v3.2.1

🚀 Enhancements

fix: guard summary jq against null Entrypoint/Cmd/Env Andriy Knysh (@aknysh) (#111)

## what

• Guard the Docker Inspect job-summary jq expressions against null fields by wrapping each iterating expression with // []:
  • .[0].Config.Entrypoint | join(" ") → (.[0].Config.Entrypoint // []) | join(" ")
  • .[0].Config.Cmd | join(" ") → (.[0].Config.Cmd // []) | join(" ")
  • .[0].Config.Env[] | ... → (.[0].Config.Env // [])[] | ...
  • .[0].RootFS.Layers | to_entries[] | ... → (.[0].RootFS.Layers // []) | to_entries[] | ...

why

The summary step (added in #98) feeds several docker inspect fields straight into jq's join, .[], and to_entries, all of which iterate their input. When an image defines no ENTRYPOINT (and/or no CMD/ENV), those fields are null in docker inspect, so jq aborts with:

jq: error (at inspect.json:79): Cannot iterate over null (null)

Under GitHub Actions' default bash --noprofile --norc -e -o pipefail shell, that non-zero exit fails the entire Docker Build step with exit code 5 — even though the image built and pushed successfully. Only the post-build job summary is broken, but the whole job (and thus the release) reports failure.

Every fixture in test/ is FROM nginx, which inherits a non-null entrypoint and cmd, so the summary path never exercised a null field. Any entrypoint-less image trips it — e.g. Atmos's FROM debian:trixie-slim image, whose release build hit exactly this:

• Failing run: https://github.com/cloudposse/atmos/actions/runs/32415649296/job/96577335200

proof

Entrypoint: null reproduces the failure with the old expression and is fixed by the new one; populated images are unaffected:

$ echo '[{"Config":{"Entrypoint":null}}]' | jq -r '.[0].Config.Entrypoint | join(" ")'
jq: error (at <stdin>:0): Cannot iterate over null (null)   # exit 5

$ echo '[{"Config":{"Entrypoint":null}}]' | jq -r '(.[0].Config.Entrypoint // []) | join(" ")'
                                                            # exit 0, empty

$ echo '[{"Config":{"Entrypoint":["/bin/atmos"]}}]' | jq -r '(.[0].Config.Entrypoint // []) | join(" ")'
/bin/atmos                                                  # still works

references

• Regresses images without an ENTRYPOINT/CMD/ENV; introduced by the structured summary in #98.
• A regression fixture would need an entrypoint-less test image plus a summary-enabled (inspect: true) run against the registry — happy to add as a follow-up if desired (the current test/* scenarios run with inspect: false).

v3.2.0

feat: add sbom input and digest output Erik Osterman (Cloud Posse) (@osterman) (#110)

## Summary - Add an `sbom` input (mirrors the existing `provenance` input) and pass it through to `docker/build-push-action@v7` to enable SBOM attestation generation. - Add a `digest` output sourced directly from the build step's own `digest` output, so downstream cosign signing steps don't need to `fromJSON()`-parse the `metadata` output. - Regenerate `README.md` (`atmos readme`) to document both the new input and output.

Test plan

• YAML validity checked locally (yaml.safe_load)
• CI workflows (test-docker-build*.yml) pass on this branch

v3.1.0

fix: install jq 1.7.1 to support arm64 runners (#106) Igor Rodionov (@goruha) (#107)

## what * Bumps the pinned `jq` version installed by `dcarbone/install-jq-action@v3.2.0` from `1.6` to `1.7.1`. * Set default value `drive-opt` from `image=public.ecr.aws/vend/moby/buildkit:buildx-stable-1` to `image=mirror.gcr.io/moby/buildkit:buildx-stable-1`

why

This action fails on arm64 GitHub-hosted / self-hosted runners with:

Cannot handle "ARM64" architecture for os "Linux"
Error: Process completed with exit code 1.

Root cause: dcarbone/install-jq-action@v3.2.0 routes jq 1.5/1.6 installs through scripts/unixish.sh, which only maps Linux binaries for 386/amd64. This is because jq 1.6 (published under stedolan/jq) never shipped a linux-arm64 release asset — arm64 support only arrived with jq 1.7 (published under jqlang/jq), which does publish a jq-linux-arm64 asset.

dcarbone/install-jq-action already added arm64 support for jq 1.7+ via scripts/unixish-17.sh — this action just needs to request a 1.7+ version to use that code path. 1.7.1 is used here (rather than plain 1.7) because it's the patch release fixing known regressions in the initial 1.7 release, and it matches install-jq-action's own default version input.

Resolves #68.

• Solved docker startup too many requests problem

references

• https://github.com/dcarbone/install-jq-action/blob/v3.2.0/action.yaml (version routing: startsWith(inputs.version, '1.7') → unixish-17.sh)
• https://github.com/jqlang/jq/releases/tag/jq-1.7.1 (publishes jq-linux-arm64)

Jon Beilke (@jrbeilke) author

v3.0.0

Enhance Docker image summary with structured inspect output Igor Rodionov (@goruha) (#98)

## what - Replace raw JSON metadata dump in step summary with a rich, structured markdown summary - Add new `summary` input (default `true`) to control step summary generation independently from `inspect` - Add new `inspect` output exposing the full `docker inspect` JSON - Change `metadata` output to use `docker/build-push-action` metadata directly instead of a separate shell step - Remove the old `Get Metadata` step entirely - Disable `inspect` in test workflows (`test-docker-build.yml`, `test-docker-build-multi-platform.yml`) - Control `DOCKER_BUILD_SUMMARY` env var based on `inspect` and `summary` inputs

why

• The previous raw JSON summary was hard to read in GitHub Actions job summaries
• The new format surfaces key image details at a glance: size, architecture, OS, license, tag, digest, revision, source, runtime config, env vars, labels, and layers — each in collapsible sections
• Separating summary from inspect gives users finer control over what gets generated

references

• https://github.com/docker/build-push-action

v2.7.0

Bump cloudposse/github-action-jq from 0.4.0 to 0.4.1 Igor Rodionov (@goruha) (#99)

## what - Bump `cloudposse/github-action-jq` from `0.4.0` to `0.4.1`

why

• Pick up the latest patch release with bug fixes and improvements

references

• https://github.com/cloudposse/github-action-jq

chore(deps): update actions/checkout action to v6 @[renovate[bot]](https://github.com/apps/renovate) (#88)

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v5 → v6

---

Release Notes

actions/checkout (actions/checkout)

v6

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

chore(deps): update docker/setup-qemu-action action to v4 @[renovate[bot]](https://github.com/apps/renovate) (#94)

This PR contains the following updates:

Package	Type	Update	Change
docker/setup-qemu-action	action	major	v3 → v4

---

Release Notes

docker/setup-qemu-action (docker/setup-qemu-action)

v4

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

v2.6.0

chore(deps): update docker/setup-buildx-action action to v4 @[renovate[bot]](https://github.com/apps/renovate) (#95)

This PR contains the following updates:

Package	Type	Update	Change
docker/setup-buildx-action	action	major	v3 → v4

---

Release Notes

docker/setup-buildx-action (docker/setup-buildx-action)

v4

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

chore(deps): update docker/metadata-action action to v6 @[renovate[bot]](https://github.com/apps/renovate) (#97)

This PR contains the following updates:

Package	Type	Update	Change
docker/metadata-action	action	major	v5 → v6

---

Release Notes

docker/metadata-action (docker/metadata-action)

v6

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

v2.5.0

chore(deps): update docker/login-action action to v4 @[renovate[bot]](https://github.com/apps/renovate) (#93)

This PR contains the following updates:

Package	Type	Update	Change
docker/login-action	action	major	v3 → v4

---

Release Notes

docker/login-action (docker/login-action)

v4

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

v2.4.0

chore(deps): update docker/build-push-action action to v7 @[renovate[bot]](https://github.com/apps/renovate) (#96)

This PR contains the following updates:

Package	Type	Update	Change
docker/build-push-action	action	major	v5 → v7

---

Release Notes

docker/build-push-action (docker/build-push-action)

v7

Compare Source

v6

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

v2.3.0

Fix handling metadata with single quotes (#90) Igor Rodionov (@goruha) (#91)

## what * Change the way how docker build output metadata is processed to handle escape character

why

• Metadata JSON from docker-build-push-action contains head/merge commit details including message which might include single quotes
• get-metadata step wraps the JSON in single quotes causing the build step to break if merge commit contains a single quote character (e.g. as part of commit description):

Run metadata=$(echo '{
...
/home/runner/work/_temp/b76bb997-9a9b-4a18-ac9f-321762ea58ba.sh: line 79: syntax error near unexpected token `('
Error: Process completed with exit code 2.
# OR
/home/runner/_work/_temp/5912f8a7-4a6e-4f73-a4c5-b6730c3ebf58.sh: line 456: unexpected EOF while looking for matching `"'
Error: Process completed with exit code 2.

• Simple way to reproduce the error locally:

metadata=$(echo '{ "message": "that's fine" }' | jq -c)

• The native bash way to escape single quotes would be to replace ' with '', however, GHA provide toJSON method which automatically escape characters when used in ENV (reference below)

references

• actions/runner#1656 (comment)
• #90

v2.2.0

Update login condition for Docker action Igor Rodionov (@goruha) (#87)

## what * Update login condition for Docker action

why

• Unable to push to ECR via role

references

• #86