csv-parse": "^6.1.0",
     "handlebars": "^4.7.8",
     "moment": "^2.30.1",
-    "moment-timezone": "^0.6.0",
+    "moment-timezone": "^0.6.1",
     "semver": "^7.7.4"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.3",
-    "@types/node": "^20.19.35",
+    "@types/node": "^24.11.0",
     "@types/semver": "^7.7.1",
     "@typescript-eslint/eslint-plugin": "^8.56.1",
     "@typescript-eslint/parser": "^8.56.1",

src/context.ts

@@ -2,7 +2,7 @@ import * as core from '@actions/core';
 
 import {Util} from '@docker/actions-toolkit/lib/util.js';
 import {Git} from '@docker/actions-toolkit/lib/git.js';
-import {GitHub} from '@docker/actions-toolkit/lib/github.js';
+import {GitHub} from '@docker/actions-toolkit/lib/github/github.js';
 import {Toolkit} from '@docker/actions-toolkit/lib/toolkit.js';
 
 type GithubContext = typeof GitHub.context;
@@ -28,11 +28,11 @@ export interface Inputs {
 export function getInputs(): Inputs {
   return {
     context: (core.getInput('context') || ContextSource.workflow) as ContextSource,
-    images: Util.getInputList('images', {ignoreComma: true, comment: '#'}),
+    images: Util.getInputList('images', {ignoreComma: true, comment: '#', commentNoInfix: true}),
-    tags: Util.getInputList('tags', {ignoreComma: true, comment: '#'}),
+    tags: Util.getInputList('tags', {ignoreComma: true, comment: '#', commentNoInfix: true}),
-    flavor: Util.getInputList('flavor', {ignoreComma: true, comment: '#'}),
+    flavor: Util.getInputList('flavor', {ignoreComma: true, comment: '#', commentNoInfix: true}),
-    labels: Util.getInputList('labels', {ignoreComma: true, comment: '#'}),
+    labels: Util.getInputList('labels', {ignoreComma: true, comment: '#', commentNoInfix: true}),
-    annotations: Util.getInputList('annotations', {ignoreComma: true, comment: '#'}),
+    annotations: Util.getInputList('annotations', {ignoreComma: true, comment: '#', commentNoInfix: true}),
     sepTags: core.getInput('sep-tags', {trimWhitespace: false}) || `\n`,
     sepLabels: core.getInput('sep-labels', {trimWhitespace: false}) || `\n`,
     sepAnnotations: core.getInput('sep-annotations', {trimWhitespace: false}) || `\n`,

src/meta.ts

@@ -6,7 +6,7 @@ import * as pep440 from '@renovate/pep440';
 import * as semver from 'semver';
 import * as core from '@actions/core';
 import {Context as ToolkitContext} from '@docker/actions-toolkit/lib/context.js';
-import {GitHubRepo} from '@docker/actions-toolkit/lib/types/github.js';
+import {GitHubRepo} from '@docker/actions-toolkit/lib/types/github/github.js';
 
 import {Inputs, Context} from './context.js';
 import * as icl from './image.js';