build(deps): bump github/codeql-action from 4.35.2 to 4.35.3

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...e46ed2cbd01164d986452f91f178727624ae40d7) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2026-05-04 05:07:33 +00:00
8 changed files with 865 additions and 0 deletions
@@ -0,0 +1,605 @@
 name: ci
 permissions:
  contents: read
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 on:
  workflow_dispatch:
  schedule:
    - cron: '0 10 * * *'
  push:
    branches:
      - 'master'
      - 'releases/v*'
    tags:
      - 'v*'
  pull_request:
 jobs:
  main:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        buildx-version:
          - ""
          - "latest"
          - "v0.4.1"
          - "cloud:latest"
          - "cloud:v0.11.2-desktop.2"
          - "lab:latest"
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up Docker Buildx
        id: buildx
        uses: ./
        with:
          version: ${{ matrix.buildx-version }}
      -
        name: Nodes output
        run: |
          cat << EOF
          ${{ steps.buildx.outputs.nodes }}
          EOF
  multi:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up Docker Buildx 1
        uses: ./
      -
        name: Set up Docker Buildx 2
        uses: ./
  error:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Stop docker
        run: |
          sudo systemctl stop docker docker.socket
      -
        name: Set up Docker Buildx
        id: buildx
        continue-on-error: true
        uses: ./
      -
        name: Check
        run: |
          echo "${{ toJson(steps.buildx) }}"
          if [ "${{ steps.buildx.outcome }}" != "failure" ] || [ "${{ steps.buildx.conclusion }}" != "success" ]; then
            echo "::error::Should have failed"
            exit 1
          fi
      -
        name: Dump context
        if: always()
        uses: crazy-max/ghaction-dump-context@5d2753e7076f4568c7729971e25231f32147e2d8 # v3.0.0
  debug:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Create Dockerfile
        run: |
          cat > ./Dockerfile <<EOL
          FROM alpine
          RUN uname -a
          EOL
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      -
        name: Set up Docker Buildx
        uses: ./
        with:
          buildkitd-flags: --debug
      -
        name: Build
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/ppc64le
  use:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        use:
          - true
          - false
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up Docker Buildx
        uses: ./
        with:
          use: ${{ matrix.use }}
      -
        name: List builder instances
        run: docker buildx ls
  driver:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        driver-opts:
          - image=moby/buildkit:latest
          - |
            image=moby/buildkit:master
            network=host
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up Docker Buildx
        uses: ./
        with:
          driver: docker-container
          driver-opts: ${{ matrix.driver-opts }}
  docker-driver:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up Docker Buildx
        uses: ./
        id: builder
        with:
          driver: docker
      -
        name: Verify
        run: |
          [[ "${{ steps.builder.outputs.name }}" = "default" ]]
          docker buildx inspect
          docker buildx inspect | grep Driver | grep docker
          docker buildx inspect | grep Status | grep running
  endpoint:
    runs-on: ubuntu-latest
    services:
      dind:
        image: docker:29.3-dind@sha256:4d90f1f6c400315c2dba96d3ec93c01e64198395cbba04f79d12adce4f737029
        options: >-
          --privileged
          --health-cmd "docker info"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        env:
          DOCKER_TLS_CERTDIR: ""
        ports:
          - 2375:2375
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Create context
        run: |
          docker context create mycontext --docker host=tcp://127.0.0.1:2375
      -
        name: Check context
        run: |
          docker --context mycontext info
      -
        name: Set up Docker Buildx
        uses: ./
        with:
          endpoint: mycontext
        env:
          DOCKER_CONTEXT: mycontext
  buildkitd-config:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Create buildkitd conf
        run: |
          cat > /tmp/buildkitd.toml <<EOL
          debug = true
          [registry."docker.io"]
            mirrors = ["mirror.gcr.io"]
          EOL
      -
        name: Create Dockerfile
        run: |
          cat > ./Dockerfile <<EOL
          FROM alpine
          EOL
      -
        name: Set up Docker Buildx
        uses: ./
        with:
          buildkitd-flags: --debug
          buildkitd-config: /tmp/buildkitd.toml
      -
        name: Build
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
  buildkitd-config-inline:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Create Dockerfile
        run: |
          cat > ./Dockerfile <<EOL
          FROM alpine
          EOL
      -
        name: Set up Docker Buildx
        uses: ./
        with:
          buildkitd-flags: --debug
          buildkitd-config-inline: |
            debug = true
            [registry."docker.io"]
              mirrors = ["mirror.gcr.io"]
      -
        name: Build
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
  with-qemu:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        buildx-version:
          - v0.9.1
          - ""
        qemu-platforms:
          - all
          - arm64,riscv64,arm
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
        with:
          platforms: ${{ matrix.qemu-platforms }}
      -
        name: Set up Docker Buildx
        id: buildx
        uses: ./
        with:
          version: ${{ matrix.buildx-version }}
      -
        name: List builder platforms
        run: echo ${{ steps.buildx.outputs.platforms }}
  build-ref:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        ref:
          - master
          - refs/tags/v0.5.1
          - refs/pull/731/head
          - cb185f095fd3d9444e0aa605d3789e9e05f2a1e7
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up Docker Buildx
        uses: ./
        with:
          version: https://github.com/docker/buildx.git#${{ matrix.ref }}
      -
        name: Create Dockerfile
        run: |
          cat > ./Dockerfile <<EOL
          FROM alpine
          EOL
      -
        name: Build
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
  standalone-cmd:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Uninstall docker cli
        run: |
          if dpkg -s "docker-ce" >/dev/null 2>&1; then
            sudo dpkg -r --force-depends docker-ce-cli docker-buildx-plugin
          else
            sudo apt-get purge -y moby-cli moby-buildx
          fi
      -
        name: Set up Docker Buildx
        uses: ./
      -
        name: Create Dockerfile
        run: |
          cat > ./Dockerfile <<EOL
          FROM alpine
          EOL
      -
        name: Build
        run: |
          buildx build .
  standalone-action:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Uninstall docker cli
        run: |
          if dpkg -s "docker-ce" >/dev/null 2>&1; then
            sudo dpkg -r --force-depends docker-ce-cli docker-buildx-plugin
          else
            sudo apt-get purge -y moby-cli moby-buildx
          fi
      -
        name: Set up Docker Buildx
        uses: ./
        with:
          version: ${{ matrix.buildx-version }}
      -
        name: Create Dockerfile
        run: |
          cat > ./Dockerfile <<EOL
          FROM alpine
          EOL
      -
        name: Build
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
  append:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Create dummy contexts
        run: |
          docker context create ctxbuilder2
          docker context create ctxbuilder3
      -
        name: Set up Docker Buildx
        id: buildx
        uses: ./
        with:
          append: |
            - name: builder2
              endpoint: ctxbuilder2
              platforms: linux/amd64
              driver-opts:
                - image=moby/buildkit:master
                - network=host
            - endpoint: ctxbuilder3
              platforms: linux/arm64
      -
        name: List builder platforms
        run: echo ${{ steps.buildx.outputs.platforms }}
  platforms:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      -
        name: Set up Docker Buildx
        uses: ./
        with:
          platforms: linux/amd64
  docker-context:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Create Docker context
        run: |
          docker context create foo
          docker context use foo
      -
        name: Set up Docker Buildx
        uses: ./
        with:
          driver: docker
  cleanup:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        cleanup:
          - true
          - false
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up Docker Buildx
        uses: ./
        with:
          cleanup: ${{ matrix.cleanup }}
  k3s:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        version:
          - latest
          - v0.11.0
          - v0.10.5
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Install k3s
        uses: crazy-max/.github/.github/actions/install-k3s@64a0bfaf6e6bb1c448d6e4c42b11034ee7094f16 # v1.7.1
      -
        name: Set up Docker Buildx
        id: buildx
        uses: ./
        with:
          version: ${{ matrix.version }}
          driver: kubernetes
          platforms: linux/amd64
          driver-opts: |
            image=moby/buildkit:buildx-stable-1
            qemu.install=true
          append: |
            - platforms: linux/arm64
              driver-opts:
                - image=moby/buildkit:buildx-stable-1
                - qemu.install=true
            - platforms: linux/s390x
              driver-opts:
                - image=moby/buildkit:buildx-stable-1
                - qemu.install=true
      -
        name: Create Dockerfile
        run: |
          cat > ./Dockerfile <<EOL
          FROM alpine
          RUN uname -a
          EOL
      -
        name: Build
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
  cache-binary:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        cache:
          - true
          - false
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up Docker Buildx
        uses: ./
        with:
          version: v0.11.2
          cache-binary: ${{ matrix.cache }}
  windows-error:
    runs-on: windows-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up Docker Buildx
        id: buildx
        continue-on-error: true
        uses: ./
      -
        name: Check
        run: |
          echo "${{ toJson(steps.buildx) }}"
          if [ "${{ steps.buildx.outcome }}" != "failure" ] || [ "${{ steps.buildx.conclusion }}" != "success" ]; then
            echo "::error::Should have failed"
            exit 1
          fi
        shell: bash
  keep-state:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up Docker Buildx
        uses: ./
        with:
          name: foo
          keep-state: true
      -
        name: Set up Docker Buildx
        uses: ./
        with:
          name: foo
          keep-state: true
  keep-state-error:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up Docker Buildx
        id: buildx
        continue-on-error: true
        uses: ./
        with:
          driver: docker
          keep-state: true
      -
        name: Check
        run: |
          echo "${{ toJson(steps.buildx) }}"
          if [ "${{ steps.buildx.outcome }}" != "failure" ] || [ "${{ steps.buildx.conclusion }}" != "success" ]; then
            echo "::error::Should have failed"
            exit 1
          fi
@@ -0,0 +1,46 @@
 name: codeql
 permissions:
  contents: read
 on:
  push:
    branches:
      - 'master'
      - 'releases/v*'
  pull_request:
 env:
  NODE_VERSION: "24"
 jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Enable corepack
        run: |
          corepack enable
          yarn --version
      -
        name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ env.NODE_VERSION }}
      -
        name: Initialize CodeQL
        uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
        with:
          languages: javascript-typescript
          build-mode: none
      -
        name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
        with:
          category: "/language:javascript-typescript"
@@ -0,0 +1,17 @@
 name: pr-assign-author
 permissions:
  contents: read
 on:
  pull_request_target: # zizmor: ignore[dangerous-triggers] safe to use without checkout
    types:
      - opened
      - reopened
 jobs:
  run:
    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@64a0bfaf6e6bb1c448d6e4c42b11034ee7094f16 # v1.7.1
    permissions:
      contents: read
      pull-requests: write
@@ -0,0 +1,28 @@
 name: publish
 permissions:
  contents: read
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 on:
  release:
    types:
      - published
 jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      packages: write
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Publish
        uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4
@@ -0,0 +1,38 @@
 name: test
 permissions:
  contents: read
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 on:
  push:
    branches:
      - 'master'
      - 'releases/v*'
  pull_request:
 jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Set up Docker Buildx
        uses: ./
      -
        name: Test
        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
        with:
          source: .
          targets: test
      -
        name: Upload coverage
        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
        with:
          files: ./coverage/clover.xml
          token: ${{ secrets.CODECOV_TOKEN }}
@@ -0,0 +1,56 @@
 name: update-dist
 permissions:
  contents: read
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 on:
  pull_request:
    types:
      - opened
      - synchronize
 jobs:
  update-dist:
    if: github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name
    runs-on: ubuntu-latest
    steps:
      -
        name: GitHub auth token from GitHub App
        id: docker-read-app
        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
        with:
          app-id: ${{ secrets.GHACTIONS_REPO_WRITE_APP_ID }}
          private-key: ${{ secrets.GHACTIONS_REPO_WRITE_APP_PRIVATE_KEY }}
          owner: docker
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          fetch-depth: 0
          token: ${{ steps.docker-read-app.outputs.token }}
      -
        name: Build
        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
        with:
          source: .
          targets: build
      -
        name: Commit and push dist
        run: |
          if [ -n "$(git status --porcelain -- dist)" ]; then
            (
              set -x
              git config user.name "github-actions[bot]"
              git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
              git add dist
              git commit -m "chore: update generated content"
              git push
            )
          else
            echo "No changes in dist"
          fi
@@ -0,0 +1,46 @@
 name: validate
 permissions:
  contents: read
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 on:
  push:
    branches:
      - 'master'
      - 'releases/v*'
  pull_request:
 jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.generate.outputs.matrix }}
    steps:
      -
        name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      -
        name: Generate matrix
        id: generate
        uses: docker/bake-action/subaction/matrix@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
        with:
          target: validate
  validate:
    runs-on: ubuntu-latest
    needs:
      - prepare
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJson(needs.prepare.outputs.matrix) }}
    steps:
      -
        name: Validate
        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
        with:
          targets: ${{ matrix.target }}
@@ -0,0 +1,29 @@
 name: zizmor
 permissions:
  contents: read
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 on:
  workflow_dispatch:
  push:
    branches:
      - 'master'
      - 'releases/v*'
    tags:
      - 'v*'
  pull_request:
 jobs:
  zizmor:
    uses: crazy-max/.github/.github/workflows/zizmor.yml@64a0bfaf6e6bb1c448d6e4c42b11034ee7094f16 # v1.7.1
    permissions:
      contents: read
      security-events: write
    with:
      min-severity: medium
      min-confidence: medium
      persona: pedantic