Merge pull request #1172 from crazy-max/build-export-disable

opt to disable build record upload
chore: update generated content
2024-07-02 18:38:46 +02:00 · 2024-07-02 18:19:48 +02:00 · 2024-07-02 18:13:41 +02:00 · 2024-07-02 18:07:54 +02:00 · 2024-07-02 17:59:43 +02:00 · 2024-07-02 17:55:45 +02:00
39 changed files with 10184 additions and 4504 deletions
--- a/.dockerignore
+++ b/.dockerignore
@ -1,2 +1,12 @@
 /coverage
-/node_modules
+
+# Dependency directories
+node_modules/
+jspm_packages/
+
+# yarn v2
+.yarn/cache
+.yarn/unplugged
+.yarn/build-state.yml
+.yarn/install-state.gz
+.pnp.*
--- a/.eslintrc.json
+++ b/.eslintrc.json
@ -13,7 +13,7 @@
  ],
  "parser": "@typescript-eslint/parser",
  "parserOptions": {
-    "ecmaVersion": "latest",
+    "ecmaVersion": 2023,
    "sourceType": "module"
  },
  "plugins": [
--- a/.gitattributes
+++ b/.gitattributes
@ -1,2 +1,4 @@
+/.yarn/releases/** binary
+/.yarn/plugins/** binary
 /dist/** linguist-generated=true
 /lib/** linguist-generated=true
--- a/.github/build-push-summary.png
+++ b/.github/build-push-summary.png
--- a/.github/workflows/.e2e-run.yml
+++ b/.github/workflows/.e2e-run.yml
@ -94,7 +94,7 @@ jobs:
        uses: docker/setup-buildx-action@v3
        with:
          version: ${{ matrix.buildx_version }}
-          config: /tmp/buildkitd.toml
+          buildkitd-config: /tmp/buildkitd.toml
          buildkitd-flags: --debug --allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host
          driver-opts: |
            image=${{ matrix.buildkit_image }}
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@ -1274,10 +1274,9 @@ jobs:
        uses: docker/setup-buildx-action@v3
        with:
          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
-          # TODO: use buildx-stable-1 image when v0.13 promoted
          driver-opts: |
            network=host
-            image=moby/buildkit:v0.13.0
+            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
          buildkitd-flags: --debug
      -
        name: Build
@ -1324,10 +1323,9 @@ jobs:
        uses: docker/setup-buildx-action@v3
        with:
          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
-          # TODO: use buildx-stable-1 image when v0.13 promoted
          driver-opts: |
            network=host
-            image=moby/buildkit:v0.13.0
+            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
          buildkitd-flags: --debug
      -
        name: Build
@ -1346,3 +1344,122 @@ jobs:
        name: Check docker
        run: |
          docker image inspect localhost:5000/name/app:latest
+
+  summary-disable:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+        with:
+          path: action
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
+          driver-opts: |
+            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
+      -
+        name: Build
+        uses: ./action
+        with:
+          file: ./test/Dockerfile
+        env:
+          DOCKER_BUILD_SUMMARY: false
+
+  summary-disable-deprecated:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+        with:
+          path: action
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
+          driver-opts: |
+            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
+      -
+        name: Build
+        uses: ./action
+        with:
+          file: ./test/Dockerfile
+        env:
+          DOCKER_BUILD_NO_SUMMARY: true
+
+  summary-not-supported:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+        with:
+          path: action
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: v0.12.1
+          driver-opts: |
+            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
+      -
+        name: Build
+        uses: ./action
+        with:
+          file: ./test/Dockerfile
+
+  record-upload-disable:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+        with:
+          path: action
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
+          driver-opts: |
+            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
+      -
+        name: Build
+        uses: ./action
+        with:
+          file: ./test/Dockerfile
+        env:
+          DOCKER_BUILD_RECORD_UPLOAD: false
+
+  record-retention-days:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        days:
+          - 2
+          - 0
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+        with:
+          path: action
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
+          driver-opts: |
+            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
+      -
+        name: Build
+        uses: ./action
+        with:
+          file: ./test/Dockerfile
+        env:
+          DOCKER_BUILD_RECORD_RETENTION_DAYS: ${{ matrix.days }}
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@ -88,13 +88,13 @@ jobs:
            username_secret: QUAY_USERNAME
            password_secret: QUAY_TOKEN
            type: remote
-#          -
-#            name: Artifactory
-#            registry: sforzando-build-team-local.jfrog.io
-#            slug: sforzando-build-team-local.jfrog.io/build-push-action-e2e
-#            username_secret: ARTIFACTORY_USERNAME
-#            password_secret: ARTIFACTORY_TOKEN
-#            type: remote
+          -
+            name: Artifactory
+            registry: infradock.jfrog.io
+            slug: infradock.jfrog.io/test-ghaction/build-push-action
+            username_secret: ARTIFACTORY_USERNAME
+            password_secret: ARTIFACTORY_TOKEN
+            type: remote
          -
            name: Harbor
            id: harbor
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@ -20,7 +20,7 @@ jobs:
        uses: actions/checkout@v4
      -
        name: Test
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@v5
        with:
          targets: test
      -
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@ -40,6 +40,6 @@ jobs:
        uses: actions/checkout@v4
      -
        name: Validate
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@v5
        with:
          targets: ${{ matrix.target }}
--- a/.gitignore
+++ b/.gitignore
@ -1,7 +1,5 @@
-node_modules
-lib
+# https://raw.githubusercontent.com/github/gitignore/main/Node.gitignore

-# Rest of the file pulled from https://github.com/github/gitignore/blob/master/Node.gitignore
 # Logs
 logs
 *.log
@ -9,6 +7,7 @@ npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 lerna-debug.log*
+.pnpm-debug.log*

 # Diagnostic reports (https://nodejs.org/api/report.html)
 report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
@ -19,34 +18,14 @@ pids
 *.seed
 *.pid.lock

-# Directory for instrumented libs generated by jscoverage/JSCover
-lib-cov
-
 # Coverage directory used by tools like istanbul
 coverage
 *.lcov

-# nyc test coverage
-.nyc_output
-
-# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
-.grunt
-
-# Bower dependency directory (https://bower.io/)
-bower_components
-
-# node-waf configuration
-.lock-wscript
-
-# Compiled binary addons (https://nodejs.org/api/addons.html)
-build/Release
-
 # Dependency directories
+node_modules/
 jspm_packages/

-# TypeScript v1 declaration files
-typings/
-
 # TypeScript cache
 *.tsbuildinfo

@ -56,36 +35,19 @@ typings/
 # Optional eslint cache
 .eslintcache

-# Optional REPL history
-.node_repl_history
-
-# Output of 'npm pack'
-*.tgz
-
 # Yarn Integrity file
 .yarn-integrity

-# dotenv environment variables file
+# dotenv environment variable files
 .env
-.env.test
+.env.development.local
+.env.test.local
+.env.production.local
+.env.local

-# parcel-bundler cache (https://parceljs.org/)
-.cache
-
-# next.js build output
-.next
-
-# nuxt.js build output
-.nuxt
-
-# vuepress build output
-.vuepress/dist
-
-# Serverless directories
-.serverless/
-
-# FuseBox cache
-.fusebox/
-
-# DynamoDB Local files
-.dynamodb/
+# yarn v2
+.yarn/cache
+.yarn/unplugged
+.yarn/build-state.yml
+.yarn/install-state.gz
+.pnp.*
--- a/.prettierignore
+++ b/.prettierignore
@ -0,0 +1,6 @@
+# Dependency directories
+node_modules/
+jspm_packages/
+
+# yarn v2
+.yarn/
--- a/.yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
+++ b/.yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
--- a/.yarnrc.yml
+++ b/.yarnrc.yml
@ -0,0 +1,13 @@
+logFilters:
+  - code: YN0013
+    level: discard
+  - code: YN0019
+    level: discard
+  - code: YN0076
+    level: discard
+
+nodeLinker: node-modules
+
+plugins:
+  - path: .yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
+    spec: "@yarnpkg/plugin-interactive-tools"
--- a/README.md
+++ b/README.md
@ -19,21 +19,11 @@ ___
  * [Git context](#git-context)
  * [Path context](#path-context)
 * [Examples](#examples)
-  * [Multi-platform image](https://docs.docker.com/build/ci/github-actions/multi-platform/)
-  * [Secrets](https://docs.docker.com/build/ci/github-actions/secrets/)
-  * [Push to multi-registries](https://docs.docker.com/build/ci/github-actions/push-multi-registries/)
-  * [Manage tags and labels](https://docs.docker.com/build/ci/github-actions/manage-tags-labels/)
-  * [Cache management](https://docs.docker.com/build/ci/github-actions/cache/)
-  * [Export to Docker](https://docs.docker.com/build/ci/github-actions/export-docker/)
-  * [Test before push](https://docs.docker.com/build/ci/github-actions/test-before-push/)
-  * [Local registry](https://docs.docker.com/build/ci/github-actions/local-registry/)
-  * [Share built image between jobs](https://docs.docker.com/build/ci/github-actions/share-image-jobs/)
-  * [Named contexts](https://docs.docker.com/build/ci/github-actions/named-contexts/)
-  * [Copy image between registries](https://docs.docker.com/build/ci/github-actions/copy-image-registries/)
-  * [Update Docker Hub repo description](https://docs.docker.com/build/ci/github-actions/update-dockerhub-desc/)
+* [Summaries](#summaries)
 * [Customizing](#customizing)
  * [inputs](#inputs)
  * [outputs](#outputs)
+  * [environment variables](#environment-variables)
 * [Troubleshooting](#troubleshooting)
 * [Contributing](#contributing)

@ -65,8 +55,6 @@ name: ci

 on:
  push:
-    branches:
-      - 'main'

 jobs:
  docker:
@ -86,7 +74,7 @@ jobs:
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      -
        name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
        with:
          push: true
          tags: user/app:latest
@ -104,28 +92,15 @@ expression `{{defaultContext}}`. Here we can use it to provide a subdirectory
 to the default Git context:

 ```yaml
-      -
-        # Setting up Docker Buildx with docker-container driver is required
-        # at the moment to be able to use a subdirectory with Git context
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
      -
        name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
        with:
          context: "{{defaultContext}}:mysubdir"
          push: true
          tags: user/app:latest
 ```

-> **Warning**
->
-> Subdirectory for Git context is available from [BuildKit v0.9.0](https://github.com/moby/buildkit/releases/tag/v0.9.0).
-> If you're using the `docker` builder (default if `setup-buildx-action` not used),
-> then BuildKit in Docker Engine will be used. As Docker Engine < v22.x.x embeds
-> Buildkit 0.8.2 at the moment, it does not support this feature. It's therefore
-> required to use the `setup-buildx-action` at the moment.
-
 Building from the current repository automatically uses the [GitHub Token](https://docs.github.com/en/actions/security-guides/automatic-token-authentication),
 so it does not need to be passed. If you want to authenticate against another
 private repository, you have to use a [secret](https://docs.docker.com/build/ci/github-actions/secrets)
@ -134,7 +109,7 @@ named `GIT_AUTH_TOKEN` to be able to authenticate against it with Buildx:
 ```yaml
      -
        name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
        with:
          push: true
          tags: user/app:latest
@ -149,8 +124,6 @@ name: ci

 on:
  push:
-    branches:
-      - 'main'

 jobs:
  docker:
@ -173,7 +146,7 @@ jobs:
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      -
        name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
@ -194,12 +167,35 @@ jobs:
 * [Named contexts](https://docs.docker.com/build/ci/github-actions/named-contexts/)
 * [Copy image between registries](https://docs.docker.com/build/ci/github-actions/copy-image-registries/)
 * [Update Docker Hub repo description](https://docs.docker.com/build/ci/github-actions/update-dockerhub-desc/)
+* [SBOM and provenance attestations](https://docs.docker.com/build/ci/github-actions/attestations/)
+* [Annotations](https://docs.docker.com/build/ci/github-actions/annotations/)
+* [Reproducible builds](https://docs.docker.com/build/ci/github-actions/reproducible-builds/)
+
+## Summaries
+
+This action generates a [job summary](https://github.blog/2022-05-09-supercharging-github-actions-with-job-summaries/)
+that provides a detailed overview of the build execution. The summary shows an
+overview of all the steps executed during the build, including the build inputs
+and eventual errors.
+
+![build-push-action job summary](./.github/build-push-summary.png)
+
+The summary also includes a link for downloading the build record with
+additional details about the build, including build stats, logs, outputs, and
+more. The build record can be imported to Docker Desktop for inspecting the
+build in greater detail.
+
+Summaries are enabled by default, but can be disabled with the
+`DOCKER_BUILD_SUMMARY` [environment variable](#environment-variables).
+
+For more information about summaries, refer to the
+[documentation](https://docs.docker.com/go/build-summary/).

 ## Customizing

 ### inputs

-Following inputs can be used as `step.with` keys
+The following inputs can be used as `step.with` keys:

 > `List` type is a newline-delimited string
 > ```yaml
@ -232,7 +228,7 @@ Following inputs can be used as `step.with` keys
 | `network`          | String      | Set the networking mode for the `RUN` instructions during build                                                                                                                   |
 | `no-cache`         | Bool        | Do not use cache when building the image (default `false`)                                                                                                                        |
 | `no-cache-filters` | List/CSV    | Do not cache specified stages                                                                                                                                                     |
-| `outputs`¹         | List        | List of [output destinations](https://docs.docker.com/engine/reference/commandline/buildx_build/#output) (format: `type=local,dest=path`)                                         |
+| `outputs`          | List        | List of [output destinations](https://docs.docker.com/engine/reference/commandline/buildx_build/#output) (format: `type=local,dest=path`)                                         |
 | `platforms`        | List/CSV    | List of [target platforms](https://docs.docker.com/engine/reference/commandline/buildx_build/#platform) for build                                                                 |
 | `provenance`       | Bool/String | Generate [provenance](https://docs.docker.com/build/attestations/slsa-provenance/) attestation for the build (shorthand for `--attest=type=provenance`)                           |
 | `pull`             | Bool        | Always attempt to pull all referenced images (default `false`)                                                                                                                    |
@ -248,10 +244,6 @@ Following inputs can be used as `step.with` keys
 | `ulimit`           | List        | [Ulimit](https://docs.docker.com/engine/reference/commandline/buildx_build/#ulimit) options (e.g., `nofile=1024:1024`)                                                            |
 | `github-token`     | String      | GitHub Token used to authenticate against a repository for [Git context](#git-context) (default `${{ github.token }}`)                                                            |

-> **Note**
->
-> * ¹ multiple `outputs` are [not yet supported](https://github.com/moby/buildkit/issues/1555)
-
 ### outputs

 The following outputs are available:
@ -262,6 +254,14 @@ The following outputs are available:
 | `digest`   | String  | Image digest          |
 | `metadata` | JSON    | Build result metadata |

+### environment variables
+
+| Name                                 | Type   | Default | Description                                                                                                                                                                                                                                                        |
+|--------------------------------------|--------|---------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `DOCKER_BUILD_SUMMARY`               | Bool   | `true`  | If `false`, [build summary](https://docs.docker.com/build/ci/github-actions/build-summary/) generation is disabled                                                                                                                                                 |
+| `DOCKER_BUILD_RECORD_UPLOAD`         | Bool   | `true`  | If `false`, build record upload as [GitHub artifact](https://docs.github.com/en/actions/using-workflows/storing-workflow-data-as-artifacts) is disabled                                                                                                            |
+| `DOCKER_BUILD_RECORD_RETENTION_DAYS` | Number |         | Duration after which build record artifact will expire in days. Defaults to repository/org [retention settings](https://docs.github.com/en/actions/learn-github-actions/usage-limits-billing-and-administration#artifact-and-log-retention-policy) if unset or `0` |
+
 ## Troubleshooting

 See [TROUBLESHOOTING.md](TROUBLESHOOTING.md)
--- a/TROUBLESHOOTING.md
+++ b/TROUBLESHOOTING.md
@ -59,7 +59,7 @@ jobs:
        uses: crazy-max/ghaction-setup-containerd@v2
      -
        name: Build Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
@ -112,7 +112,7 @@ to generate sanitized tags:
    tags: latest

 - name: Build and push
-  uses: docker/build-push-action@v5
+  uses: docker/build-push-action@v6
  with:
    context: .
    push: true
@ -130,7 +130,7 @@ Or a dedicated step to sanitize the slug:
    script: return 'ghcr.io/${{ github.repository }}'.toLowerCase()

 - name: Build and push
-  uses: docker/build-push-action@v5
+  uses: docker/build-push-action@v6
  with:
    context: .
    push: true
--- a/tests/context.test.ts
+++ b/tests/context.test.ts
@ -1,13 +1,16 @@
 import {beforeEach, describe, expect, jest, test} from '@jest/globals';
 import * as fs from 'fs';
 import * as path from 'path';
+
 import {Builder} from '@docker/actions-toolkit/lib/buildx/builder';
 import {Buildx} from '@docker/actions-toolkit/lib/buildx/buildx';
+import {Build} from '@docker/actions-toolkit/lib/buildx/build';
 import {Context} from '@docker/actions-toolkit/lib/context';
 import {Docker} from '@docker/actions-toolkit/lib/docker/docker';
 import {GitHub} from '@docker/actions-toolkit/lib/github';
 import {Toolkit} from '@docker/actions-toolkit/lib/toolkit';
-import {BuilderInfo} from '@docker/actions-toolkit/lib/types/builder';
+
+import {BuilderInfo} from '@docker/actions-toolkit/lib/types/buildx/builder';
 import {GitHubRepo} from '@docker/actions-toolkit/lib/types/github';

 import * as context from '../src/context';
@ -35,6 +38,16 @@ jest.spyOn(Docker, 'isAvailable').mockImplementation(async (): Promise<boolean>
  return true;
 });

+const metadataJson = path.join(tmpDir, 'metadata.json');
+jest.spyOn(Build.prototype, 'getMetadataFilePath').mockImplementation((): string => {
+  return metadataJson;
+});
+
+const imageIDFilePath = path.join(tmpDir, 'iidfile.txt');
+jest.spyOn(Build.prototype, 'getImageIDFilePath').mockImplementation((): string => {
+  return imageIDFilePath;
+});
+
 jest.spyOn(Builder.prototype, 'inspect').mockImplementation(async (): Promise<BuilderInfo> => {
  return {
    name: 'builder2',
@ -78,7 +91,7 @@ describe('getArgs', () => {
      ]),
      [
        'build',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
+        '--iidfile', imageIDFilePath,
        '.'
      ]
    ],
@ -101,7 +114,7 @@ ccc"`],
        '--build-arg', 'MY_ARG=val1,val2,val3',
        '--build-arg', 'ARG=val',
        '--build-arg', `MULTILINE=aaaa\nbbbb\nccc`,
-        '--iidfile', path.join(tmpDir, 'iidfile'),
+        '--iidfile', imageIDFilePath,
        'https://github.com/docker/build-push-action.git#refs/heads/master'
      ]
    ],
@ -117,7 +130,7 @@ ccc"`],
      ]),
      [
        'build',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
+        '--iidfile', imageIDFilePath,
        '--tag', 'name/app:7.4',
        '--tag', 'name/app:latest',
        'https://github.com/docker/build-push-action.git#refs/heads/master'
@ -172,7 +185,7 @@ ccc"`],
      ]),
      [
        'build',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
+        '--iidfile', imageIDFilePath,
        '.'
      ]
    ],
@ -189,7 +202,7 @@ ccc"`],
      ]),
      [
        'build',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
+        '--iidfile', imageIDFilePath,
        '--secret', `id=GIT_AUTH_TOKEN,src=${tmpName}`,
        '.'
      ]
@ -230,7 +243,7 @@ ccc"`],
      [
        'build',
        '--file', './test/Dockerfile',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
+        '--iidfile', imageIDFilePath,
        '--platform', 'linux/amd64,linux/arm64',
        '--secret', `id=GIT_AUTH_TOKEN,src=${tmpName}`,
        '--builder', 'builder-git-context-2',
@ -264,7 +277,7 @@ ccc"`],
      [
        'build',
        '--file', './test/Dockerfile',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
+        '--iidfile', imageIDFilePath,
        '--platform', 'linux/amd64,linux/arm64',
        '--secret', `id=GIT_AUTH_TOKEN,src=${tmpName}`,
        '--secret', `id=MYSECRET,src=${tmpName}`,
@ -301,7 +314,7 @@ ccc`],
      [
        'build',
        '--file', './test/Dockerfile',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
+        '--iidfile', imageIDFilePath,
        '--platform', 'linux/amd64,linux/arm64',
        '--secret', `id=GIT_AUTH_TOKEN,src=${tmpName}`,
        '--secret', `id=MYSECRET,src=${tmpName}`,
@ -330,7 +343,7 @@ ccc`],
      [
        'build',
        '--file', './test/Dockerfile',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
+        '--iidfile', imageIDFilePath,
        '--secret', `id=MY_SECRET,src=${tmpName}`,
        '--builder', 'builder-git-context-2',
        '--network', 'host',
@ -377,8 +390,8 @@ ccc`],
        '--add-host', 'docker:10.180.0.1',
        '--add-host', 'foo:10.0.0.1',
        '--file', './test/Dockerfile',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
-        '--metadata-file', path.join(tmpDir, 'metadata-file'),
+        '--iidfile', imageIDFilePath,
+        '--metadata-file', metadataJson,
        '--network', 'host',
        '--push',
        '.'
@ -406,11 +419,11 @@ nproc=3`],
        '--add-host', 'foo:10.0.0.1',
        '--cgroup-parent', 'foo',
        '--file', './test/Dockerfile',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
+        '--iidfile', imageIDFilePath,
        '--shm-size', '2g',
        '--ulimit', 'nofile=1024:1024',
        '--ulimit', 'nproc=3',
-        '--metadata-file', path.join(tmpDir, 'metadata-file'),
+        '--metadata-file', metadataJson,
        '.'
      ]
    ],
@ -426,8 +439,8 @@ nproc=3`],
      ]),
      [
        'build',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
-        '--metadata-file', path.join(tmpDir, 'metadata-file'),
+        '--iidfile', imageIDFilePath,
+        '--metadata-file', metadataJson,
        'https://github.com/docker/build-push-action.git#refs/heads/master:docker'
      ]
    ],
@ -444,9 +457,9 @@ nproc=3`],
      ]),
      [
        'build',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
+        '--iidfile', imageIDFilePath,
        '--secret', `id=GIT_AUTH_TOKEN,src=${tmpName}`,
-        '--metadata-file', path.join(tmpDir, 'metadata-file'),
+        '--metadata-file', metadataJson,
        'https://github.com/docker/build-push-action.git#refs/heads/master:subdir'
      ]
    ],
@ -463,8 +476,8 @@ nproc=3`],
      ]),
      [
        'build',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
-        '--metadata-file', path.join(tmpDir, 'metadata-file'),
+        '--iidfile', imageIDFilePath,
+        '--metadata-file', metadataJson,
        '.'
      ]
    ],
@ -480,9 +493,9 @@ nproc=3`],
      ]),
      [
        'build',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
-        "--provenance", `mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789`,
-        '--metadata-file', path.join(tmpDir, 'metadata-file'),
+        '--iidfile', imageIDFilePath,
+        '--attest', `type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--metadata-file', metadataJson,
        '.'
      ]
    ],
@ -499,9 +512,9 @@ nproc=3`],
      ]),
      [
        'build',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
-        "--provenance", `builder-id=https://github.com/docker/build-push-action/actions/runs/123456789`,
-        '--metadata-file', path.join(tmpDir, 'metadata-file'),
+        '--iidfile', imageIDFilePath,
+        '--attest', `type=provenance,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--metadata-file', metadataJson,
        '.'
      ]
    ],
@ -518,9 +531,9 @@ nproc=3`],
      ]),
      [
        'build',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
-        "--provenance", `mode=max,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789`,
-        '--metadata-file', path.join(tmpDir, 'metadata-file'),
+        '--iidfile', imageIDFilePath,
+        '--attest', `type=provenance,mode=max,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--metadata-file', metadataJson,
        '.'
      ]
    ],
@ -537,9 +550,9 @@ nproc=3`],
      ]),
      [
        'build',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
-        "--provenance", 'false',
-        '--metadata-file', path.join(tmpDir, 'metadata-file'),
+        '--iidfile', imageIDFilePath,
+        '--attest', 'type=provenance,disabled=true',
+        '--metadata-file', metadataJson,
        '.'
      ]
    ],
@ -556,9 +569,9 @@ nproc=3`],
      ]),
      [
        'build',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
-        "--provenance", 'builder-id=foo',
-        '--metadata-file', path.join(tmpDir, 'metadata-file'),
+        '--iidfile', imageIDFilePath,
+        '--attest', 'type=provenance,builder-id=foo',
+        '--metadata-file', metadataJson,
        '.'
      ]
    ],
@ -575,9 +588,9 @@ nproc=3`],
      ]),
      [
        'build',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
+        '--iidfile', imageIDFilePath,
        "--output", 'type=docker',
-        '--metadata-file', path.join(tmpDir, 'metadata-file'),
+        '--metadata-file', metadataJson,
        '.'
      ]
    ],
@ -593,9 +606,9 @@ nproc=3`],
      ]),
      [
        'build',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
+        '--iidfile', imageIDFilePath,
        '--load',
-        '--metadata-file', path.join(tmpDir, 'metadata-file'),
+        '--metadata-file', metadataJson,
        '.'
      ]
    ],
@ -613,14 +626,14 @@ nproc=3`],
      [
        'build',
        '--build-arg', 'FOO=bar#baz',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
+        '--iidfile', imageIDFilePath,
        '--load',
-        '--metadata-file', path.join(tmpDir, 'metadata-file'),
+        '--metadata-file', metadataJson,
        '.'
      ]
    ],
    [
-      25,
+      26,
      '0.10.0',
      new Map<string, string>([
        ['context', '.'],
@ -635,14 +648,14 @@ ANOTHER_SECRET=ANOTHER_SECRET_ENV`]
        'build',
        '--secret', 'id=MY_SECRET,env=MY_SECRET_ENV',
        '--secret', 'id=ANOTHER_SECRET,env=ANOTHER_SECRET_ENV',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
+        '--iidfile', imageIDFilePath,
        '--load',
-        '--metadata-file', path.join(tmpDir, 'metadata-file'),
+        '--metadata-file', metadataJson,
        '.'
      ]
    ],
    [
-      26,
+      27,
      '0.10.0',
      new Map<string, string>([
        ['context', '.'],
@ -656,14 +669,14 @@ ANOTHER_SECRET=ANOTHER_SECRET_ENV`]
        'build',
        '--secret', 'id=MY_SECRET,env=MY_SECRET_ENV',
        '--secret', 'id=ANOTHER_SECRET,env=ANOTHER_SECRET_ENV',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
+        '--iidfile', imageIDFilePath,
        '--load',
-        '--metadata-file', path.join(tmpDir, 'metadata-file'),
+        '--metadata-file', metadataJson,
        '.'
      ]
    ],
    [
-      27,
+      28,
      '0.11.0',
      new Map<string, string>([
        ['context', '.'],
@ -677,13 +690,13 @@ ANOTHER_SECRET=ANOTHER_SECRET_ENV`]
      [
        'build',
        '--output', 'type=local,dest=./release-out',
-        "--provenance", `mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789`,
-        '--metadata-file', path.join(tmpDir, 'metadata-file'),
+        '--attest', `type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--metadata-file', metadataJson,
        '.'
      ]
    ],
    [
-      28,
+      29,
      '0.12.0',
      new Map<string, string>([
        ['context', '.'],
@ -701,13 +714,13 @@ ANOTHER_SECRET=ANOTHER_SECRET_ENV`]
        '--annotation', 'manifest:example3=yyy',
        '--annotation', 'manifest-descriptor[linux/amd64]:example4=zzz',
        '--output', 'type=local,dest=./release-out',
-        "--provenance", `mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789`,
-        '--metadata-file', path.join(tmpDir, 'metadata-file'),
+        '--attest', `type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--metadata-file', metadataJson,
        '.'
      ]
    ],
    [
-      29,
+      30,
      '0.12.0',
      new Map<string, string>([
        ['context', '.'],
@ -719,13 +732,73 @@ ANOTHER_SECRET=ANOTHER_SECRET_ENV`]
      ]),
      [
        'build',
-        '--iidfile', path.join(tmpDir, 'iidfile'),
+        '--iidfile', imageIDFilePath,
        "--output", `type=image,"name=localhost:5000/name/app:latest,localhost:5000/name/app:foo",push-by-digest=true,name-canonical=true,push=true`,
-        "--provenance", `mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789`,
-        '--metadata-file', path.join(tmpDir, 'metadata-file'),
+        '--attest', `type=provenance,mode=min,inline-only=true,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--metadata-file', metadataJson,
        '.'
      ]
-    ]
+    ],
+    [
+      31,
+      '0.13.1',
+      new Map<string, string>([
+        ['context', '.'],
+        ['load', 'false'],
+        ['no-cache', 'false'],
+        ['push', 'false'],
+        ['pull', 'false'],
+        ['provenance', 'mode=max'],
+        ['sbom', 'true'],
+      ]),
+      [
+        'build',
+        '--iidfile', imageIDFilePath,
+        '--attest', `type=provenance,mode=max,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--attest', `type=sbom,disabled=false`,
+        '--metadata-file', metadataJson,
+        '.'
+      ]
+    ],
+    [
+      32,
+      '0.13.1',
+      new Map<string, string>([
+        ['context', '.'],
+        ['load', 'false'],
+        ['no-cache', 'false'],
+        ['push', 'false'],
+        ['pull', 'false'],
+        ['attests', 'type=provenance,mode=min'],
+        ['provenance', 'mode=max'],
+      ]),
+      [
+        'build',
+        '--iidfile', imageIDFilePath,
+        '--attest', `type=provenance,mode=max,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--metadata-file', metadataJson,
+        '.'
+      ]
+    ],
+    [
+      33,
+      '0.13.1',
+      new Map<string, string>([
+        ['context', '.'],
+        ['load', 'false'],
+        ['no-cache', 'false'],
+        ['push', 'false'],
+        ['pull', 'false'],
+        ['attests', 'type=provenance,mode=min'],
+      ]),
+      [
+        'build',
+        '--iidfile', imageIDFilePath,
+        '--attest', `type=provenance,mode=min,builder-id=https://github.com/docker/build-push-action/actions/runs/123456789/attempts/1`,
+        '--metadata-file', metadataJson,
+        '.'
+      ]
+    ],
  ])(
    '[%d] given %p with %p as inputs, returns %p',
    async (num: number, buildxVersion: string, inputs: Map<string, string>, expected: Array<string>) => {
--- a/dev.Dockerfile
+++ b/dev.Dockerfile
@ -5,9 +5,16 @@ ARG NODE_VERSION=20
 FROM node:${NODE_VERSION}-alpine AS base
 RUN apk add --no-cache cpio findutils git
 WORKDIR /src
+RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/.yarn/cache <<EOT
+  corepack enable
+  yarn --version
+  yarn config set --home enableTelemetry 0
+EOT

 FROM base AS deps
 RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/.yarn/cache \
  --mount=type=cache,target=/src/node_modules \
  yarn install && mkdir /vendor && cp yarn.lock /vendor

@ -16,18 +23,19 @@ COPY --from=deps /vendor /

 FROM deps AS vendor-validate
 RUN --mount=type=bind,target=.,rw <<EOT
-set -e
-git add -A
-cp -rf /vendor/* .
-if [ -n "$(git status --porcelain -- yarn.lock)" ]; then
-  echo >&2 'ERROR: Vendor result differs. Please vendor your package with "docker buildx bake vendor-update"'
-  git status --porcelain -- yarn.lock
-  exit 1
-fi
+  set -e
+  git add -A
+  cp -rf /vendor/* .
+  if [ -n "$(git status --porcelain -- yarn.lock)" ]; then
+    echo >&2 'ERROR: Vendor result differs. Please vendor your package with "docker buildx bake vendor-update"'
+    git status --porcelain -- yarn.lock
+    exit 1
+  fi
 EOT

 FROM deps AS build
 RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/.yarn/cache \
  --mount=type=cache,target=/src/node_modules \
  yarn run build && mkdir /out && cp -Rf dist /out/

@ -36,32 +44,35 @@ COPY --from=build /out /

 FROM build AS build-validate
 RUN --mount=type=bind,target=.,rw <<EOT
-set -e
-git add -A
-cp -rf /out/* .
-if [ -n "$(git status --porcelain -- dist)" ]; then
-  echo >&2 'ERROR: Build result differs. Please build first with "docker buildx bake build"'
-  git status --porcelain -- dist
-  exit 1
-fi
+  set -e
+  git add -A
+  cp -rf /out/* .
+  if [ -n "$(git status --porcelain -- dist)" ]; then
+    echo >&2 'ERROR: Build result differs. Please build first with "docker buildx bake build"'
+    git status --porcelain -- dist
+    exit 1
+  fi
 EOT

 FROM deps AS format
 RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/.yarn/cache \
  --mount=type=cache,target=/src/node_modules \
  yarn run format \
-  && mkdir /out && find . -name '*.ts' -not -path './node_modules/*' | cpio -pdm /out
+  && mkdir /out && find . -name '*.ts' -not -path './node_modules/*' -not -path './.yarn/*' | cpio -pdm /out

 FROM scratch AS format-update
 COPY --from=format /out /

 FROM deps AS lint
 RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/.yarn/cache \
  --mount=type=cache,target=/src/node_modules \
  yarn run lint

 FROM deps AS test
 RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/.yarn/cache \
  --mount=type=cache,target=/src/node_modules \
  yarn run test --coverage --coverageDirectory=/tmp/coverage

--- a/dist/index.js
+++ b/dist/index.js
--- a/dist/index.js.map
+++ b/dist/index.js.map
--- a/dist/licenses.txt
+++ b/dist/licenses.txt
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@ -3,7 +3,7 @@ group "default" {
 }

 group "pre-checkin" {
-  targets = ["vendor-update", "format", "build"]
+  targets = ["vendor", "format", "build"]
 }

 group "validate" {
@ -34,7 +34,7 @@ target "lint" {
  output = ["type=cacheonly"]
 }

-target "vendor-update" {
+target "vendor" {
  dockerfile = "dev.Dockerfile"
  target = "vendor-update"
  output = ["."]
--- a/docs/advanced/cache.md
+++ b/docs/advanced/cache.md
@ -1,3 +0,0 @@
-# Cache
-
-This page has moved to [Docker Docs website](https://docs.docker.com/build/ci/github-actions/cache/)
--- a/docs/advanced/copy-between-registries.md
+++ b/docs/advanced/copy-between-registries.md
@ -1,3 +0,0 @@
-# Copy images between registries
-
-This page has moved to [Docker Docs website](https://docs.docker.com/build/ci/github-actions/copy-image-registries/)
--- a/docs/advanced/dockerhub-desc.md
+++ b/docs/advanced/dockerhub-desc.md
@ -1,3 +0,0 @@
-# Update Docker Hub repo description
-
-This page has moved to [Docker Docs website](https://docs.docker.com/build/ci/github-actions/update-dockerhub-desc/)
--- a/docs/advanced/export-docker.md
+++ b/docs/advanced/export-docker.md
@ -1,3 +0,0 @@
-# Export image to Docker
-
-This page has moved to [Docker Docs website](https://docs.docker.com/build/ci/github-actions/export-docker/)
--- a/docs/advanced/isolated-builders.md
+++ b/docs/advanced/isolated-builders.md
@ -1,3 +0,0 @@
-# Isolated builders
-
-This page has moved to [Docker Docs website](https://docs.docker.com/build/ci/github-actions/configure-builder/#isolated-builders)
--- a/docs/advanced/local-registry.md
+++ b/docs/advanced/local-registry.md
@ -1,3 +0,0 @@
-# Local registry
-
-This page has moved to [Docker Docs website](https://docs.docker.com/build/ci/github-actions/local-registry/)
--- a/docs/advanced/multi-platform.md
+++ b/docs/advanced/multi-platform.md
@ -1,3 +0,0 @@
-# Multi-platform image
-
-This page has moved to [Docker Docs website](https://docs.docker.com/build/ci/github-actions/multi-platform/)
--- a/docs/advanced/named-contexts.md
+++ b/docs/advanced/named-contexts.md
@ -1,3 +0,0 @@
-# Named contexts
-
-This page has moved to [Docker Docs website](https://docs.docker.com/build/ci/github-actions/named-contexts/)
--- a/docs/advanced/push-multi-registries.md
+++ b/docs/advanced/push-multi-registries.md
@ -1,3 +0,0 @@
-# Push to multi-registries
-
-This page has moved to [Docker Docs website](https://docs.docker.com/build/ci/github-actions/push-multi-registries/)
--- a/docs/advanced/secrets.md
+++ b/docs/advanced/secrets.md
@ -1,3 +0,0 @@
-# Secrets
-
-This page has moved to [Docker Docs website](https://docs.docker.com/build/ci/github-actions/secrets/)
--- a/docs/advanced/share-image-jobs.md
+++ b/docs/advanced/share-image-jobs.md
@ -1,3 +0,0 @@
-# Share built image between jobs
-
-This page has moved to [Docker Docs website](https://docs.docker.com/build/ci/github-actions/share-image-jobs/)
--- a/docs/advanced/tags-labels.md
+++ b/docs/advanced/tags-labels.md
@ -1,3 +0,0 @@
-# Handle tags and labels
-
-This page has moved to [Docker Docs website](https://docs.docker.com/build/ci/github-actions/manage-tags-labels/)
--- a/docs/advanced/test-before-push.md
+++ b/docs/advanced/test-before-push.md
@ -1,3 +0,0 @@
-# Test your image before pushing it
-
-This page has moved to [Docker Docs website](https://docs.docker.com/build/ci/github-actions/test-before-push/)
--- a/package.json
+++ b/package.json
@ -1,17 +1,16 @@
 {
  "name": "docker-build-push",
  "description": "Build and push Docker images",
-  "main": "lib/main.js",
+  "main": "src/main.ts",
  "scripts": {
-    "build": "ncc build src/main.ts --source-map --minify --license licenses.txt",
+    "build": "ncc build --source-map --minify --license licenses.txt",
    "lint": "yarn run prettier && yarn run eslint",
    "format": "yarn run prettier:fix && yarn run eslint:fix",
    "eslint": "eslint --max-warnings=0 .",
    "eslint:fix": "eslint --fix .",
    "prettier": "prettier --check \"./**/*.ts\"",
    "prettier:fix": "prettier --write \"./**/*.ts\"",
-    "test": "jest",
-    "all": "yarn run build && yarn run format && yarn test"
+    "test": "jest"
  },
  "repository": {
    "type": "git",
@ -25,25 +24,25 @@
  ],
  "author": "Docker Inc.",
  "license": "Apache-2.0",
+  "packageManager": "yarn@3.6.3",
  "dependencies": {
    "@actions/core": "^1.10.1",
-    "@docker/actions-toolkit": "0.19.0",
+    "@docker/actions-toolkit": "0.31.0",
    "handlebars": "^4.7.7"
  },
  "devDependencies": {
-    "@types/csv-parse": "^1.2.2",
-    "@types/node": "^20.5.9",
-    "@typescript-eslint/eslint-plugin": "^6.6.0",
-    "@typescript-eslint/parser": "^6.6.0",
-    "@vercel/ncc": "^0.38.0",
-    "eslint": "^8.48.0",
-    "eslint-config-prettier": "^9.0.0",
-    "eslint-plugin-jest": "^27.2.3",
-    "eslint-plugin-prettier": "^5.0.0",
-    "jest": "^29.6.4",
-    "prettier": "^3.0.3",
-    "ts-jest": "^29.1.1",
-    "ts-node": "^10.9.1",
-    "typescript": "^5.2.2"
+    "@types/node": "^20.12.12",
+    "@typescript-eslint/eslint-plugin": "^7.9.0",
+    "@typescript-eslint/parser": "^7.9.0",
+    "@vercel/ncc": "^0.38.1",
+    "eslint": "^8.57.0",
+    "eslint-config-prettier": "^9.1.0",
+    "eslint-plugin-jest": "^28.5.0",
+    "eslint-plugin-prettier": "^5.1.3",
+    "jest": "^29.7.0",
+    "prettier": "^3.2.5",
+    "ts-jest": "^29.1.2",
+    "ts-node": "^10.9.2",
+    "typescript": "^5.4.5"
  }
 }
--- a/src/context.ts
+++ b/src/context.ts
@ -1,29 +1,30 @@
 import * as core from '@actions/core';
 import * as handlebars from 'handlebars';
+
+import {Build} from '@docker/actions-toolkit/lib/buildx/build';
 import {Context} from '@docker/actions-toolkit/lib/context';
 import {GitHub} from '@docker/actions-toolkit/lib/github';
-import {Inputs as BuildxInputs} from '@docker/actions-toolkit/lib/buildx/inputs';
 import {Toolkit} from '@docker/actions-toolkit/lib/toolkit';
 import {Util} from '@docker/actions-toolkit/lib/util';

 export interface Inputs {
-  addHosts: string[];
+  'add-hosts': string[];
  allow: string[];
  annotations: string[];
  attests: string[];
-  buildArgs: string[];
-  buildContexts: string[];
+  'build-args': string[];
+  'build-contexts': string[];
  builder: string;
-  cacheFrom: string[];
-  cacheTo: string[];
-  cgroupParent: string;
+  'cache-from': string[];
+  'cache-to': string[];
+  'cgroup-parent': string;
  context: string;
  file: string;
  labels: string[];
  load: boolean;
  network: string;
-  noCache: boolean;
-  noCacheFilters: string[];
+  'no-cache': boolean;
+  'no-cache-filters': string[];
  outputs: string[];
  platforms: string[];
  provenance: string;
@ -31,53 +32,72 @@ export interface Inputs {
  push: boolean;
  sbom: string;
  secrets: string[];
-  secretEnvs: string[];
-  secretFiles: string[];
-  shmSize: string;
+  'secret-envs': string[];
+  'secret-files': string[];
+  'shm-size': string;
  ssh: string[];
  tags: string[];
  target: string;
  ulimit: string[];
-  githubToken: string;
+  'github-token': string;
 }

 export async function getInputs(): Promise<Inputs> {
  return {
-    addHosts: Util.getInputList('add-hosts'),
+    'add-hosts': Util.getInputList('add-hosts'),
    allow: Util.getInputList('allow'),
    annotations: Util.getInputList('annotations', {ignoreComma: true}),
    attests: Util.getInputList('attests', {ignoreComma: true}),
-    buildArgs: Util.getInputList('build-args', {ignoreComma: true}),
-    buildContexts: Util.getInputList('build-contexts', {ignoreComma: true}),
+    'build-args': Util.getInputList('build-args', {ignoreComma: true}),
+    'build-contexts': Util.getInputList('build-contexts', {ignoreComma: true}),
    builder: core.getInput('builder'),
-    cacheFrom: Util.getInputList('cache-from', {ignoreComma: true}),
-    cacheTo: Util.getInputList('cache-to', {ignoreComma: true}),
-    cgroupParent: core.getInput('cgroup-parent'),
+    'cache-from': Util.getInputList('cache-from', {ignoreComma: true}),
+    'cache-to': Util.getInputList('cache-to', {ignoreComma: true}),
+    'cgroup-parent': core.getInput('cgroup-parent'),
    context: core.getInput('context') || Context.gitContext(),
    file: core.getInput('file'),
    labels: Util.getInputList('labels', {ignoreComma: true}),
    load: core.getBooleanInput('load'),
    network: core.getInput('network'),
-    noCache: core.getBooleanInput('no-cache'),
-    noCacheFilters: Util.getInputList('no-cache-filters'),
+    'no-cache': core.getBooleanInput('no-cache'),
+    'no-cache-filters': Util.getInputList('no-cache-filters'),
    outputs: Util.getInputList('outputs', {ignoreComma: true, quote: false}),
    platforms: Util.getInputList('platforms'),
-    provenance: BuildxInputs.getProvenanceInput('provenance'),
+    provenance: Build.getProvenanceInput('provenance'),
    pull: core.getBooleanInput('pull'),
    push: core.getBooleanInput('push'),
    sbom: core.getInput('sbom'),
    secrets: Util.getInputList('secrets', {ignoreComma: true}),
-    secretEnvs: Util.getInputList('secret-envs'),
-    secretFiles: Util.getInputList('secret-files', {ignoreComma: true}),
-    shmSize: core.getInput('shm-size'),
+    'secret-envs': Util.getInputList('secret-envs'),
+    'secret-files': Util.getInputList('secret-files', {ignoreComma: true}),
+    'shm-size': core.getInput('shm-size'),
    ssh: Util.getInputList('ssh'),
    tags: Util.getInputList('tags'),
    target: core.getInput('target'),
    ulimit: Util.getInputList('ulimit', {ignoreComma: true}),
-    githubToken: core.getInput('github-token')
+    'github-token': core.getInput('github-token')
  };
 }

+export function sanitizeInputs(inputs: Inputs) {
+  const res = {};
+  for (const key of Object.keys(inputs)) {
+    if (key === 'github-token') {
+      continue;
+    }
+    const value: string | string[] | boolean = inputs[key];
+    if (typeof value === 'boolean' && value === false) {
+      continue;
+    } else if (Array.isArray(value) && value.length === 0) {
+      continue;
+    } else if (!value) {
+      continue;
+    }
+    res[key] = value;
+  }
+  return res;
+}
+
 export async function getArgs(inputs: Inputs, toolkit: Toolkit): Promise<Array<string>> {
  const context = handlebars.compile(inputs.context)({
    defaultContext: Context.gitContext()
@ -92,19 +112,12 @@ export async function getArgs(inputs: Inputs, toolkit: Toolkit): Promise<Array<s

 async function getBuildArgs(inputs: Inputs, context: string, toolkit: Toolkit): Promise<Array<string>> {
  const args: Array<string> = ['build'];
-  await Util.asyncForEach(inputs.addHosts, async addHost => {
+  await Util.asyncForEach(inputs['add-hosts'], async addHost => {
    args.push('--add-host', addHost);
  });
  if (inputs.allow.length > 0) {
    args.push('--allow', inputs.allow.join(','));
  }
-  if (await toolkit.buildx.versionSatisfies('>=0.10.0')) {
-    await Util.asyncForEach(inputs.attests, async attest => {
-      args.push('--attest', attest);
-    });
-  } else if (inputs.attests.length > 0) {
-    core.warning("Attestations are only supported by buildx >= 0.10.0; the input 'attests' is ignored.");
-  }
  if (await toolkit.buildx.versionSatisfies('>=0.12.0')) {
    await Util.asyncForEach(inputs.annotations, async annotation => {
      args.push('--annotation', annotation);
@ -112,28 +125,28 @@ async function getBuildArgs(inputs: Inputs, context: string, toolkit: Toolkit):
  } else if (inputs.annotations.length > 0) {
    core.warning("Annotations are only supported by buildx >= 0.12.0; the input 'annotations' is ignored.");
  }
-  await Util.asyncForEach(inputs.buildArgs, async buildArg => {
+  await Util.asyncForEach(inputs['build-args'], async buildArg => {
    args.push('--build-arg', buildArg);
  });
  if (await toolkit.buildx.versionSatisfies('>=0.8.0')) {
-    await Util.asyncForEach(inputs.buildContexts, async buildContext => {
+    await Util.asyncForEach(inputs['build-contexts'], async buildContext => {
      args.push('--build-context', buildContext);
    });
-  } else if (inputs.buildContexts.length > 0) {
+  } else if (inputs['build-contexts'].length > 0) {
    core.warning("Build contexts are only supported by buildx >= 0.8.0; the input 'build-contexts' is ignored.");
  }
-  await Util.asyncForEach(inputs.cacheFrom, async cacheFrom => {
+  await Util.asyncForEach(inputs['cache-from'], async cacheFrom => {
    args.push('--cache-from', cacheFrom);
  });
-  await Util.asyncForEach(inputs.cacheTo, async cacheTo => {
+  await Util.asyncForEach(inputs['cache-to'], async cacheTo => {
    args.push('--cache-to', cacheTo);
  });
-  if (inputs.cgroupParent) {
-    args.push('--cgroup-parent', inputs.cgroupParent);
+  if (inputs['cgroup-parent']) {
+    args.push('--cgroup-parent', inputs['cgroup-parent']);
  }
-  await Util.asyncForEach(inputs.secretEnvs, async secretEnv => {
+  await Util.asyncForEach(inputs['secret-envs'], async secretEnv => {
    try {
-      args.push('--secret', BuildxInputs.resolveBuildSecretEnv(secretEnv));
+      args.push('--secret', Build.resolveSecretEnv(secretEnv));
    } catch (err) {
      core.warning(err.message);
    }
@ -141,13 +154,13 @@ async function getBuildArgs(inputs: Inputs, context: string, toolkit: Toolkit):
  if (inputs.file) {
    args.push('--file', inputs.file);
  }
-  if (!BuildxInputs.hasLocalExporter(inputs.outputs) && !BuildxInputs.hasTarExporter(inputs.outputs) && (inputs.platforms.length == 0 || (await toolkit.buildx.versionSatisfies('>=0.4.2')))) {
-    args.push('--iidfile', BuildxInputs.getBuildImageIDFilePath());
+  if (!Build.hasLocalExporter(inputs.outputs) && !Build.hasTarExporter(inputs.outputs) && (inputs.platforms.length == 0 || (await toolkit.buildx.versionSatisfies('>=0.4.2')))) {
+    args.push('--iidfile', toolkit.buildxBuild.getImageIDFilePath());
  }
  await Util.asyncForEach(inputs.labels, async label => {
    args.push('--label', label);
  });
-  await Util.asyncForEach(inputs.noCacheFilters, async noCacheFilter => {
+  await Util.asyncForEach(inputs['no-cache-filters'], async noCacheFilter => {
    args.push('--no-cache-filter', noCacheFilter);
  });
  await Util.asyncForEach(inputs.outputs, async output => {
@ -157,46 +170,29 @@ async function getBuildArgs(inputs: Inputs, context: string, toolkit: Toolkit):
    args.push('--platform', inputs.platforms.join(','));
  }
  if (await toolkit.buildx.versionSatisfies('>=0.10.0')) {
-    if (inputs.provenance) {
-      args.push('--provenance', inputs.provenance);
-    } else if ((await toolkit.buildkit.versionSatisfies(inputs.builder, '>=0.11.0')) && !BuildxInputs.hasDockerExporter(inputs.outputs, inputs.load)) {
-      // if provenance not specified and BuildKit version compatible for
-      // attestation, set default provenance. Also needs to make sure user
-      // doesn't want to explicitly load the image to docker.
-      if (GitHub.context.payload.repository?.private ?? false) {
-        // if this is a private repository, we set the default provenance
-        // attributes being set in buildx: https://github.com/docker/buildx/blob/fb27e3f919dcbf614d7126b10c2bc2d0b1927eb6/build/build.go#L603
-        args.push('--provenance', BuildxInputs.resolveProvenanceAttrs(`mode=min,inline-only=true`));
-      } else {
-        // for a public repository, we set max provenance mode.
-        args.push('--provenance', BuildxInputs.resolveProvenanceAttrs(`mode=max`));
-      }
-    }
-    if (inputs.sbom) {
-      args.push('--sbom', inputs.sbom);
-    }
-  } else if (inputs.provenance || inputs.sbom) {
-    core.warning("Attestations are only supported by buildx >= 0.10.0; the inputs 'provenance' and 'sbom' are ignored.");
+    args.push(...(await getAttestArgs(inputs, toolkit)));
+  } else {
+    core.warning("Attestations are only supported by buildx >= 0.10.0; the inputs 'attests', 'provenance' and 'sbom' are ignored.");
  }
  await Util.asyncForEach(inputs.secrets, async secret => {
    try {
-      args.push('--secret', BuildxInputs.resolveBuildSecretString(secret));
+      args.push('--secret', Build.resolveSecretString(secret));
    } catch (err) {
      core.warning(err.message);
    }
  });
-  await Util.asyncForEach(inputs.secretFiles, async secretFile => {
+  await Util.asyncForEach(inputs['secret-files'], async secretFile => {
    try {
-      args.push('--secret', BuildxInputs.resolveBuildSecretFile(secretFile));
+      args.push('--secret', Build.resolveSecretFile(secretFile));
    } catch (err) {
      core.warning(err.message);
    }
  });
-  if (inputs.githubToken && !BuildxInputs.hasGitAuthTokenSecret(inputs.secrets) && context.startsWith(Context.gitContext())) {
-    args.push('--secret', BuildxInputs.resolveBuildSecretString(`GIT_AUTH_TOKEN=${inputs.githubToken}`));
+  if (inputs['github-token'] && !Build.hasGitAuthTokenSecret(inputs.secrets) && context.startsWith(Context.gitContext())) {
+    args.push('--secret', Build.resolveSecretString(`GIT_AUTH_TOKEN=${inputs['github-token']}`));
  }
-  if (inputs.shmSize) {
-    args.push('--shm-size', inputs.shmSize);
+  if (inputs['shm-size']) {
+    args.push('--shm-size', inputs['shm-size']);
  }
  await Util.asyncForEach(inputs.ssh, async ssh => {
    args.push('--ssh', ssh);
@ -222,12 +218,12 @@ async function getCommonArgs(inputs: Inputs, toolkit: Toolkit): Promise<Array<st
    args.push('--load');
  }
  if (await toolkit.buildx.versionSatisfies('>=0.6.0')) {
-    args.push('--metadata-file', BuildxInputs.getBuildMetadataFilePath());
+    args.push('--metadata-file', toolkit.buildxBuild.getMetadataFilePath());
  }
  if (inputs.network) {
    args.push('--network', inputs.network);
  }
-  if (inputs.noCache) {
+  if (inputs['no-cache']) {
    args.push('--no-cache');
  }
  if (inputs.pull) {
@ -238,3 +234,52 @@ async function getCommonArgs(inputs: Inputs, toolkit: Toolkit): Promise<Array<st
  }
  return args;
 }
+
+async function getAttestArgs(inputs: Inputs, toolkit: Toolkit): Promise<Array<string>> {
+  const args: Array<string> = [];
+
+  // check if provenance attestation is set in attests input
+  let hasAttestProvenance = false;
+  await Util.asyncForEach(inputs.attests, async (attest: string) => {
+    if (Build.hasAttestationType('provenance', attest)) {
+      hasAttestProvenance = true;
+    }
+  });
+
+  let provenanceSet = false;
+  let sbomSet = false;
+  if (inputs.provenance) {
+    args.push('--attest', Build.resolveAttestationAttrs(`type=provenance,${inputs.provenance}`));
+    provenanceSet = true;
+  } else if (!hasAttestProvenance && (await toolkit.buildkit.versionSatisfies(inputs.builder, '>=0.11.0')) && !Build.hasDockerExporter(inputs.outputs, inputs.load)) {
+    // if provenance not specified in provenance or attests inputs and BuildKit
+    // version compatible for attestation, set default provenance. Also needs
+    // to make sure user doesn't want to explicitly load the image to docker.
+    if (GitHub.context.payload.repository?.private ?? false) {
+      // if this is a private repository, we set the default provenance
+      // attributes being set in buildx: https://github.com/docker/buildx/blob/fb27e3f919dcbf614d7126b10c2bc2d0b1927eb6/build/build.go#L603
+      args.push('--attest', `type=provenance,${Build.resolveProvenanceAttrs(`mode=min,inline-only=true`)}`);
+    } else {
+      // for a public repository, we set max provenance mode.
+      args.push('--attest', `type=provenance,${Build.resolveProvenanceAttrs(`mode=max`)}`);
+    }
+  }
+  if (inputs.sbom) {
+    args.push('--attest', Build.resolveAttestationAttrs(`type=sbom,${inputs.sbom}`));
+    sbomSet = true;
+  }
+
+  // set attests but check if provenance or sbom types already set as
+  // provenance and sbom inputs take precedence over attests input.
+  await Util.asyncForEach(inputs.attests, async (attest: string) => {
+    if (!Build.hasAttestationType('provenance', attest) && !Build.hasAttestationType('sbom', attest)) {
+      args.push('--attest', Build.resolveAttestationAttrs(attest));
+    } else if (!provenanceSet && Build.hasAttestationType('provenance', attest)) {
+      args.push('--attest', Build.resolveProvenanceAttrs(attest));
+    } else if (!sbomSet && Build.hasAttestationType('sbom', attest)) {
+      args.push('--attest', attest);
+    }
+  });
+
+  return args;
+}
--- a/src/main.ts
+++ b/src/main.ts
@ -3,21 +3,29 @@ import * as path from 'path';
 import * as stateHelper from './state-helper';
 import * as core from '@actions/core';
 import * as actionsToolkit from '@docker/actions-toolkit';
+
+import {Buildx} from '@docker/actions-toolkit/lib/buildx/buildx';
+import {History as BuildxHistory} from '@docker/actions-toolkit/lib/buildx/history';
 import {Context} from '@docker/actions-toolkit/lib/context';
 import {Docker} from '@docker/actions-toolkit/lib/docker/docker';
 import {Exec} from '@docker/actions-toolkit/lib/exec';
 import {GitHub} from '@docker/actions-toolkit/lib/github';
-import {Inputs as BuildxInputs} from '@docker/actions-toolkit/lib/buildx/inputs';
 import {Toolkit} from '@docker/actions-toolkit/lib/toolkit';
-import {ConfigFile} from '@docker/actions-toolkit/lib/types/docker';
+import {Util} from '@docker/actions-toolkit/lib/util';
+
+import {BuilderInfo} from '@docker/actions-toolkit/lib/types/buildx/builder';
+import {ConfigFile} from '@docker/actions-toolkit/lib/types/docker/docker';
+import {UploadArtifactResponse} from '@docker/actions-toolkit/lib/types/github';

 import * as context from './context';

 actionsToolkit.run(
  // main
  async () => {
+    const startedTime = new Date();
    const inputs: context.Inputs = await context.getInputs();
    core.debug(`inputs: ${JSON.stringify(inputs)}`);
+    stateHelper.setInputs(inputs);

    const toolkit = new Toolkit();

@ -74,6 +82,12 @@ actionsToolkit.run(
      await toolkit.buildx.printVersion();
    });

+    let builder: BuilderInfo;
+    await core.group(`Builder info`, async () => {
+      builder = await toolkit.builder.inspect(inputs.builder);
+      core.info(JSON.stringify(builder, null, 2));
+    });
+
    const args: string[] = await context.getArgs(inputs, toolkit);
    core.debug(`context.getArgs: ${JSON.stringify(args)}`);

@ -81,18 +95,18 @@ actionsToolkit.run(
    core.debug(`buildCmd.command: ${buildCmd.command}`);
    core.debug(`buildCmd.args: ${JSON.stringify(buildCmd.args)}`);

+    let err: Error | undefined;
    await Exec.getExecOutput(buildCmd.command, buildCmd.args, {
      ignoreReturnCode: true
    }).then(res => {
      if (res.stderr.length > 0 && res.exitCode != 0) {
-        throw new Error(`buildx failed with: ${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
+        err = Error(`buildx failed with: ${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
      }
    });

-    const imageID = BuildxInputs.resolveBuildImageID();
-    const metadata = BuildxInputs.resolveBuildMetadata();
-    const digest = BuildxInputs.resolveDigest();
-
+    const imageID = toolkit.buildxBuild.resolveImageID();
+    const metadata = toolkit.buildxBuild.resolveMetadata();
+    const digest = toolkit.buildxBuild.resolveDigest();
    if (imageID) {
      await core.group(`ImageID`, async () => {
        core.info(imageID);
@ -107,13 +121,80 @@ actionsToolkit.run(
    }
    if (metadata) {
      await core.group(`Metadata`, async () => {
-        core.info(metadata);
-        core.setOutput('metadata', metadata);
+        const metadatadt = JSON.stringify(metadata, null, 2);
+        core.info(metadatadt);
+        core.setOutput('metadata', metadatadt);
      });
    }
+
+    let ref: string;
+    await core.group(`Reference`, async () => {
+      ref = await buildRef(toolkit, startedTime, inputs.builder);
+      if (ref) {
+        core.info(ref);
+        stateHelper.setBuildRef(ref);
+      } else {
+        core.info('No build reference found');
+      }
+    });
+
+    await core.group(`Check build summary support`, async () => {
+      if (!buildSummaryEnabled()) {
+        core.info('Build summary disabled');
+      } else if (GitHub.isGHES) {
+        core.warning('Build summary is not yet supported on GHES');
+      } else if (!(await toolkit.buildx.versionSatisfies('>=0.13.0'))) {
+        core.warning('Build summary requires Buildx >= 0.13.0');
+      } else if (builder && builder.driver === 'cloud') {
+        core.warning('Build summary is not yet supported with Docker Build Cloud');
+      } else if (!ref) {
+        core.warning('Build summary requires a build reference');
+      } else {
+        core.info('Build summary supported!');
+        stateHelper.setSummarySupported();
+      }
+    });
+
+    if (err) {
+      throw err;
+    }
  },
  // post
  async () => {
+    if (stateHelper.isSummarySupported) {
+      await core.group(`Generating build summary`, async () => {
+        try {
+          const recordUploadEnabled = buildRecordUploadEnabled();
+          let recordRetentionDays: number | undefined;
+          if (recordUploadEnabled) {
+            recordRetentionDays = buildRecordRetentionDays();
+          }
+
+          const buildxHistory = new BuildxHistory();
+          const exportRes = await buildxHistory.export({
+            refs: stateHelper.buildRef ? [stateHelper.buildRef] : []
+          });
+          core.info(`Build record written to ${exportRes.dockerbuildFilename} (${Util.formatFileSize(exportRes.dockerbuildSize)})`);
+
+          let uploadRes: UploadArtifactResponse | undefined;
+          if (recordUploadEnabled) {
+            uploadRes = await GitHub.uploadArtifact({
+              filename: exportRes.dockerbuildFilename,
+              mimeType: 'application/gzip',
+              retentionDays: recordRetentionDays
+            });
+          }
+
+          await GitHub.writeBuildSummary({
+            exportRes: exportRes,
+            uploadRes: uploadRes,
+            inputs: stateHelper.inputs
+          });
+        } catch (e) {
+          core.warning(e.message);
+        }
+      });
+    }
    if (stateHelper.tmpDir.length > 0) {
      await core.group(`Removing temp folder ${stateHelper.tmpDir}`, async () => {
        fs.rmSync(stateHelper.tmpDir, {recursive: true});
@ -121,3 +202,56 @@ actionsToolkit.run(
    }
  }
 );
+
+async function buildRef(toolkit: Toolkit, since: Date, builder?: string): Promise<string> {
+  // get ref from metadata file
+  const ref = toolkit.buildxBuild.resolveRef();
+  if (ref) {
+    return ref;
+  }
+  // otherwise, look for the very first build ref since the build has started
+  if (!builder) {
+    const currentBuilder = await toolkit.builder.inspect();
+    builder = currentBuilder.name;
+  }
+  const refs = Buildx.refs({
+    dir: Buildx.refsDir,
+    builderName: builder,
+    since: since
+  });
+  return Object.keys(refs).length > 0 ? Object.keys(refs)[0] : '';
+}
+
+function buildSummaryEnabled(): boolean {
+  if (process.env.DOCKER_BUILD_NO_SUMMARY) {
+    core.warning('DOCKER_BUILD_NO_SUMMARY is deprecated. Set DOCKER_BUILD_SUMMARY to false instead.');
+    return !Util.parseBool(process.env.DOCKER_BUILD_NO_SUMMARY);
+  } else if (process.env.DOCKER_BUILD_SUMMARY) {
+    return Util.parseBool(process.env.DOCKER_BUILD_SUMMARY);
+  }
+  return true;
+}
+
+function buildRecordUploadEnabled(): boolean {
+  if (process.env.DOCKER_BUILD_RECORD_UPLOAD) {
+    return Util.parseBool(process.env.DOCKER_BUILD_RECORD_UPLOAD);
+  }
+  return true;
+}
+
+function buildRecordRetentionDays(): number | undefined {
+  let val: string | undefined;
+  if (process.env.DOCKER_BUILD_EXPORT_RETENTION_DAYS) {
+    core.warning('DOCKER_BUILD_EXPORT_RETENTION_DAYS is deprecated. Use DOCKER_BUILD_RECORD_RETENTION_DAYS instead.');
+    val = process.env.DOCKER_BUILD_EXPORT_RETENTION_DAYS;
+  } else if (process.env.DOCKER_BUILD_RECORD_RETENTION_DAYS) {
+    val = process.env.DOCKER_BUILD_RECORD_RETENTION_DAYS;
+  }
+  if (val) {
+    const res = parseInt(val);
+    if (isNaN(res)) {
+      throw Error(`Invalid build record retention days: ${val}`);
+    }
+    return res;
+  }
+}
--- a/src/state-helper.ts
+++ b/src/state-helper.ts
@ -1,7 +1,24 @@
 import * as core from '@actions/core';

+import {Inputs, sanitizeInputs} from './context';
+
 export const tmpDir = process.env['STATE_tmpDir'] || '';
+export const inputs = process.env['STATE_inputs'] ? JSON.parse(process.env['STATE_inputs']) : undefined;
+export const buildRef = process.env['STATE_buildRef'] || '';
+export const isSummarySupported = !!process.env['STATE_isSummarySupported'];

 export function setTmpDir(tmpDir: string) {
  core.saveState('tmpDir', tmpDir);
 }
+
+export function setInputs(inputs: Inputs) {
+  core.saveState('inputs', JSON.stringify(sanitizeInputs(inputs)));
+}
+
+export function setBuildRef(buildRef: string) {
+  core.saveState('buildRef', buildRef);
+}
+
+export function setSummarySupported() {
+  core.saveState('isSummarySupported', 'true');
+}
--- a/yarn.lock
+++ b/yarn.lock