From 7c4296846c7c0bd6a0216519fa9a67ad9f80357b Mon Sep 17 00:00:00 2001 From: CrazyMax <1951866+crazy-max@users.noreply.github.com> Date: Fri, 10 Jul 2026 17:08:24 +0200 Subject: [PATCH] build/bake: add artifact retention days input Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com> --- .github/workflows/.test-bake.yml | 1 + .github/workflows/.test-build.yml | 1 + .github/workflows/bake.yml | 7 ++ .github/workflows/build.yml | 7 ++ README.md | 118 +++++++++++++++--------------- 5 files changed, 76 insertions(+), 58 deletions(-) diff --git a/.github/workflows/.test-bake.yml b/.github/workflows/.test-bake.yml index a310b23..2db80c5 100644 --- a/.github/workflows/.test-bake.yml +++ b/.github/workflows/.test-bake.yml @@ -270,6 +270,7 @@ jobs: with: artifact-name: bake-output artifact-upload: true + artifact-retention-days: 1 context: test output: local sbom: true diff --git a/.github/workflows/.test-build.yml b/.github/workflows/.test-build.yml index c25f359..9a51143 100644 --- a/.github/workflows/.test-build.yml +++ b/.github/workflows/.test-build.yml @@ -320,6 +320,7 @@ jobs: with: artifact-name: build-output artifact-upload: true + artifact-retention-days: 1 file: test/hello.Dockerfile output: local platforms: linux/amd64,linux/arm64 diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml index 78f1413..71353d7 100644 --- a/.github/workflows/bake.yml +++ b/.github/workflows/bake.yml @@ -40,6 +40,11 @@ on: description: "Upload build output GitHub artifact (for local output)" required: false default: false + artifact-retention-days: + type: number + description: "Duration after which artifact will expire in days. 0 means using default retention." + required: false + default: 0 cache: type: boolean description: "Enable cache to GitHub Actions cache backend" @@ -1089,6 +1094,7 @@ jobs: name: ${{ inputs.artifact-name }}${{ steps.prepare.outputs.platform-pair-suffix || '0' }} path: ${{ env.LOCAL_EXPORT_DIR }} if-no-files-found: error + retention-days: ${{ inputs.artifact-retention-days }} - name: Set result output id: result @@ -1277,6 +1283,7 @@ jobs: name: ${{ inputs.artifact-name }} pattern: ${{ inputs.artifact-name }}* delete-merged: true + retention-days: ${{ inputs.artifact-retention-days }} - name: Set outputs id: set diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6332cb8..e3f2e91 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -40,6 +40,11 @@ on: description: "Upload build output GitHub artifact (for local output)" required: false default: false + artifact-retention-days: + type: number + description: "Duration after which artifact will expire in days. 0 means using default retention." + required: false + default: 0 annotations: type: string description: "List of annotations to set to the image (for image output)" @@ -944,6 +949,7 @@ jobs: name: ${{ inputs.artifact-name }}${{ steps.prepare.outputs.platform-pair-suffix || '0' }} path: ${{ env.LOCAL_EXPORT_DIR }} if-no-files-found: error + retention-days: ${{ inputs.artifact-retention-days }} - name: Set result output id: result @@ -1133,6 +1139,7 @@ jobs: name: ${{ inputs.artifact-name }} pattern: ${{ inputs.artifact-name }}* delete-merged: true + retention-days: ${{ inputs.artifact-retention-days }} - name: Set outputs id: set diff --git a/README.md b/README.md index 5bc2772..8231fb1 100644 --- a/README.md +++ b/README.md @@ -214,36 +214,37 @@ jobs: > tags: name/app:latest,name/app:1.0.0 > ``` -| Name | Type | Default | Description | -|------------------------|----------|---------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `runner` | String | See [Runner mapping](#runner-mapping) | GitHub-hosted Linux runner label or platform mapping to build on. See [Runner mapping](#runner-mapping). | -| `distribute` | Bool | `true` | Whether to distribute the build across multiple runners (one platform per runner) | -| `fail-fast` | Bool | `false` | Whether to cancel all in-progress and queued jobs in the matrix if any job fails | -| `job-name-prefix` | String | | Prefix to include in reusable workflow job matrix names in the GitHub Actions UI | -| `setup-qemu` | Bool | `false` | Runs the `setup-qemu-action` step to install QEMU static binaries | -| `artifact-name` | String | `docker-github-builder-assets` | Name of the uploaded GitHub artifact (for `local` output) | -| `artifact-upload` | Bool | `false` | Upload build output GitHub artifact (for `local` output) | -| `annotations` | List | | List of annotations to set to the image (for `image` output) | -| `build-args` | List | `auto` | List of [build-time variables](https://docs.docker.com/engine/reference/commandline/buildx_build/#build-arg). If you want to set a build-arg through an environment variable, use the `envs` input | -| `cache` | Bool | `false` | Enable [GitHub Actions cache](https://docs.docker.com/build/cache/backends/gha/) exporter | -| `cache-scope` | String | target name or `buildkit` | Which [scope cache object belongs to](https://docs.docker.com/build/cache/backends/gha/#scope) if `cache` is enabled. This is the cache blob prefix name used when pushing cache to GitHub Actions cache backend | -| `cache-mode` | String | `min` | [Cache layers to export](https://docs.docker.com/build/cache/backends/#cache-mode) if cache enabled (`min` or `max`). In `min` cache mode, only layers that are exported into the resulting image are cached, while in `max` cache mode, all layers are cached, even those of intermediate steps | -| `context` | String | `.` | Context to build from in the Git working tree | -| `file` | String | `{context}/Dockerfile` | Path to the Dockerfile | -| `labels` | List | | List of labels for an image (for `image` output) | -| `output` | String | | Build output destination (one of [`image`](https://docs.docker.com/build/exporters/image-registry/) or [`local`](https://docs.docker.com/build/exporters/local-tar/)). Unlike the `build-push-action`, it only accepts `image` or `local`. The reusable workflow takes care of setting the `outputs` attribute | -| `platforms` | List/CSV | | List of [target platforms](https://docs.docker.com/engine/reference/commandline/buildx_build/#platform) to build | -| `push` | Bool | `false` | [Push](https://docs.docker.com/engine/reference/commandline/buildx_build/#push) image to the registry (for `image` output) | -| `sbom` | Bool | `false` | Generate [SBOM](https://docs.docker.com/build/attestations/sbom/) attestation for the build | -| `shm-size` | String | | Size of [`/dev/shm`](https://docs.docker.com/engine/reference/commandline/buildx_build/#shm-size) (e.g., `2g`) | -| `sign` | String | `auto` | Sign attestation manifest for `image` output or artifacts for `local` output, can be one of `auto`, `true` or `false`. The `auto` mode will enable signing if `push` is enabled for pushing the `image` or if `artifact-upload` is enabled for uploading the `local` build output as GitHub Artifact | -| `target` | String | | Sets the target stage to build | -| `ulimit` | List | | [Ulimit](https://docs.docker.com/engine/reference/commandline/buildx_build/#ulimit) options (e.g., `nofile=1024:1024`) | -| `set-meta-annotations` | Bool | `false` | Append OCI Image Format Specification annotations generated by `docker/metadata-action` | -| `set-meta-labels` | Bool | `false` | Append OCI Image Format Specification labels generated by `docker/metadata-action` | -| `meta-images` | List | | [List of images](https://github.com/docker/metadata-action?tab=readme-ov-file#images-input) to use as base name for tags (required for image output) | -| `meta-tags` | List | | [List of tags](https://github.com/docker/metadata-action?tab=readme-ov-file#tags-input) as key-value pair attributes | -| `meta-flavor` | List | | [Flavor](https://github.com/docker/metadata-action?tab=readme-ov-file#flavor-input) defines a global behavior for `meta-tags` | +| Name | Type | Default | Description | +|---------------------------|----------|---------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `runner` | String | See [Runner mapping](#runner-mapping) | GitHub-hosted Linux runner label or platform mapping to build on. See [Runner mapping](#runner-mapping). | +| `distribute` | Bool | `true` | Whether to distribute the build across multiple runners (one platform per runner) | +| `fail-fast` | Bool | `false` | Whether to cancel all in-progress and queued jobs in the matrix if any job fails | +| `job-name-prefix` | String | | Prefix to include in reusable workflow job matrix names in the GitHub Actions UI | +| `setup-qemu` | Bool | `false` | Runs the `setup-qemu-action` step to install QEMU static binaries | +| `artifact-name` | String | `docker-github-builder-assets` | Name of the uploaded GitHub artifact (for `local` output) | +| `artifact-upload` | Bool | `false` | Upload build output GitHub artifact (for `local` output) | +| `artifact-retention-days` | Number | `0` | Duration after which artifact will expire in days. `0` means using default retention | +| `annotations` | List | | List of annotations to set to the image (for `image` output) | +| `build-args` | List | `auto` | List of [build-time variables](https://docs.docker.com/engine/reference/commandline/buildx_build/#build-arg). If you want to set a build-arg through an environment variable, use the `envs` input | +| `cache` | Bool | `false` | Enable [GitHub Actions cache](https://docs.docker.com/build/cache/backends/gha/) exporter | +| `cache-scope` | String | target name or `buildkit` | Which [scope cache object belongs to](https://docs.docker.com/build/cache/backends/gha/#scope) if `cache` is enabled. This is the cache blob prefix name used when pushing cache to GitHub Actions cache backend | +| `cache-mode` | String | `min` | [Cache layers to export](https://docs.docker.com/build/cache/backends/#cache-mode) if cache enabled (`min` or `max`). In `min` cache mode, only layers that are exported into the resulting image are cached, while in `max` cache mode, all layers are cached, even those of intermediate steps | +| `context` | String | `.` | Context to build from in the Git working tree | +| `file` | String | `{context}/Dockerfile` | Path to the Dockerfile | +| `labels` | List | | List of labels for an image (for `image` output) | +| `output` | String | | Build output destination (one of [`image`](https://docs.docker.com/build/exporters/image-registry/) or [`local`](https://docs.docker.com/build/exporters/local-tar/)). Unlike the `build-push-action`, it only accepts `image` or `local`. The reusable workflow takes care of setting the `outputs` attribute | +| `platforms` | List/CSV | | List of [target platforms](https://docs.docker.com/engine/reference/commandline/buildx_build/#platform) to build | +| `push` | Bool | `false` | [Push](https://docs.docker.com/engine/reference/commandline/buildx_build/#push) image to the registry (for `image` output) | +| `sbom` | Bool | `false` | Generate [SBOM](https://docs.docker.com/build/attestations/sbom/) attestation for the build | +| `shm-size` | String | | Size of [`/dev/shm`](https://docs.docker.com/engine/reference/commandline/buildx_build/#shm-size) (e.g., `2g`) | +| `sign` | String | `auto` | Sign attestation manifest for `image` output or artifacts for `local` output, can be one of `auto`, `true` or `false`. The `auto` mode will enable signing if `push` is enabled for pushing the `image` or if `artifact-upload` is enabled for uploading the `local` build output as GitHub Artifact | +| `target` | String | | Sets the target stage to build | +| `ulimit` | List | | [Ulimit](https://docs.docker.com/engine/reference/commandline/buildx_build/#ulimit) options (e.g., `nofile=1024:1024`) | +| `set-meta-annotations` | Bool | `false` | Append OCI Image Format Specification annotations generated by `docker/metadata-action` | +| `set-meta-labels` | Bool | `false` | Append OCI Image Format Specification labels generated by `docker/metadata-action` | +| `meta-images` | List | | [List of images](https://github.com/docker/metadata-action?tab=readme-ov-file#images-input) to use as base name for tags (required for image output) | +| `meta-tags` | List | | [List of tags](https://github.com/docker/metadata-action?tab=readme-ov-file#tags-input) as key-value pair attributes | +| `meta-flavor` | List | | [Flavor](https://github.com/docker/metadata-action?tab=readme-ov-file#flavor-input) defines a global behavior for `meta-tags` | ### Secrets @@ -326,34 +327,35 @@ jobs: > foo*.args.mybuildarg=value > ``` -| Name | Type | Default | Description | -|------------------------|--------|---------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `runner` | String | See [Runner mapping](#runner-mapping) | GitHub-hosted Linux runner label or platform mapping to build on. See [Runner mapping](#runner-mapping). | -| `distribute` | Bool | `true` | Whether to distribute the build across multiple runners (one platform per runner) | -| `fail-fast` | Bool | `false` | Whether to cancel all in-progress and queued jobs in the matrix if any job fails | -| `job-name-prefix` | String | | Prefix to include in reusable workflow job matrix names in the GitHub Actions UI | -| `setup-qemu` | Bool | `false` | Runs the `setup-qemu-action` step to install QEMU static binaries | -| `artifact-name` | String | `docker-github-builder-assets` | Name of the uploaded GitHub artifact (for `local` output) | -| `artifact-upload` | Bool | `false` | Upload build output GitHub artifact (for `local` output) | -| `cache` | Bool | `false` | Enable [GitHub Actions cache](https://docs.docker.com/build/cache/backends/gha/) exporter | -| `cache-scope` | String | target name or `buildkit` | Which [scope cache object belongs to](https://docs.docker.com/build/cache/backends/gha/#scope) if `cache` is enabled. This is the cache blob prefix name used when pushing cache to GitHub Actions cache backend | -| `cache-mode` | String | `min` | [Cache layers to export](https://docs.docker.com/build/cache/backends/#cache-mode) if cache enabled (`min` or `max`). In `min` cache mode, only layers that are exported into the resulting image are cached, while in `max` cache mode, all layers are cached, even those of intermediate steps | -| `context` | String | `.` | Context to build from in the Git working tree | -| `files` | List | `{context}/docker-bake.hcl` | List of bake definition files | -| `output` | String | | Build output destination (one of [`image`](https://docs.docker.com/build/exporters/image-registry/) or [`local`](https://docs.docker.com/build/exporters/local-tar/)). | -| `push` | Bool | `false` | Push image to the registry (for `image` output) | -| `sbom` | Bool | `false` | Generate [SBOM](https://docs.docker.com/build/attestations/sbom/) attestation for the build | -| `set` | List | | List of [target values to override](https://docs.docker.com/engine/reference/commandline/buildx_bake/#set) (e.g., `targetpattern.key=value`) | -| `sign` | String | `auto` | Sign attestation manifest for `image` output or artifacts for `local` output, can be one of `auto`, `true` or `false`. The `auto` mode will enable signing if `push` is enabled for pushing the `image` or if `artifact-upload` is enabled for uploading the `local` build output as GitHub Artifact | -| `target` | String | `default` | Bake target to build | -| `vars` | List | | [Variables](https://docs.docker.com/build/bake/variables/) to set in the Bake definition as list of key-value pair | -| `set-meta-annotations` | Bool | `false` | Append OCI Image Format Specification annotations generated by `docker/metadata-action` | -| `set-meta-labels` | Bool | `false` | Append OCI Image Format Specification labels generated by `docker/metadata-action` | -| `meta-images` | List | | [List of images](https://github.com/docker/metadata-action?tab=readme-ov-file#images-input) to use as base name for tags (required for image output) | -| `meta-tags` | List | | [List of tags](https://github.com/docker/metadata-action?tab=readme-ov-file#tags-input) as key-value pair attributes | -| `meta-labels` | List | | [List of custom labels](https://github.com/docker/metadata-action?tab=readme-ov-file#overwrite-labels-and-annotations) | -| `meta-annotations` | List | | [List of custom annotations](https://github.com/docker/metadata-action?tab=readme-ov-file#overwrite-labels-and-annotations) | -| `meta-flavor` | List | | [Flavor](https://github.com/docker/metadata-action?tab=readme-ov-file#flavor-input) defines a global behavior for `meta-tags` | +| Name | Type | Default | Description | +|---------------------------|--------|---------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `runner` | String | See [Runner mapping](#runner-mapping) | GitHub-hosted Linux runner label or platform mapping to build on. See [Runner mapping](#runner-mapping). | +| `distribute` | Bool | `true` | Whether to distribute the build across multiple runners (one platform per runner) | +| `fail-fast` | Bool | `false` | Whether to cancel all in-progress and queued jobs in the matrix if any job fails | +| `job-name-prefix` | String | | Prefix to include in reusable workflow job matrix names in the GitHub Actions UI | +| `setup-qemu` | Bool | `false` | Runs the `setup-qemu-action` step to install QEMU static binaries | +| `artifact-name` | String | `docker-github-builder-assets` | Name of the uploaded GitHub artifact (for `local` output) | +| `artifact-upload` | Bool | `false` | Upload build output GitHub artifact (for `local` output) | +| `artifact-retention-days` | Number | `0` | Duration after which artifact will expire in days. `0` means using default retention | +| `cache` | Bool | `false` | Enable [GitHub Actions cache](https://docs.docker.com/build/cache/backends/gha/) exporter | +| `cache-scope` | String | target name or `buildkit` | Which [scope cache object belongs to](https://docs.docker.com/build/cache/backends/gha/#scope) if `cache` is enabled. This is the cache blob prefix name used when pushing cache to GitHub Actions cache backend | +| `cache-mode` | String | `min` | [Cache layers to export](https://docs.docker.com/build/cache/backends/#cache-mode) if cache enabled (`min` or `max`). In `min` cache mode, only layers that are exported into the resulting image are cached, while in `max` cache mode, all layers are cached, even those of intermediate steps | +| `context` | String | `.` | Context to build from in the Git working tree | +| `files` | List | `{context}/docker-bake.hcl` | List of bake definition files | +| `output` | String | | Build output destination (one of [`image`](https://docs.docker.com/build/exporters/image-registry/) or [`local`](https://docs.docker.com/build/exporters/local-tar/)). | +| `push` | Bool | `false` | Push image to the registry (for `image` output) | +| `sbom` | Bool | `false` | Generate [SBOM](https://docs.docker.com/build/attestations/sbom/) attestation for the build | +| `set` | List | | List of [target values to override](https://docs.docker.com/engine/reference/commandline/buildx_bake/#set) (e.g., `targetpattern.key=value`) | +| `sign` | String | `auto` | Sign attestation manifest for `image` output or artifacts for `local` output, can be one of `auto`, `true` or `false`. The `auto` mode will enable signing if `push` is enabled for pushing the `image` or if `artifact-upload` is enabled for uploading the `local` build output as GitHub Artifact | +| `target` | String | `default` | Bake target to build | +| `vars` | List | | [Variables](https://docs.docker.com/build/bake/variables/) to set in the Bake definition as list of key-value pair | +| `set-meta-annotations` | Bool | `false` | Append OCI Image Format Specification annotations generated by `docker/metadata-action` | +| `set-meta-labels` | Bool | `false` | Append OCI Image Format Specification labels generated by `docker/metadata-action` | +| `meta-images` | List | | [List of images](https://github.com/docker/metadata-action?tab=readme-ov-file#images-input) to use as base name for tags (required for image output) | +| `meta-tags` | List | | [List of tags](https://github.com/docker/metadata-action?tab=readme-ov-file#tags-input) as key-value pair attributes | +| `meta-labels` | List | | [List of custom labels](https://github.com/docker/metadata-action?tab=readme-ov-file#overwrite-labels-and-annotations) | +| `meta-annotations` | List | | [List of custom annotations](https://github.com/docker/metadata-action?tab=readme-ov-file#overwrite-labels-and-annotations) | +| `meta-flavor` | List | | [Flavor](https://github.com/docker/metadata-action?tab=readme-ov-file#flavor-input) defines a global behavior for `meta-tags` | ### Secrets