chore(deps): Bump the crazy-max-dot-github group with 2 updates

Bumps the crazy-max-dot-github group with 2 updates: [crazy-max/.github/.github/workflows/pr-assign-author.yml](https://github.com/crazy-max/.github) and [crazy-max/.github/.github/workflows/zizmor.yml](https://github.com/crazy-max/.github).


Updates `crazy-max/.github/.github/workflows/pr-assign-author.yml` from 1.6.0 to 1.7.1
- [Release notes](https://github.com/crazy-max/.github/releases)
- [Commits](d89fe92d80...64a0bfaf6e)

Updates `crazy-max/.github/.github/workflows/zizmor.yml` from 1.6.0 to 1.7.1
- [Release notes](https://github.com/crazy-max/.github/releases)
- [Commits](d89fe92d80...64a0bfaf6e)

---
updated-dependencies:
- dependency-name: crazy-max/.github/.github/workflows/pr-assign-author.yml
  dependency-version: 1.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: crazy-max-dot-github
- dependency-name: crazy-max/.github/.github/workflows/zizmor.yml
  dependency-version: 1.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: crazy-max-dot-github
...

Signed-off-by: dependabot[bot] <support@github.com>

.dockerignore

@@ -1,2 +1,12 @@
 /coverage
-/node_modules
+
+# Dependency directories
+node_modules/
+jspm_packages/
+
+# yarn v2
+.yarn/cache
+.yarn/unplugged
+.yarn/build-state.yml
+.yarn/install-state.gz
+.pnp.*

.eslintignore

@@ -1,3 +0,0 @@
-/dist/**
-/coverage/**
-/node_modules/**

.eslintrc.json

@@ -1,24 +0,0 @@
-{
-  "env": {
-    "node": true,
-    "es6": true,
-    "jest": true
-  },
-  "extends": [
-    "eslint:recommended",
-    "plugin:@typescript-eslint/eslint-recommended",
-    "plugin:@typescript-eslint/recommended",
-    "plugin:jest/recommended",
-    "plugin:prettier/recommended"
-  ],
-  "parser": "@typescript-eslint/parser",
-  "parserOptions": {
-    "ecmaVersion": "latest",
-    "sourceType": "module"
-  },
-  "plugins": [
-    "@typescript-eslint",
-    "jest",
-    "prettier"
-  ]
-}

.gitattributes

@@ -1,3 +1,5 @@
+/.yarn/releases/** binary
+/.yarn/plugins/** binary
 /__tests__/fixtures/** -linguist-detectable
 /dist/** linguist-generated=true
 /lib/** linguist-generated=true

.github/dependabot.yml

@@ -4,6 +4,12 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 2
+    groups:
+      crazy-max-dot-github:
+        patterns:
+          - "crazy-max/.github/*"
     labels:
       - "dependencies"
       - "bot"
@@ -11,6 +17,10 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 2
+      exclude:
+        - "@docker/actions-toolkit"
     versioning-strategy: "increase"
     allow:
       - dependency-type: "production"

.github/workflows/ci.yml

@@ -1,5 +1,8 @@
 name: ci
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -17,14 +20,39 @@ on:
 
 env:
   DOCKER_IMAGE: localhost:5000/name/app
+  BUILDX_VERSION: latest
 
 jobs:
+  context:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        context:
+          - workflow
+          - git
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Docker meta
+        uses: ./
+        with:
+          context: ${{ matrix.context }}
+
   multi-images:
     runs-on: ubuntu-latest
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          version: ${{ env.BUILDX_VERSION }}
+          driver: docker
       -
         name: Docker meta
         uses: ./
@@ -55,7 +83,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          version: ${{ env.BUILDX_VERSION }}
+          driver: docker
       -
         name: Docker meta
         uses: ./
@@ -85,7 +119,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          version: ${{ env.BUILDX_VERSION }}
+          driver: docker
       -
         name: Docker meta
         uses: ./
@@ -113,7 +153,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          version: ${{ env.BUILDX_VERSION }}
+          driver: docker
       -
         name: Docker meta
         uses: ./
@@ -138,7 +184,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          version: ${{ env.BUILDX_VERSION }}
+          driver: docker
       -
         name: Docker meta
         uses: ./
@@ -155,7 +207,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          version: ${{ env.BUILDX_VERSION }}
+          driver: docker
       -
         name: Docker meta
         uses: ./
@@ -165,12 +223,18 @@ jobs:
             name=ghcr.io/name/app,enable=${{ github.event_name == 'pull_request' }}
             name=ghcr.io/name/release,enable=${{ startsWith(github.ref, 'refs/tags/') }}
 
-  labels:
+  custom-labels-annotations:
     runs-on: ubuntu-latest
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          version: ${{ env.BUILDX_VERSION }}
+          driver: docker
       -
         name: Docker meta
         uses: ./
@@ -183,13 +247,24 @@ jobs:
             org.opencontainers.image.title=MyCustomTitle
             org.opencontainers.image.description=this is a "good" example
             org.opencontainers.image.vendor=MyCompany
+          annotations: |
+            maintainer=Foo
+            org.opencontainers.image.title=MyFooTitle
+            org.opencontainers.image.description=this is a "foo" example
+            org.opencontainers.image.vendor=MyFooCompany
 
   global-exps:
     runs-on: ubuntu-latest
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          version: ${{ env.BUILDX_VERSION }}
+          driver: docker
       -
         name: Docker meta
         uses: ./
@@ -197,6 +272,8 @@ jobs:
           images: |
             ${{ env.DOCKER_IMAGE }}
             ghcr.io/name/app
+          labels: |
+            org.opencontainers.image.created={{commit_date 'YYYY-MM-DDTHH:mm:ss.SSS[Z]'}}
           tags: |
             type=sha
             type=raw,value=gexp-branch-{{branch}}
@@ -204,13 +281,20 @@ jobs:
             type=raw,value=gexp-tag-{{tag}}
             type=raw,value=gexp-baseref-{{base_ref}}
             type=raw,value=gexp-defbranch,enable={{is_default_branch}}
+            type=raw,value=gexp-notdefbranch,enable={{is_not_default_branch}}
 
   json:
     runs-on: ubuntu-latest
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          version: ${{ env.BUILDX_VERSION }}
+          driver: docker
       -
         name: Docker meta
         id: meta
@@ -233,13 +317,19 @@ jobs:
     runs-on: ubuntu-latest
     services:
       registry:
-        image: registry:2
+        image: registry:2.8.3@sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373
         ports:
           - 5000:5000
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          version: ${{ env.BUILDX_VERSION }}
+          driver-opts: network=host
       -
         name: Docker meta
         id: docker_meta
@@ -256,17 +346,9 @@ jobs:
             type=semver,pattern=v{{major}}.{{minor}}
             type=semver,pattern=v{{major}}
             type=sha
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          driver-opts: network=host
       -
         name: Build and push to local registry
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: ./test
           file: ./test/Dockerfile
@@ -283,17 +365,18 @@ jobs:
         name: Check manifest
         run: |
           docker buildx imagetools inspect ${{ env.DOCKER_IMAGE }}:${{ steps.docker_meta.outputs.version }}
-      -
-        name: Dump context
-        if: always()
-        uses: crazy-max/ghaction-dump-context@v2
 
   bake:
     runs-on: ubuntu-latest
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          version: ${{ env.BUILDX_VERSION }}
       -
         name: Docker meta
         id: docker_meta
@@ -311,20 +394,14 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
             type=sha
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
       -
         name: Build
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
         with:
           files: |
             ./test/docker-bake.hcl
-            ${{ steps.docker_meta.outputs.bake-file-tags }}
-            ${{ steps.docker_meta.outputs.bake-file-labels }}
+            cwd://${{ steps.docker_meta.outputs.bake-file-tags }}
+            cwd://${{ steps.docker_meta.outputs.bake-file-labels }}
           targets: |
             release
 
@@ -339,7 +416,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          version: ${{ env.BUILDX_VERSION }}
+          driver: docker
       -
         name: Docker meta
         id: meta
@@ -351,7 +434,7 @@ jobs:
           sep-tags: ${{ matrix.sep }}
       -
         name: Tags
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             console.log(`${{ steps.meta.outputs.tags }}`);
@@ -361,7 +444,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          version: ${{ env.BUILDX_VERSION }}
+          driver: docker
       -
         name: Docker meta
         id: meta
@@ -372,9 +461,11 @@ jobs:
             ghcr.io/name/app
           labels: |
             maintainer=CrazyMax
+          annotations: |
+            maintainer=Foo
       -
         name: Build
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: ./test
           file: ./test/output.Dockerfile
@@ -382,14 +473,46 @@ jobs:
             DOCKER_METADATA_OUTPUT_VERSION
             DOCKER_METADATA_OUTPUT_TAGS
             DOCKER_METADATA_OUTPUT_LABELS
+            DOCKER_METADATA_OUTPUT_ANNOTATIONS
             DOCKER_METADATA_OUTPUT_JSON
 
+  no-output-env:
+    runs-on: ubuntu-latest
+    env:
+      DOCKER_METADATA_SET_OUTPUT_ENV: false
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Docker meta
+        id: meta
+        uses: ./
+        with:
+          images: |
+            ${{ env.DOCKER_IMAGE }}
+            ghcr.io/name/app
+          labels: |
+            maintainer=CrazyMax
+          annotations: |
+            maintainer=Foo
+      -
+        name: No output environment variables set
+        shell: bash
+        run: |
+          [[ "$(printenv | grep "^DOCKER_METADATA_OUTPUT_" | wc -l)" -eq 0 ]] || exit 1
+
   bake-annotations:
     runs-on: ubuntu-latest
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          version: ${{ env.BUILDX_VERSION }}
       -
         name: Docker meta
         id: docker_meta
@@ -409,22 +532,14 @@ jobs:
             type=sha
         env:
           DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
-      -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          version: v0.12.0-rc1
       -
         name: Build
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
         with:
           files: |
             ./test/docker-bake.hcl
-            ${{ steps.docker_meta.outputs.bake-file-tags }}
-            ${{ steps.docker_meta.outputs.bake-file-annotations }}
+            cwd://${{ steps.docker_meta.outputs.bake-file-tags }}
+            cwd://${{ steps.docker_meta.outputs.bake-file-annotations }}
           targets: |
             release
 
@@ -433,7 +548,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          version: ${{ env.BUILDX_VERSION }}
+          driver: docker
       -
         name: Docker meta
         uses: ./
@@ -447,3 +568,70 @@ jobs:
       -
         name: Print envs
         run: env|sort
+
+  bake-path-context:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          version: latest
+      -
+        name: Docker meta
+        id: docker_meta
+        uses: ./
+      -
+        name: Build
+        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
+        with:
+          source: .
+          files: |
+            ./test/docker-bake.hcl
+            ${{ steps.docker_meta.outputs.bake-file-tags }}
+            ${{ steps.docker_meta.outputs.bake-file-labels }}
+          targets: |
+            release
+
+  sha-short:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        short-length:
+          - ''
+          - 16
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          version: ${{ env.BUILDX_VERSION }}
+          driver: docker
+      -
+        name: Docker meta
+        uses: ./
+        with:
+          images: |
+            ${{ env.DOCKER_IMAGE }}
+            ghcr.io/name/app
+          tags: |
+            type=sha
+        env:
+          DOCKER_METADATA_SHORT_SHA_LENGTH: ${{ matrix.short-length }}
+
+  dump:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Dump context
+        uses: crazy-max/ghaction-dump-context@5d2753e7076f4568c7729971e25231f32147e2d8 # v3.0.0

.github/workflows/codeql.yml

@@ -0,0 +1,46 @@
+name: codeql
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'releases/v*'
+  pull_request:
+
+env:
+  NODE_VERSION: "24"
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Enable corepack
+        run: |
+          corepack enable
+          yarn --version
+      -
+        name: Set up Node
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+      -
+        name: Initialize CodeQL
+        uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        with:
+          languages: javascript-typescript
+          build-mode: none
+      -
+        name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        with:
+          category: "/language:javascript-typescript"

.github/workflows/pr-assign-author.yml

@@ -0,0 +1,17 @@
+name: pr-assign-author
+
+permissions:
+  contents: read
+
+on:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] safe to use without checkout
+    types:
+      - opened
+      - reopened
+
+jobs:
+  run:
+    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@64a0bfaf6e6bb1c448d6e4c42b11034ee7094f16 # v1.7.1
+    permissions:
+      contents: read
+      pull-requests: write

.github/workflows/publish.yml

@@ -0,0 +1,28 @@
+name: publish
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  release:
+    types:
+      - published
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      -
+        name: Publish
+        uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4

.github/workflows/test.yml

@@ -1,5 +1,8 @@
 name: test
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -17,14 +20,16 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Test
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
         with:
+          source: .
           targets: test
       -
         name: Upload coverage
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
         with:
-          file: ./coverage/clover.xml
+          files: ./coverage/clover.xml
+          token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/update-dist.yml

@@ -0,0 +1,56 @@
+name: update-dist
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+
+jobs:
+  update-dist:
+    if: github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: GitHub auth token from GitHub App
+        id: docker-read-app
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        with:
+          app-id: ${{ secrets.GHACTIONS_REPO_WRITE_APP_ID }}
+          private-key: ${{ secrets.GHACTIONS_REPO_WRITE_APP_PRIVATE_KEY }}
+          owner: docker
+      -
+        name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          fetch-depth: 0
+          token: ${{ steps.docker-read-app.outputs.token }}
+      -
+        name: Build
+        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
+        with:
+          source: .
+          targets: build
+      -
+        name: Commit and push dist
+        run: |
+          if [ -n "$(git status --porcelain -- dist)" ]; then
+            (
+              set -x
+              git config user.name "github-actions[bot]"
+              git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+              git add dist
+              git commit -m "chore: update generated content"
+              git push
+            )
+          else
+            echo "No changes in dist"
+          fi

.github/workflows/validate.yml

@@ -1,5 +1,8 @@
 name: validate
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -15,16 +18,17 @@ jobs:
   prepare:
     runs-on: ubuntu-latest
     outputs:
-      targets: ${{ steps.targets.outputs.matrix }}
+      matrix: ${{ steps.generate.outputs.matrix }}
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
-        name: Targets matrix
-        id: targets
-        run: |
-          echo "matrix=$(docker buildx bake validate --print | jq -cr '.group.validate.targets')" >> $GITHUB_OUTPUT
+        name: Generate matrix
+        id: generate
+        uses: docker/bake-action/subaction/matrix@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
+        with:
+          target: validate
 
   validate:
     runs-on: ubuntu-latest
@@ -33,13 +37,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: ${{ fromJson(needs.prepare.outputs.targets) }}
+        include: ${{ fromJson(needs.prepare.outputs.matrix) }}
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
       -
         name: Validate
-        uses: docker/bake-action@v4
+        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
         with:
           targets: ${{ matrix.target }}

.github/workflows/zizmor.yml

@@ -0,0 +1,29 @@
+name: zizmor
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - 'master'
+      - 'releases/v*'
+    tags:
+      - 'v*'
+  pull_request:
+
+jobs:
+  zizmor:
+    uses: crazy-max/.github/.github/workflows/zizmor.yml@64a0bfaf6e6bb1c448d6e4c42b11034ee7094f16 # v1.7.1
+    permissions:
+      contents: read
+      security-events: write
+    with:
+      min-severity: medium
+      min-confidence: medium
+      persona: pedantic

.gitignore

@@ -1,12 +1,5 @@
-/.dev
-node_modules/
-lib
+# https://raw.githubusercontent.com/github/gitignore/main/Node.gitignore
 
-# Jetbrains
-/.idea
-/*.iml
-
-# Rest of the file pulled from https://github.com/github/gitignore/blob/master/Node.gitignore
 # Logs
 logs
 *.log
@@ -14,6 +7,7 @@ npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 lerna-debug.log*
+.pnpm-debug.log*
 
 # Diagnostic reports (https://nodejs.org/api/report.html)
 report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
@@ -24,34 +18,14 @@ pids
 *.seed
 *.pid.lock
 
-# Directory for instrumented libs generated by jscoverage/JSCover
-lib-cov
-
 # Coverage directory used by tools like istanbul
 coverage
 *.lcov
 
-# nyc test coverage
-.nyc_output
-
-# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
-.grunt
-
-# Bower dependency directory (https://bower.io/)
-bower_components
-
-# node-waf configuration
-.lock-wscript
-
-# Compiled binary addons (https://nodejs.org/api/addons.html)
-build/Release
-
 # Dependency directories
+node_modules/
 jspm_packages/
 
-# TypeScript v1 declaration files
-typings/
-
 # TypeScript cache
 *.tsbuildinfo
 
@@ -61,36 +35,19 @@ typings/
 # Optional eslint cache
 .eslintcache
 
-# Optional REPL history
-.node_repl_history
-
-# Output of 'npm pack'
-*.tgz
-
 # Yarn Integrity file
 .yarn-integrity
 
-# dotenv environment variables file
+# dotenv environment variable files
 .env
-.env.test
+.env.development.local
+.env.test.local
+.env.production.local
+.env.local
 
-# parcel-bundler cache (https://parceljs.org/)
-.cache
-
-# next.js build output
-.next
-
-# nuxt.js build output
-.nuxt
-
-# vuepress build output
-.vuepress/dist
-
-# Serverless directories
-.serverless/
-
-# FuseBox cache
-.fusebox/
-
-# DynamoDB Local files
-.dynamodb/
+# yarn v2
+.yarn/cache
+.yarn/unplugged
+.yarn/build-state.yml
+.yarn/install-state.gz
+.pnp.*

.prettierignore

@@ -0,0 +1,6 @@
+# Dependency directories
+node_modules/
+jspm_packages/
+
+# yarn v2
+.yarn/

.prettierrc.json

@@ -6,6 +6,5 @@
   "singleQuote": true,
   "trailingComma": "none",
   "bracketSpacing": false,
-  "arrowParens": "avoid",
-  "parser": "typescript"
+  "arrowParens": "avoid"
 }

.yarnrc.yml

@@ -0,0 +1,17 @@
+# https://yarnpkg.com/configuration/yarnrc
+
+compressionLevel: mixed
+enableGlobalCache: false
+enableHardenedMode: true
+
+logFilters:
+  - code: YN0013
+    level: discard
+  - code: YN0019
+    level: discard
+  - code: YN0076
+    level: discard
+  - code: YN0086
+    level: discard
+
+nodeLinker: node-modules

README.md

@@ -44,10 +44,12 @@ ___
     * [`{{sha}}`](#sha)
     * [`{{base_ref}}`](#base_ref)
     * [`{{is_default_branch}}`](#is_default_branch)
+    * [`{{is_not_default_branch}}`](#is_not_default_branch)
     * [`{{date '<format>' tz='<timezone>'}}`](#date-format-tztimezone)
+    * [`{{commit_date '<format>' tz='<timezone>'}}`](#commit_date-format-tztimezone)
   * [Major version zero](#major-version-zero)
   * [JSON output object](#json-output-object)
-  * [Overwrite labels](#overwrite-labels)
+  * [Overwrite labels and annotations](#overwrite-labels-and-annotations)
   * [Annotations](#annotations)
 * [Contributing](#contributing)
 
@@ -73,27 +75,23 @@ jobs:
   docker:
     runs-on: ubuntu-latest
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: name/app
       -
         name: Login to DockerHub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       -
         name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
-          context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -127,13 +125,10 @@ jobs:
   docker:
     runs-on: ubuntu-latest
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             name/app
@@ -145,15 +140,14 @@ jobs:
       -
         name: Login to DockerHub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       -
         name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
-          context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -205,13 +199,10 @@ jobs:
   docker:
     runs-on: ubuntu-latest
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             name/app
@@ -223,11 +214,11 @@ jobs:
             type=sha
       -
         name: Build
-        uses: docker/bake-action@v3
+        uses: docker/bake-action@v7
         with:
           files: |
             ./docker-bake.hcl
-            ${{ steps.meta.outputs.bake-file }}
+            cwd://${{ steps.meta.outputs.bake-file }}
           targets: build
 ```
 
@@ -270,12 +261,12 @@ similar to the previous one:
 ```yaml
       -
         name: Build
-        uses: docker/bake-action@v3
+        uses: docker/bake-action@v7
         with:
           files: |
             ./docker-bake.hcl
-            ${{ steps.meta.outputs.bake-file-tags }}
-            ${{ steps.meta.outputs.bake-file-labels }}
+            cwd://${{ steps.meta.outputs.bake-file-tags }}
+            cwd://${{ steps.meta.outputs.bake-file-labels }}
           targets: build
 ```
 
@@ -285,6 +276,7 @@ similar to the previous one:
 
 The following inputs can be used as `step.with` keys:
 
+> [!NOTE]
 > `List` type is a newline-delimited string
 > ```yaml
 > labels: |
@@ -293,16 +285,18 @@ The following inputs can be used as `step.with` keys:
 >   org.opencontainers.image.vendor=MyCompany
 > ```
 
-| Name          | Type   | Description                                                                   |
-|---------------|--------|-------------------------------------------------------------------------------|
-| `context`     | String | Where to get context data. Allowed options are: `workflow` (default), `git`.  |
-| `images`      | List   | List of Docker images to use as base name for tags                            |
-| `tags`        | List   | List of [tags](#tags-input) as key-value pair attributes                      |
-| `flavor`      | List   | [Flavor](#flavor-input) to apply                                              |
-| `labels`      | List   | List of custom labels                                                         |
-| `sep-tags`    | String | Separator to use for tags output (default `\n`)                               |
-| `sep-labels`  | String | Separator to use for labels output (default `\n`)                             |
-| `bake-target` | String | Bake target name (default `docker-metadata-action`)                           |
+| Name              | Type   | Description                                                                  |
+|-------------------|--------|------------------------------------------------------------------------------|
+| `context`         | String | Where to get context data. Allowed options are: `workflow` (default), `git`. |
+| `images`          | List   | List of Docker images to use as base name for tags                           |
+| `tags`            | List   | List of [tags](#tags-input) as key-value pair attributes                     |
+| `flavor`          | List   | [Flavor](#flavor-input) to apply                                             |
+| `labels`          | List   | List of custom labels                                                        |
+| `annotations`     | List   | List of custom annotations                                                   |
+| `sep-tags`        | String | Separator to use for tags output (default `\n`)                              |
+| `sep-labels`      | String | Separator to use for labels output (default `\n`)                            |
+| `sep-annotations` | String | Separator to use for annotations output (default `\n`)                       |
+| `bake-target`     | String | Bake target name (default `docker-metadata-action`)                          |
 
 ### outputs
 
@@ -312,6 +306,7 @@ The following outputs are available:
 |-------------------------|--------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `version`               | String | Docker image version                                                                                                                                            |
 | `tags`                  | String | Docker tags                                                                                                                                                     |
+| `tag-names`             | String | Docker tag names without image base name                                                                                                                        |
 | `labels`                | String | Docker labels                                                                                                                                                   |
 | `annotations`           | String | [Annotations](https://github.com/moby/buildkit/blob/master/docs/annotations.md)                                                                                 |
 | `json`                  | String | JSON output of tags and labels                                                                                                                                  |
@@ -319,7 +314,7 @@ The following outputs are available:
 | `bake-file-labels`      | File   | [Bake file definition](https://docs.docker.com/build/bake/reference/) path with labels                                                                          |
 | `bake-file-annotations` | File   | [Bake file definition](https://docs.docker.com/build/bake/reference/) path with [annotations](https://github.com/moby/buildkit/blob/master/docs/annotations.md) |
 
-Alternatively, each output is also exported as an environment variable:
+Alternatively, each output is also exported as an environment variable when `DOCKER_METADATA_SET_OUTPUT_ENV` is `true`:
 
 * `DOCKER_METADATA_OUTPUT_VERSION`
 * `DOCKER_METADATA_OUTPUT_TAGS`
@@ -333,7 +328,7 @@ Alternatively, each output is also exported as an environment variable:
 So it can be used with our [Docker Build Push action](https://github.com/docker/build-push-action/):
 
 ```yaml
-- uses: docker/build-push-action@v5
+- uses: docker/build-push-action@v7
   with:
     build-args: |
       DOCKER_METADATA_OUTPUT_JSON
@@ -341,10 +336,12 @@ So it can be used with our [Docker Build Push action](https://github.com/docker/
 
 ### environment variables
 
-| Name                                 | Type   | Description                                                                                                |
-|--------------------------------------|--------|------------------------------------------------------------------------------------------------------------|
-| `DOCKER_METADATA_PR_HEAD_SHA`        | Bool   | If `true`, set associated head SHA instead of commit SHA that triggered the workflow on pull request event |
-| `DOCKER_METADATA_ANNOTATIONS_LEVELS` | String | Comma separated list of annotations levels to set for annotations output separated (default `manifest`)    |
+| Name                                 | Type   | Description                                                                                                                                  |
+|--------------------------------------|--------|----------------------------------------------------------------------------------------------------------------------------------------------|
+| `DOCKER_METADATA_PR_HEAD_SHA`        | Bool   | If `true`, set associated head SHA instead of commit SHA that triggered the workflow on pull request event                                   |
+| `DOCKER_METADATA_SHORT_SHA_LENGTH`   | Number | Specifies the length of the [short commit SHA](#typesha) to ensure uniqueness. Default is `7`, but can be increased for larger repositories. |
+| `DOCKER_METADATA_ANNOTATIONS_LEVELS` | String | Comma separated list of annotations levels to set for annotations output separated (default `manifest`)                                      |
+| `DOCKER_METADATA_SET_OUTPUT_ENV`     | Bool   | If `true`, sets each output as an environment variable (default `true`)                                                                      |
 
 ## `context` input
 
@@ -459,7 +456,7 @@ tags: |
   # handlebars
   type=schedule,pattern={{date 'YYYYMMDD'}}
   # handlebars with timezone
-  type=schedule,pattern={{date 'YYYYMMDD-hhmmss' tz='Asia/Tokyo'}}
+  type=schedule,pattern={{date 'YYYYMMDD-HHmmss' tz='Asia/Tokyo'}}
 ```
 
 Will be used on [schedule event](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#schedule).
@@ -491,6 +488,8 @@ tags: |
   type=semver,pattern={{version}}
   # use custom value instead of git tag
   type=semver,pattern={{version}},value=v1.0.0
+  # use custom value and match part of it
+  type=semver,pattern={{version}},value=p1/v1.0.0,match=v(\d.\d.\d)$
 ```
 
 Will be used on a [push tag event](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#push)
@@ -506,18 +505,21 @@ with the following expressions:
 * `minor` ; minor version identifier
 * `patch` ; patch version identifier
 
-| Git tag            | Pattern                                                  | Output               |
-|--------------------|----------------------------------------------------------|----------------------|
-| `v1.2.3`           | `{{raw}}`                                                | `v1.2.3`             |
-| `v1.2.3`           | `{{version}}`                                            | `1.2.3`              |
-| `v1.2.3`           | `{{major}}.{{minor}}`                                    | `1.2`                |
-| `v1.2.3`           | `v{{major}}`                                             | `v1`                 |
-| `v1.2.3`           | `{{minor}}`                                              | `2`                  |
-| `v1.2.3`           | `{{patch}}`                                              | `3`                  |
-| `v2.0.8-beta.67`   | `{{raw}}`                                                | `v2.0.8-beta.67`     |
-| `v2.0.8-beta.67`   | `{{version}}`                                            | `2.0.8-beta.67`      |
-| `v2.0.8-beta.67`   | `{{major}}.{{minor}}`                                    | `2.0.8-beta.67`*     |
+| Git tag          | Pattern               | Match          | Output           |
+|------------------|-----------------------|----------------|------------------|
+| `v1.2.3`         | `{{raw}}`             |                | `v1.2.3`         |
+| `v1.2.3`         | `{{version}}`         |                | `1.2.3`          |
+| `v1.2.3`         | `{{major}}.{{minor}}` |                | `1.2`            |
+| `v1.2.3`         | `v{{major}}`          |                | `v1`             |
+| `v1.2.3`         | `{{minor}}`           |                | `2`              |
+| `v1.2.3`         | `{{patch}}`           |                | `3`              |
+| `p1/v1.2.3`      | `{{version}}`         | `v(\d.\d.\d)$` | `1.2.3`          |
+| `v2.0.8-beta.67` | `{{raw}}`             |                | `v2.0.8-beta.67` |
+| `v2.0.8-beta.67` | `{{version}}`         |                | `2.0.8-beta.67`  |
+| `v2.0.8-beta.67` | `{{major}}`           |                | `2.0.8-beta.67`* |
+| `v2.0.8-beta.67` | `{{major}}.{{minor}}` |                | `2.0.8-beta.67`* |
 
+> [!IMPORTANT]
 > *Pre-release (rc, beta, alpha) will only extend `{{version}}` (or `{{raw}}`
 > if specified) as tag because they are updated frequently, and contain many
 > breaking changes that are (by the author's design) not yet fit for public
@@ -527,7 +529,7 @@ Extended attributes and default values:
 
 ```yaml
 tags: |
-  type=semver,enable=true,priority=900,prefix=,suffix=,pattern=,value=
+  type=semver,enable=true,priority=900,prefix=,suffix=,pattern=,value=,match=
 ```
 
 ### `type=pep440`
@@ -538,6 +540,8 @@ tags: |
   type=pep440,pattern={{version}}
   # use custom value instead of git tag
   type=pep440,pattern={{version}},value=1.0.0
+  # use custom value and match part of it
+  type=pep440,pattern={{version}},value=p1/v1.0.0,match=v(\d.\d.\d)$
 ```
 
 Will be used on a [push tag event](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#push)
@@ -553,20 +557,22 @@ with the following expressions:
 * `minor` ; minor version identifier
 * `patch` ; patch version identifier
 
-| Git tag            | Pattern                                                  | Output               |
-|--------------------|----------------------------------------------------------|----------------------|
-| `1.2.3`            | `{{raw}}`                                                | `1.2.3`              |
-| `1.2.3`            | `{{version}}`                                            | `1.2.3`              |
-| `v1.2.3`           | `{{version}}`                                            | `1.2.3`              |
-| `1.2.3`            | `{{major}}.{{minor}}`                                    | `1.2`                |
-| `1.2.3`            | `v{{major}}`                                             | `v1`                 |
-| `v1.2.3rc2`        | `{{raw}}`                                                | `v1.2.3rc2`          |
-| `1.2.3rc2`         | `{{version}}`                                            | `1.2.3rc2`           |
-| `1.2.3rc2`         | `{{major}}.{{minor}}`                                    | `1.2.3rc2`*          |
-| `1.2.3post1`       | `{{major}}.{{minor}}`                                    | `1.2.3.post1`*       |
-| `1.2.3beta2`       | `{{major}}.{{minor}}`                                    | `1.2.3b2`*           |
-| `1.0dev4`          | `{{major}}.{{minor}}`                                    | `1.0.dev4`*          |
+| Git tag      | Pattern               | Match          | Output         |
+|--------------|-----------------------|----------------|----------------|
+| `1.2.3`      | `{{raw}}`             |                | `1.2.3`        |
+| `1.2.3`      | `{{version}}`         |                | `1.2.3`        |
+| `v1.2.3`     | `{{version}}`         |                | `1.2.3`        |
+| `1.2.3`      | `{{major}}.{{minor}}` |                | `1.2`          |
+| `1.2.3`      | `v{{major}}`          |                | `v1`           |
+| `v1.2.3rc2`  | `{{raw}}`             |                | `v1.2.3rc2`    |
+| `1.2.3rc2`   | `{{version}}`         |                | `1.2.3rc2`     |
+| `p1/v1.2.3`  | `{{version}}`         | `v(\d.\d.\d)$` | `1.2.3`        |
+| `1.2.3rc2`   | `{{major}}.{{minor}}` |                | `1.2.3rc2`*    |
+| `1.2.3post1` | `{{major}}.{{minor}}` |                | `1.2.3.post1`* |
+| `1.2.3beta2` | `{{major}}.{{minor}}` |                | `1.2.3b2`*     |
+| `1.0dev4`    | `{{major}}.{{minor}}` |                | `1.0.dev4`*    |
 
+> [!IMPORTANT]
 > *dev/pre/post release will only extend `{{version}}` (or `{{raw}}` if
 > specified) as tag because they are updated frequently, and contain many
 > breaking changes that are (by the author's design) not yet fit for public
@@ -703,7 +709,26 @@ tags: |
   type=sha,format=long
 ```
 
-Output Git short commit (or long if specified) as Docker tag like `sha-ad132f5`.
+Output Git short commit (or long if specified) as Docker tag like
+`sha-860c190`.
+
+By default, the length of the short commit SHA is `7` characters. You can
+increase this length for larger repositories by setting the
+[`DOCKER_METADATA_SHORT_SHA_LENGTH` environment variable](#environment-variables):
+
+```yaml
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: |
+            name/app
+          tags: |
+            type=sha
+        env:
+          DOCKER_METADATA_SHORT_SHA_LENGTH: 12
+```
 
 Extended attributes and default values:
 
@@ -737,6 +762,7 @@ generated by default (`auto` mode) for:
 
 * [`type=ref,event=tag`](#typeref)
 * [`type=semver,pattern=...`](#typesemver)
+* [`type=pep440,pattern=...`](#typepep440)
 * [`type=match,pattern=...`](#typematch)
 
 For conditionally tagging with latest for a specific branch name, e.g. if your
@@ -778,7 +804,8 @@ Each tags `type` attribute has a default priority:
 ### Global expressions
 
 The following [Handlebars' template](https://handlebarsjs.com/guide/) expressions
-for `prefix`, `suffix`, `value` and `enable` attributes are available:
+for `prefix`, `suffix`, `value` and `enable` attributes of `tags` input are
+available:
 
 ```yaml
 tags: |
@@ -788,6 +815,13 @@ tags: |
   type=raw,value=mytag-{{branch}}-{{sha}}
 ```
 
+They can also be applied to `labels` and `annotations` inputs:
+
+```yaml
+labels: |
+  org.opencontainers.image.created={{commit_date 'YYYY-MM-DDTHH:mm:ss.SSS[Z]'}}
+```
+
 #### `{{branch}}`
 
 Returns the branch name that triggered the workflow run. Will be empty if not 
@@ -828,6 +862,7 @@ workflow run. Will be empty for a branch reference:
 | `push`         | `refs/heads/my/branch`        |                    |
 | `push tag`*    | `refs/tags/v1.2.3`            | `master`           |
 
+> [!IMPORTANT]
 > *`base_ref` is available in the push payload but doesn't always seem to 
 > return the expected branch when the push tag event occurs. It's also
 > [not documented in GitHub docs](https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#push).
@@ -839,6 +874,11 @@ workflow run. Will be empty for a branch reference:
 Returns `true` if the branch that triggered the workflow run is the default
 one, otherwise `false`.
 
+#### `{{is_not_default_branch}}`
+
+Returns `true` if the branch that triggered the workflow run is not the default
+one, otherwise `false`.
+
 #### `{{date '<format>' tz='<timezone>'}}`
 
 Returns the current date rendered by its [moment format](https://momentjs.com/docs/#/displaying/format/).
@@ -850,6 +890,20 @@ Default `tz` is UTC.
 | `{{date 'dddd, MMMM Do YYYY, h:mm:ss a'}}`   | `Friday, January 10th 2020, 3:25:50 pm` |
 | `{{date 'YYYYMMDD-HHmmss' tz='Asia/Tokyo'}}` | `20200110-093000`                       |
 
+#### `{{commit_date '<format>' tz='<timezone>'}}`
+
+Returns the date when the current git commit is committed, rendered by its
+[moment format](https://momentjs.com/docs/#/displaying/format/). It falls back
+to the current date if the commit date is not available.
+
+Default `tz` is UTC.
+
+| Expression                                          | Output example                          |
+|-----------------------------------------------------|-----------------------------------------|
+| `{{commit_date 'YYYYMMDD'}}`                        | `20200110`                              |
+| `{{commit_date 'dddd, MMMM Do YYYY, h:mm:ss a'}}`   | `Friday, January 10th 2020, 3:25:50 pm` |
+| `{{commit_date 'YYYYMMDD-HHmmss' tz='Asia/Tokyo'}}` | `20200110-093000`                       |
+
 ### Major version zero
 
 Major version zero (`0.y.z`) is for initial development and **may** change at
@@ -877,13 +931,13 @@ that you can reuse them further in your workflow using the [`fromJSON` function]
 ```yaml
       -
         name: Docker meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         id: meta
         with:
           images: name/app
       -
         name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -893,16 +947,17 @@ that you can reuse them further in your workflow using the [`fromJSON` function]
             REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
 ```
 
-### Overwrite labels
+### Overwrite labels and annotations
 
 If some [OCI Image Format Specification](https://github.com/opencontainers/image-spec/blob/master/annotations.md)
-labels generated are not suitable, you can overwrite them like this:
+generated are not suitable as labels/annotations, you can overwrite them like
+this:
 
 ```yaml
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: name/app
           labels: |
@@ -924,12 +979,12 @@ of the `metadata-action`:
 ```yaml
       -
         name: Docker meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: name/app
       -
         name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           tags: ${{ steps.meta.outputs.tags }}
           annotations: ${{ steps.meta.outputs.annotations }}
@@ -940,35 +995,43 @@ The same can be done with the [`bake-action`](https://github.com/docker/bake-act
 ```yaml
       -
         name: Docker meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: name/app
       -
         name: Build
-        uses: docker/bake-action@v3
+        uses: docker/bake-action@v7
         with:
           files: |
             ./docker-bake.hcl
-            ${{ steps.meta.outputs.bake-file-tags }}
-            ${{ steps.meta.outputs.bake-file-annotations }}
+            cwd://${{ steps.meta.outputs.bake-file-tags }}
+            cwd://${{ steps.meta.outputs.bake-file-annotations }}
           targets: build
 ```
 
-If you want to set specific level(s) for your annotations, you can use the
+Note that annotations can be attached at many different levels within a manifest.
+By default, the generated annotations will be attached to image manifests,
+but different registries may expect annotations at different places;
+a common practice is to read annotations at _image indexes_ if present,
+which are often used by multi-arch builds to index platform-specific images.
+If you want to specify level(s) for your annotations, you can use the
 [`DOCKER_METADATA_ANNOTATIONS_LEVELS` environment variable](#environment-variables)
-with a comma separated list of levels (defaults to `manifest`):
+with a comma separated list of all levels the annotations should be attached to (defaults to `manifest`).
+The following configuration demonstrates the ability to attach annotations to both image manifests and image indexes,
+though your registry may only need annotations at the index level. (That is, `index` alone may be enough.)
+Please consult the documentation of your registry.
 
 ```yaml
       -
         name: Docker meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: name/app
         env:
           DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
       -
         name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           tags: ${{ steps.meta.outputs.tags }}
           annotations: ${{ steps.meta.outputs.annotations }}

UPGRADE.md

@@ -1,300 +0,0 @@
-# Upgrade notes
-
-## v2 to v3
-
-* Repository has been moved to docker org. Replace `crazy-max/ghaction-docker-meta@v2`
-  with `docker/metadata-action@v5`
-* The default bake target has been changed: `ghaction-docker-meta` > `docker-metadata-action`
-
-## v1 to v2
-
-* [inputs](#inputs)
-  * [`tag-sha`](#tag-sha)
-  * [`tag-edge` / `tag-edge-branch`](#tag-edge--tag-edge-branch)
-  * [`tag-semver`](#tag-semver)
-  * [`tag-match` / `tag-match-group`](#tag-match--tag-match-group)
-  * [`tag-latest`](#tag-latest)
-  * [`tag-schedule`](#tag-schedule)
-  * [`tag-custom` / `tag-custom-only`](#tag-custom--tag-custom-only)
-  * [`label-custom`](#label-custom)
-* [Basic workflow](#basic-workflow)
-* [Semver workflow](#semver-workflow)
-
-### inputs
-
-| New        | Unchanged       | Removed            |
-|------------|-----------------|--------------------|
-| `tags`     | `images`        | `tag-sha`          |
-| `flavor`   | `sep-tags`      | `tag-edge`         |
-| `labels`   | `sep-labels`    | `tag-edge-branch`  |
-|            |                 | `tag-semver`       |
-|            |                 | `tag-match`        |
-|            |                 | `tag-match-group`  |
-|            |                 | `tag-latest`       |
-|            |                 | `tag-schedule`     |
-|            |                 | `tag-custom`       |
-|            |                 | `tag-custom-only`  |
-|            |                 | `label-custom`     |
-
-#### `tag-sha`
-
-```yaml
-tags: |
-  type=sha
-```
-
-#### `tag-edge` / `tag-edge-branch`
-
-```yaml
-tags: |
-  # default branch
-  type=edge
-  # specify branch
-  type=edge,branch=main
-```
-
-#### `tag-semver`
-
-```yaml
-tags: |
-  type=semver,pattern={{version}}
-```
-
-#### `tag-match` / `tag-match-group`
-
-```yaml
-tags: |
-  type=match,pattern=v(.*),group=1
-```
-
-#### `tag-latest`
-
-`tag-latest` is now handled through the [`flavor` input](README.md#flavor-input):
-
-```yaml
-flavor: |
-  latest=auto
-```
-
-See also the notes about ["latest tag" behavior](README.md#latest-tag)
-
-#### `tag-schedule`
-
-```yaml
-tags: |
-  # default tag (nightly)
-  type=schedule
-  # specific pattern
-  type=schedule,pattern={{date 'YYYYMMDD'}}
-```
-
-#### `tag-custom` / `tag-custom-only`
-
-```yaml
-tags: |
-  type=raw,value=foo
-  type=raw,value=bar
-  # or
-  type=raw,foo
-  type=raw,bar
-  # or
-  foo
-  bar
-```
-
-#### `label-custom`
-
-Same behavior for `labels`:
-
-```yaml
-labels: |
-  maintainer=CrazyMax
-```
-
-### Basic workflow
-
-```yaml
-# v1
-name: ci
-
-on:
-  push:
-    branches:
-      - 'master'
-    tags:
-      - 'v*'
-  pull_request:
-    branches:
-      - 'master'
-
-jobs:
-  docker:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v1
-        with:
-          images: name/app
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      -
-        name: Build and push
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-```
-
-```yaml
-# v2
-name: ci
-
-on:
-  push:
-    branches:
-      - 'master'
-    tags:
-      - 'v*'
-  pull_request:
-    branches:
-      - 'master'
-
-jobs:
-  docker:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: name/app
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      -
-        name: Build and push
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-```
-
-### Semver workflow
-
-```yaml
-# v1
-name: ci
-
-on:
-  push:
-    branches:
-      - 'master'
-    tags:
-      - 'v*'
-  pull_request:
-    branches:
-      - 'master'
-
-jobs:
-  docker:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v1
-        with:
-          images: name/app
-          tag-semver: |
-            {{version}}
-            {{major}}.{{minor}}
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      -
-        name: Build and push
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-```
-
-```yaml
-# v2
-name: ci
-
-on:
-  push:
-    branches:
-      - 'master'
-    tags:
-      - 'v*'
-  pull_request:
-    branches:
-      - 'master'
-
-jobs:
-  docker:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
-      -
-        name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: name/app
-          tags: |
-            type=ref,event=branch
-            type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-      -
-        name: Login to DockerHub
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      -
-        name: Build and push
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-```

__mocks__/@actions/github.ts

@@ -1,207 +0,0 @@
-import {jest} from '@jest/globals';
-
-export const context = {
-  repo: {
-    owner: 'docker',
-    repo: 'actions-toolkit'
-  },
-  ref: 'refs/heads/master',
-  runId: 123,
-  payload: {
-    after: '860c1904a1ce19322e91ac35af1ab07466440c37',
-    base_ref: null,
-    before: '5f3331d7f7044c18ca9f12c77d961c4d7cf3276a',
-    commits: [
-      {
-        author: {
-          email: 'crazy-max@users.noreply.github.com',
-          name: 'CrazyMax',
-          username: 'crazy-max'
-        },
-        committer: {
-          email: 'crazy-max@users.noreply.github.com',
-          name: 'CrazyMax',
-          username: 'crazy-max'
-        },
-        distinct: true,
-        id: '860c1904a1ce19322e91ac35af1ab07466440c37',
-        message: 'hello dev',
-        timestamp: '2022-04-19T11:27:24+02:00',
-        tree_id: 'd2c60af597e863787d2d27f569e30495b0b92820',
-        url: 'https://github.com/docker/test-docker-action/commit/860c1904a1ce19322e91ac35af1ab07466440c37'
-      }
-    ],
-    compare: 'https://github.com/docker/test-docker-action/compare/5f3331d7f704...860c1904a1ce',
-    created: false,
-    deleted: false,
-    forced: false,
-    head_commit: {
-      author: {
-        email: 'crazy-max@users.noreply.github.com',
-        name: 'CrazyMax',
-        username: 'crazy-max'
-      },
-      committer: {
-        email: 'crazy-max@users.noreply.github.com',
-        name: 'CrazyMax',
-        username: 'crazy-max'
-      },
-      distinct: true,
-      id: '860c1904a1ce19322e91ac35af1ab07466440c37',
-      message: 'hello dev',
-      timestamp: '2022-04-19T11:27:24+02:00',
-      tree_id: 'd2c60af597e863787d2d27f569e30495b0b92820',
-      url: 'https://github.com/docker/test-docker-action/commit/860c1904a1ce19322e91ac35af1ab07466440c37'
-    },
-    organization: {
-      avatar_url: 'https://avatars.githubusercontent.com/u/5429470?v=4',
-      description: 'Docker helps developers bring their ideas to life by conquering the complexity of app development.',
-      events_url: 'https://api.github.com/orgs/docker/events',
-      hooks_url: 'https://api.github.com/orgs/docker/hooks',
-      id: 5429470,
-      issues_url: 'https://api.github.com/orgs/docker/issues',
-      login: 'docker',
-      members_url: 'https://api.github.com/orgs/docker/members{/member}',
-      node_id: 'MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=',
-      public_members_url: 'https://api.github.com/orgs/docker/public_members{/member}',
-      repos_url: 'https://api.github.com/orgs/docker/repos',
-      url: 'https://api.github.com/orgs/docker'
-    },
-    pusher: {
-      email: 'github@crazymax.dev',
-      name: 'crazy-max'
-    },
-    ref: 'refs/heads/dev',
-    repository: {
-      allow_forking: true,
-      archive_url: 'https://api.github.com/repos/docker/test-docker-action/{archive_format}{/ref}',
-      archived: false,
-      assignees_url: 'https://api.github.com/repos/docker/test-docker-action/assignees{/user}',
-      blobs_url: 'https://api.github.com/repos/docker/test-docker-action/git/blobs{/sha}',
-      branches_url: 'https://api.github.com/repos/docker/test-docker-action/branches{/branch}',
-      clone_url: 'https://github.com/docker/test-docker-action.git',
-      collaborators_url: 'https://api.github.com/repos/docker/test-docker-action/collaborators{/collaborator}',
-      comments_url: 'https://api.github.com/repos/docker/test-docker-action/comments{/number}',
-      commits_url: 'https://api.github.com/repos/docker/test-docker-action/commits{/sha}',
-      compare_url: 'https://api.github.com/repos/docker/test-docker-action/compare/{base}...{head}',
-      contents_url: 'https://api.github.com/repos/docker/test-docker-action/contents/{+path}',
-      contributors_url: 'https://api.github.com/repos/docker/test-docker-action/contributors',
-      created_at: 1596792180,
-      default_branch: 'master',
-      deployments_url: 'https://api.github.com/repos/docker/test-docker-action/deployments',
-      description: 'Test "Docker" Actions',
-      disabled: false,
-      downloads_url: 'https://api.github.com/repos/docker/test-docker-action/downloads',
-      events_url: 'https://api.github.com/repos/docker/test-docker-action/events',
-      fork: false,
-      forks: 1,
-      forks_count: 1,
-      forks_url: 'https://api.github.com/repos/docker/test-docker-action/forks',
-      full_name: 'docker/test-docker-action',
-      git_commits_url: 'https://api.github.com/repos/docker/test-docker-action/git/commits{/sha}',
-      git_refs_url: 'https://api.github.com/repos/docker/test-docker-action/git/refs{/sha}',
-      git_tags_url: 'https://api.github.com/repos/docker/test-docker-action/git/tags{/sha}',
-      git_url: 'git://github.com/docker/test-docker-action.git',
-      has_downloads: true,
-      has_issues: true,
-      has_pages: false,
-      has_projects: true,
-      has_wiki: true,
-      homepage: '',
-      hooks_url: 'https://api.github.com/repos/docker/test-docker-action/hooks',
-      html_url: 'https://github.com/docker/test-docker-action',
-      id: 285789493,
-      is_template: false,
-      issue_comment_url: 'https://api.github.com/repos/docker/test-docker-action/issues/comments{/number}',
-      issue_events_url: 'https://api.github.com/repos/docker/test-docker-action/issues/events{/number}',
-      issues_url: 'https://api.github.com/repos/docker/test-docker-action/issues{/number}',
-      keys_url: 'https://api.github.com/repos/docker/test-docker-action/keys{/key_id}',
-      labels_url: 'https://api.github.com/repos/docker/test-docker-action/labels{/name}',
-      language: 'JavaScript',
-      languages_url: 'https://api.github.com/repos/docker/test-docker-action/languages',
-      license: {
-        key: 'mit',
-        name: 'MIT License',
-        node_id: 'MDc6TGljZW5zZTEz',
-        spdx_id: 'MIT',
-        url: 'https://api.github.com/licenses/mit'
-      },
-      master_branch: 'master',
-      merges_url: 'https://api.github.com/repos/docker/test-docker-action/merges',
-      milestones_url: 'https://api.github.com/repos/docker/test-docker-action/milestones{/number}',
-      mirror_url: null,
-      name: 'test-docker-action',
-      node_id: 'MDEwOlJlcG9zaXRvcnkyODU3ODk0OTM=',
-      notifications_url: 'https://api.github.com/repos/docker/test-docker-action/notifications{?since,all,participating}',
-      open_issues: 6,
-      open_issues_count: 6,
-      organization: 'docker',
-      owner: {
-        avatar_url: 'https://avatars.githubusercontent.com/u/5429470?v=4',
-        email: 'info@docker.com',
-        events_url: 'https://api.github.com/users/docker/events{/privacy}',
-        followers_url: 'https://api.github.com/users/docker/followers',
-        following_url: 'https://api.github.com/users/docker/following{/other_user}',
-        gists_url: 'https://api.github.com/users/docker/gists{/gist_id}',
-        gravatar_id: '',
-        html_url: 'https://github.com/docker',
-        id: 5429470,
-        login: 'docker',
-        name: 'docker',
-        node_id: 'MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=',
-        organizations_url: 'https://api.github.com/users/docker/orgs',
-        received_events_url: 'https://api.github.com/users/docker/received_events',
-        repos_url: 'https://api.github.com/users/docker/repos',
-        site_admin: false,
-        starred_url: 'https://api.github.com/users/docker/starred{/owner}{/repo}',
-        subscriptions_url: 'https://api.github.com/users/docker/subscriptions',
-        type: 'Organization',
-        url: 'https://api.github.com/users/docker'
-      },
-      private: true,
-      pulls_url: 'https://api.github.com/repos/docker/test-docker-action/pulls{/number}',
-      pushed_at: 1650360446,
-      releases_url: 'https://api.github.com/repos/docker/test-docker-action/releases{/id}',
-      size: 796,
-      ssh_url: 'git@github.com:docker/test-docker-action.git',
-      stargazers: 0,
-      stargazers_count: 0,
-      stargazers_url: 'https://api.github.com/repos/docker/test-docker-action/stargazers',
-      statuses_url: 'https://api.github.com/repos/docker/test-docker-action/statuses/{sha}',
-      subscribers_url: 'https://api.github.com/repos/docker/test-docker-action/subscribers',
-      subscription_url: 'https://api.github.com/repos/docker/test-docker-action/subscription',
-      svn_url: 'https://github.com/docker/test-docker-action',
-      tags_url: 'https://api.github.com/repos/docker/test-docker-action/tags',
-      teams_url: 'https://api.github.com/repos/docker/test-docker-action/teams',
-      topics: [],
-      trees_url: 'https://api.github.com/repos/docker/test-docker-action/git/trees{/sha}',
-      updated_at: '2022-04-19T09:05:09Z',
-      url: 'https://github.com/docker/test-docker-action',
-      visibility: 'private',
-      watchers: 0,
-      watchers_count: 0
-    },
-    sender: {
-      avatar_url: 'https://avatars.githubusercontent.com/u/1951866?v=4',
-      events_url: 'https://api.github.com/users/crazy-max/events{/privacy}',
-      followers_url: 'https://api.github.com/users/crazy-max/followers',
-      following_url: 'https://api.github.com/users/crazy-max/following{/other_user}',
-      gists_url: 'https://api.github.com/users/crazy-max/gists{/gist_id}',
-      gravatar_id: '',
-      html_url: 'https://github.com/crazy-max',
-      id: 1951866,
-      login: 'crazy-max',
-      node_id: 'MDQ6VXNlcjE5NTE4NjY=',
-      organizations_url: 'https://api.github.com/users/crazy-max/orgs',
-      received_events_url: 'https://api.github.com/users/crazy-max/received_events',
-      repos_url: 'https://api.github.com/users/crazy-max/repos',
-      site_admin: false,
-      starred_url: 'https://api.github.com/users/crazy-max/starred{/owner}{/repo}',
-      subscriptions_url: 'https://api.github.com/users/crazy-max/subscriptions',
-      type: 'User',
-      url: 'https://api.github.com/users/crazy-max'
-    }
-  }
-};
-
-export const getOctokit = jest.fn();

__tests__/context.test.ts

@@ -1,19 +1,10 @@
-import {afterEach, beforeEach, describe, expect, test, it, jest} from '@jest/globals';
-import * as dotenv from 'dotenv';
-import * as fs from 'fs';
-import * as path from 'path';
-import {Context} from '@actions/github/lib/context';
-import {Git} from '@docker/actions-toolkit/lib/git';
-import {GitHub} from '@docker/actions-toolkit/lib/github';
+import {beforeEach, describe, expect, test, it, vi} from 'vitest';
+import {Git} from '@docker/actions-toolkit/lib/git.js';
+import {Toolkit} from '@docker/actions-toolkit/lib/toolkit.js';
 
-import {ContextSource, getContext, getInputs, Inputs} from '../src/context';
+import * as context from '../src/context.js';
 
-beforeEach(() => {
-  jest.clearAllMocks();
-  jest.spyOn(GitHub, 'context', 'get').mockImplementation((): Context => {
-    return new Context();
-  });
-});
+const toolkit = new Toolkit({githubToken: 'fake-github-token'});
 
 describe('getInputs', () => {
   beforeEach(() => {
@@ -26,23 +17,25 @@ describe('getInputs', () => {
   });
 
   // prettier-ignore
-  test.each([
+  const cases: [number, Map<string, string>, context.Inputs][] = [
     [
       0,
       new Map<string, string>([
         ['images', 'moby/buildkit\nghcr.io/moby/mbuildkit'],
       ]),
       {
-        context: ContextSource.workflow,
+        context: context.ContextSource.workflow,
         bakeTarget: 'docker-metadata-action',
         flavor: [],
         githubToken: '',
         images: ['moby/buildkit', 'ghcr.io/moby/mbuildkit'],
         labels: [],
+        annotations: [],
         sepLabels: '\n',
         sepTags: '\n',
+        sepAnnotations: '\n',
         tags: [],
-      } as Inputs
+      }
     ],
     [
       1,
@@ -51,18 +44,21 @@ describe('getInputs', () => {
         ['images', 'moby/buildkit'],
         ['sep-labels', ','],
         ['sep-tags', ','],
+        ['sep-annotations', ',']
       ]),
       {
-        context: ContextSource.workflow,
+        context: context.ContextSource.workflow,
         bakeTarget: 'metadata',
         flavor: [],
         githubToken: '',
         images: ['moby/buildkit'],
         labels: [],
+        annotations: [],
         sepLabels: ',',
         sepTags: ',',
+        sepAnnotations: ',',
         tags: [],
-      } as Inputs
+      }
     ],
     [
       2,
@@ -70,57 +66,111 @@ describe('getInputs', () => {
         ['images', 'moby/buildkit\n#comment\nghcr.io/moby/mbuildkit'],
       ]),
       {
-        context: ContextSource.workflow,
+        context: context.ContextSource.workflow,
         bakeTarget: 'docker-metadata-action',
         flavor: [],
         githubToken: '',
         images: ['moby/buildkit', 'ghcr.io/moby/mbuildkit'],
         labels: [],
+        annotations: [],
         sepLabels: '\n',
         sepTags: '\n',
+        sepAnnotations: '\n',
         tags: [],
-      } as Inputs
+      }
     ],
-  ])(
-    '[%d] given %p as inputs, returns %p',
-    async (num: number, inputs: Map<string, string>, expected: Inputs) => {
-      inputs.forEach((value: string, name: string) => {
-        setInput(name, value);
-      });
-      expect(await getInputs()).toEqual(expected);
-    }
-  );
+    [
+      3,
+      new Map<string, string>([
+        ['labels', 'mylabel=foo#bar\n#comment\nanother=bar'],
+      ]),
+      {
+        context: context.ContextSource.workflow,
+        bakeTarget: 'docker-metadata-action',
+        flavor: [],
+        githubToken: '',
+        images: [],
+        labels: ['mylabel=foo#bar', 'another=bar'],
+        annotations: [],
+        sepLabels: '\n',
+        sepTags: '\n',
+        sepAnnotations: '\n',
+        tags: [],
+      }
+    ],
+    [
+      4,
+      new Map<string, string>([
+        ['annotations', 'org.opencontainers.image.url=https://example.com/path#readme\n#comment\norg.opencontainers.image.source=https://github.com/docker/metadata-action'],
+      ]),
+      {
+        context: context.ContextSource.workflow,
+        bakeTarget: 'docker-metadata-action',
+        flavor: [],
+        githubToken: '',
+        images: [],
+        labels: [],
+        annotations: [
+          'org.opencontainers.image.url=https://example.com/path#readme',
+          'org.opencontainers.image.source=https://github.com/docker/metadata-action'
+        ],
+        sepLabels: '\n',
+        sepTags: '\n',
+        sepAnnotations: '\n',
+        tags: [],
+      }
+    ],
+    [
+      5,
+      new Map<string, string>([
+        ['tags', 'type=raw,value=foo#bar\n#comment'],
+        ['flavor', 'prefix=v#1\n#comment'],
+      ]),
+      {
+        context: context.ContextSource.workflow,
+        bakeTarget: 'docker-metadata-action',
+        flavor: ['prefix=v#1'],
+        githubToken: '',
+        images: [],
+        labels: [],
+        annotations: [],
+        sepLabels: '\n',
+        sepTags: '\n',
+        sepAnnotations: '\n',
+        tags: ['type=raw,value=foo#bar'],
+      }
+    ],
+  ];
+  test.each(cases)('[%d] given %o as inputs, returns %o', async (num: number, inputs: Map<string, string>, expected: context.Inputs) => {
+    inputs.forEach((value: string, name: string) => {
+      setInput(name, value);
+    });
+    const res = await context.getInputs();
+    expect(res).toEqual(expected);
+  });
 });
 
 describe('getContext', () => {
-  const originalEnv = process.env;
-  beforeEach(() => {
-    jest.resetModules();
-    process.env = {
-      ...originalEnv,
-      ...dotenv.parse(fs.readFileSync(path.join(__dirname, 'fixtures/event_create_branch.env')))
-    };
-  });
-  afterEach(() => {
-    process.env = originalEnv;
-  });
-
   it('workflow', async () => {
-    const context = await getContext(ContextSource.workflow);
-    expect(context.ref).toEqual('refs/heads/dev');
-    expect(context.sha).toEqual('5f3331d7f7044c18ca9f12c77d961c4d7cf3276a');
+    const ctx = await context.getContext(context.ContextSource.workflow, toolkit);
+    expect(ctx.ref).toEqual('refs/heads/dev');
+    expect(ctx.sha).toEqual('5f3331d7f7044c18ca9f12c77d961c4d7cf3276a');
+    expect(ctx.commitDate).toEqual(new Date('2024-11-13T13:42:28.000Z'));
   });
-
   it('git', async () => {
-    jest.spyOn(Git, 'context').mockImplementation((): Promise<Context> => {
+    vi.spyOn(Git, 'context').mockImplementation((): Promise<context.Context> => {
       return Promise.resolve({
         ref: 'refs/heads/git-test',
         sha: 'git-test-sha'
-      } as Context);
+      } as context.Context);
     });
-    const context = await getContext(ContextSource.git);
-    expect(context.ref).toEqual('refs/heads/git-test');
-    expect(context.sha).toEqual('git-test-sha');
+    vi.spyOn(Git, 'commitDate').mockImplementation(async (): Promise<Date> => {
+      return new Date('2023-01-01T13:42:28.000Z');
+    });
+    const ctx = await context.getContext(context.ContextSource.git, toolkit);
+    expect(ctx.ref).toEqual('refs/heads/git-test');
+    expect(ctx.sha).toEqual('git-test-sha');
+    expect(ctx.commitDate).toEqual(new Date('2023-01-01T13:42:28.000Z'));
   });
 });
 

__tests__/flavor.test.ts

@@ -1,6 +1,6 @@
-import {describe, expect, test} from '@jest/globals';
+import {describe, expect, test} from 'vitest';
 
-import {Flavor, Transform} from '../src/flavor';
+import {Flavor, Transform} from '../src/flavor.js';
 
 describe('transform', () => {
   // prettier-ignore
@@ -175,7 +175,7 @@ describe('transform', () => {
       if (!invalid) {
         console.error(err);
       }
-      // eslint-disable-next-line jest/no-conditional-expect
+      // eslint-disable-next-line vitest/no-conditional-expect
       expect(true).toBe(invalid);
     }
   });

__tests__/image.test.ts

@@ -1,6 +1,6 @@
-import {describe, expect, test} from '@jest/globals';
+import {describe, expect, test} from 'vitest';
 
-import {Transform, Image} from '../src/image';
+import {Transform, Image} from '../src/image.js';
 
 describe('transform', () => {
   // prettier-ignore
@@ -95,7 +95,7 @@ describe('transform', () => {
       if (!invalid) {
         console.error(err);
       }
-      // eslint-disable-next-line jest/no-conditional-expect
+      // eslint-disable-next-line vitest/no-conditional-expect
       expect(true).toBe(invalid);
     }
   });

__tests__/setup.unit.ts

@@ -0,0 +1,252 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import {vi} from 'vitest';
+
+const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'docker-metadata-action-'));
+
+const githubPayload = {
+  after: '860c1904a1ce19322e91ac35af1ab07466440c37',
+  base_ref: null,
+  before: '5f3331d7f7044c18ca9f12c77d961c4d7cf3276a',
+  commits: [
+    {
+      author: {
+        email: 'crazy-max@users.noreply.github.com',
+        name: 'CrazyMax',
+        username: 'crazy-max'
+      },
+      committer: {
+        email: 'crazy-max@users.noreply.github.com',
+        name: 'CrazyMax',
+        username: 'crazy-max'
+      },
+      distinct: true,
+      id: '5f3331d7f7044c18ca9f12c77d961c4d7cf3276a',
+      message: 'hello dev',
+      timestamp: '2024-11-13T13:42:28Z',
+      tree_id: 'd2c60af597e863787d2d27f569e30495b0b92820',
+      url: 'https://github.com/docker/test-docker-action/commit/5f3331d7f7044c18ca9f12c77d961c4d7cf3276a'
+    }
+  ],
+  compare: 'https://github.com/docker/test-docker-action/compare/5f3331d7f704...860c1904a1ce',
+  created: false,
+  deleted: false,
+  forced: false,
+  head_commit: {
+    author: {
+      email: 'crazy-max@users.noreply.github.com',
+      name: 'CrazyMax',
+      username: 'crazy-max'
+    },
+    committer: {
+      email: 'crazy-max@users.noreply.github.com',
+      name: 'CrazyMax',
+      username: 'crazy-max'
+    },
+    distinct: true,
+    id: '5f3331d7f7044c18ca9f12c77d961c4d7cf3276a',
+    message: 'hello dev',
+    timestamp: '2024-11-13T13:42:28Z',
+    tree_id: 'd2c60af597e863787d2d27f569e30495b0b92820',
+    url: 'https://github.com/docker/test-docker-action/commit/5f3331d7f7044c18ca9f12c77d961c4d7cf3276a'
+  },
+  organization: {
+    avatar_url: 'https://avatars.githubusercontent.com/u/5429470?v=4',
+    description: 'Docker helps developers bring their ideas to life by conquering the complexity of app development.',
+    events_url: 'https://api.github.com/orgs/docker/events',
+    hooks_url: 'https://api.github.com/orgs/docker/hooks',
+    id: 5429470,
+    issues_url: 'https://api.github.com/orgs/docker/issues',
+    login: 'docker',
+    members_url: 'https://api.github.com/orgs/docker/members{/member}',
+    node_id: 'MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=',
+    public_members_url: 'https://api.github.com/orgs/docker/public_members{/member}',
+    repos_url: 'https://api.github.com/orgs/docker/repos',
+    url: 'https://api.github.com/orgs/docker'
+  },
+  pusher: {
+    email: 'github@crazymax.dev',
+    name: 'crazy-max'
+  },
+  ref: 'refs/heads/dev',
+  repository: {
+    allow_forking: true,
+    archive_url: 'https://api.github.com/repos/docker/test-docker-action/{archive_format}{/ref}',
+    archived: false,
+    assignees_url: 'https://api.github.com/repos/docker/test-docker-action/assignees{/user}',
+    blobs_url: 'https://api.github.com/repos/docker/test-docker-action/git/blobs{/sha}',
+    branches_url: 'https://api.github.com/repos/docker/test-docker-action/branches{/branch}',
+    clone_url: 'https://github.com/docker/test-docker-action.git',
+    collaborators_url: 'https://api.github.com/repos/docker/test-docker-action/collaborators{/collaborator}',
+    comments_url: 'https://api.github.com/repos/docker/test-docker-action/comments{/number}',
+    commits_url: 'https://api.github.com/repos/docker/test-docker-action/commits{/sha}',
+    compare_url: 'https://api.github.com/repos/docker/test-docker-action/compare/{base}...{head}',
+    contents_url: 'https://api.github.com/repos/docker/test-docker-action/contents/{+path}',
+    contributors_url: 'https://api.github.com/repos/docker/test-docker-action/contributors',
+    created_at: 1596792180,
+    default_branch: 'master',
+    deployments_url: 'https://api.github.com/repos/docker/test-docker-action/deployments',
+    description: 'Test "Docker" Actions',
+    disabled: false,
+    downloads_url: 'https://api.github.com/repos/docker/test-docker-action/downloads',
+    events_url: 'https://api.github.com/repos/docker/test-docker-action/events',
+    fork: false,
+    forks: 1,
+    forks_count: 1,
+    forks_url: 'https://api.github.com/repos/docker/test-docker-action/forks',
+    full_name: 'docker/test-docker-action',
+    git_commits_url: 'https://api.github.com/repos/docker/test-docker-action/git/commits{/sha}',
+    git_refs_url: 'https://api.github.com/repos/docker/test-docker-action/git/refs{/sha}',
+    git_tags_url: 'https://api.github.com/repos/docker/test-docker-action/git/tags{/sha}',
+    git_url: 'git://github.com/docker/test-docker-action.git',
+    has_downloads: true,
+    has_issues: true,
+    has_pages: false,
+    has_projects: true,
+    has_wiki: true,
+    homepage: '',
+    hooks_url: 'https://api.github.com/repos/docker/test-docker-action/hooks',
+    html_url: 'https://github.com/docker/test-docker-action',
+    id: 285789493,
+    is_template: false,
+    issue_comment_url: 'https://api.github.com/repos/docker/test-docker-action/issues/comments{/number}',
+    issue_events_url: 'https://api.github.com/repos/docker/test-docker-action/issues/events{/number}',
+    issues_url: 'https://api.github.com/repos/docker/test-docker-action/issues{/number}',
+    keys_url: 'https://api.github.com/repos/docker/test-docker-action/keys{/key_id}',
+    labels_url: 'https://api.github.com/repos/docker/test-docker-action/labels{/name}',
+    language: 'JavaScript',
+    languages_url: 'https://api.github.com/repos/docker/test-docker-action/languages',
+    license: {
+      key: 'mit',
+      name: 'MIT License',
+      node_id: 'MDc6TGljZW5zZTEz',
+      spdx_id: 'MIT',
+      url: 'https://api.github.com/licenses/mit'
+    },
+    master_branch: 'master',
+    merges_url: 'https://api.github.com/repos/docker/test-docker-action/merges',
+    milestones_url: 'https://api.github.com/repos/docker/test-docker-action/milestones{/number}',
+    mirror_url: null,
+    name: 'test-docker-action',
+    node_id: 'MDEwOlJlcG9zaXRvcnkyODU3ODk0OTM=',
+    notifications_url: 'https://api.github.com/repos/docker/test-docker-action/notifications{?since,all,participating}',
+    open_issues: 6,
+    open_issues_count: 6,
+    organization: 'docker',
+    owner: {
+      avatar_url: 'https://avatars.githubusercontent.com/u/5429470?v=4',
+      email: 'info@docker.com',
+      events_url: 'https://api.github.com/users/docker/events{/privacy}',
+      followers_url: 'https://api.github.com/users/docker/followers',
+      following_url: 'https://api.github.com/users/docker/following{/other_user}',
+      gists_url: 'https://api.github.com/users/docker/gists{/gist_id}',
+      gravatar_id: '',
+      html_url: 'https://github.com/docker',
+      id: 5429470,
+      login: 'docker',
+      name: 'docker',
+      node_id: 'MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=',
+      organizations_url: 'https://api.github.com/users/docker/orgs',
+      received_events_url: 'https://api.github.com/users/docker/received_events',
+      repos_url: 'https://api.github.com/users/docker/repos',
+      site_admin: false,
+      starred_url: 'https://api.github.com/users/docker/starred{/owner}{/repo}',
+      subscriptions_url: 'https://api.github.com/users/docker/subscriptions',
+      type: 'Organization',
+      url: 'https://api.github.com/users/docker'
+    },
+    private: true,
+    pulls_url: 'https://api.github.com/repos/docker/test-docker-action/pulls{/number}',
+    pushed_at: 1650360446,
+    releases_url: 'https://api.github.com/repos/docker/test-docker-action/releases{/id}',
+    size: 796,
+    ssh_url: 'git@github.com:docker/test-docker-action.git',
+    stargazers: 0,
+    stargazers_count: 0,
+    stargazers_url: 'https://api.github.com/repos/docker/test-docker-action/stargazers',
+    statuses_url: 'https://api.github.com/repos/docker/test-docker-action/statuses/{sha}',
+    subscribers_url: 'https://api.github.com/repos/docker/test-docker-action/subscribers',
+    subscription_url: 'https://api.github.com/repos/docker/test-docker-action/subscription',
+    svn_url: 'https://github.com/docker/test-docker-action',
+    tags_url: 'https://api.github.com/repos/docker/test-docker-action/tags',
+    teams_url: 'https://api.github.com/repos/docker/test-docker-action/teams',
+    topics: [],
+    trees_url: 'https://api.github.com/repos/docker/test-docker-action/git/trees{/sha}',
+    updated_at: '2022-04-19T09:05:09Z',
+    url: 'https://github.com/docker/test-docker-action',
+    visibility: 'private',
+    watchers: 0,
+    watchers_count: 0
+  },
+  sender: {
+    avatar_url: 'https://avatars.githubusercontent.com/u/1951866?v=4',
+    events_url: 'https://api.github.com/users/crazy-max/events{/privacy}',
+    followers_url: 'https://api.github.com/users/crazy-max/followers',
+    following_url: 'https://api.github.com/users/crazy-max/following{/other_user}',
+    gists_url: 'https://api.github.com/users/crazy-max/gists{/gist_id}',
+    gravatar_id: '',
+    html_url: 'https://github.com/crazy-max',
+    id: 1951866,
+    login: 'crazy-max',
+    node_id: 'MDQ6VXNlcjE5NTE4NjY=',
+    organizations_url: 'https://api.github.com/users/crazy-max/orgs',
+    received_events_url: 'https://api.github.com/users/crazy-max/received_events',
+    repos_url: 'https://api.github.com/users/crazy-max/repos',
+    site_admin: false,
+    starred_url: 'https://api.github.com/users/crazy-max/starred{/owner}{/repo}',
+    subscriptions_url: 'https://api.github.com/users/crazy-max/subscriptions',
+    type: 'User',
+    url: 'https://api.github.com/users/crazy-max'
+  }
+};
+
+const githubEventPath = path.join(tmpDir, 'github-event.json');
+fs.writeFileSync(githubEventPath, JSON.stringify(githubPayload));
+
+process.env = Object.assign({}, process.env, {
+  TEMP: tmpDir,
+  GITHUB_REPOSITORY: 'docker/metadata-action',
+  GITHUB_REF: 'refs/heads/dev',
+  GITHUB_RUN_ID: '2188748038',
+  GITHUB_RUN_ATTEMPT: '1',
+  GITHUB_RUN_NUMBER: '15',
+  GITHUB_SHA: '5f3331d7f7044c18ca9f12c77d961c4d7cf3276a',
+  GITHUB_EVENT_PATH: githubEventPath,
+  RUNNER_TEMP: path.join(tmpDir, 'runner-temp'),
+  RUNNER_TOOL_CACHE: path.join(tmpDir, 'runner-tool-cache')
+});
+
+const getCommitMock = vi.hoisted(() =>
+  vi.fn(async () => ({
+    data: {
+      commit: {
+        committer: {
+          date: '2024-11-13T13:42:28Z'
+        }
+      }
+    }
+  }))
+);
+
+const getOctokitMock = vi.hoisted(() =>
+  vi.fn(() => ({
+    rest: {
+      repos: {
+        getCommit: getCommitMock
+      }
+    }
+  }))
+);
+
+vi.mock('@actions/github', async importOriginal => {
+  const actual = await importOriginal<typeof import('@actions/github')>();
+  return {
+    ...actual,
+    context: {
+      ...actual.context,
+      payload: githubPayload
+    },
+    getOctokit: getOctokitMock
+  };
+});

__tests__/tag.test.ts

@@ -1,6 +1,6 @@
-import {describe, expect, test} from '@jest/globals';
+import {describe, expect, test} from 'vitest';
 
-import {Transform, Parse, Tag, Type, RefEvent, ShaFormat, DefaultPriorities} from '../src/tag';
+import {Transform, Parse, Tag, Type, RefEvent, ShaFormat, DefaultPriorities} from '../src/tag.js';
 
 describe('transform', () => {
   // prettier-ignore
@@ -32,7 +32,8 @@ describe('transform', () => {
             "priority": DefaultPriorities[Type.Semver],
             "enable": "true",
             "pattern": "{{version}}",
-            "value": ""
+            "value": "",
+            "match": ""
           }
         },
         {
@@ -106,7 +107,7 @@ describe('transform', () => {
       if (!invalid) {
         console.error(err);
       }
-      // eslint-disable-next-line jest/no-conditional-expect
+      // eslint-disable-next-line vitest/no-conditional-expect
       expect(true).toBe(invalid);
     }
   });
@@ -147,7 +148,8 @@ describe('parse', () => {
           "priority": DefaultPriorities[Type.Semver],
           "enable": "true",
           "pattern": "{{version}}",
-          "value": ""
+          "value": "",
+          "match": ""
         }
       } as Tag,
       false
@@ -160,7 +162,8 @@ describe('parse', () => {
           "priority": "1",
           "enable": "true",
           "pattern": "{{version}}",
-          "value": ""
+          "value": "",
+          "match": ""
         }
       } as Tag,
       false
@@ -173,7 +176,22 @@ describe('parse', () => {
           "priority": "1",
           "enable": "true",
           "pattern": "{{version}}",
-          "value": "v1.0.0"
+          "value": "v1.0.0",
+          "match": ""
+        }
+      } as Tag,
+      false
+    ],
+    [
+      `type=semver,priority=1,enable=true,pattern={{version}},value=p1/v1.0.0,"match=v(\\d.\\d.\\d)$"`,
+      {
+        type: Type.Semver,
+        attrs: {
+          "priority": "1",
+          "enable": "true",
+          "pattern": "{{version}}",
+          "value": "p1/v1.0.0",
+          "match": "v(\\d.\\d.\\d)$"
         }
       } as Tag,
       false
@@ -443,7 +461,7 @@ describe('parse', () => {
       if (!invalid) {
         console.error(err);
       }
-      // eslint-disable-next-line jest/no-conditional-expect
+      // eslint-disable-next-line vitest/no-conditional-expect
       expect(true).toBe(invalid);
     }
   });

action.yml

@@ -23,12 +23,18 @@ inputs:
   labels:
     description: 'List of custom labels'
     required: false
+  annotations:
+    description: 'List of custom annotations'
+    required: false
   sep-tags:
     description: 'Separator to use for tags output (default \n)'
     required: false
   sep-labels:
     description: 'Separator to use for labels output (default \n)'
     required: false
+  sep-annotations:
+    description: 'Separator to use for annotations output (default \n)'
+    required: false
   bake-target:
     description: 'Bake target name (default docker-metadata-action)'
     required: false
@@ -42,6 +48,8 @@ outputs:
     description: 'Generated Docker image version'
   tags:
     description: 'Generated Docker tags'
+  tag-names:
+    description: 'Generated Docker tag names without image base name'
   labels:
     description: 'Generated Docker labels'
   annotations:
@@ -53,10 +61,10 @@ outputs:
   bake-file-labels:
     description: 'Bake definition file with labels'
   bake-file-annotations:
-    description: 'Bake definiton file with annotations'
+    description: 'Bake definition file with annotations'
   bake-file:
     description: 'Bake definition file with tags and labels'
 
 runs:
-  using: 'node20'
-  main: 'dist/index.js'
+  using: 'node24'
+  main: 'dist/index.cjs'

dev.Dockerfile

@@ -1,13 +1,21 @@
 # syntax=docker/dockerfile:1
 
-ARG NODE_VERSION=20
+ARG NODE_VERSION=24
 
 FROM node:${NODE_VERSION}-alpine AS base
-RUN apk add --no-cache cpio findutils git
+RUN apk add --no-cache cpio findutils git rsync
 WORKDIR /src
+RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/.yarn/cache <<EOT
+  set -e
+  corepack enable
+  yarn --version
+  yarn config set --home enableTelemetry 0
+EOT
 
 FROM base AS deps
 RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/.yarn/cache \
   --mount=type=cache,target=/src/node_modules \
   yarn install && mkdir /vendor && cp yarn.lock /vendor
 
@@ -20,24 +28,34 @@ RUN --mount=type=bind,target=.,rw <<EOT
   git add -A
   cp -rf /vendor/* .
   if [ -n "$(git status --porcelain -- yarn.lock)" ]; then
-    echo >&2 'ERROR: Vendor result differs. Please vendor your package with "docker buildx bake vendor-update"'
+    echo >&2 'ERROR: Vendor result differs. Please vendor your package with "docker buildx bake vendor"'
     git status --porcelain -- yarn.lock
     exit 1
   fi
 EOT
 
 FROM deps AS build
-RUN --mount=type=bind,target=.,rw \
-  --mount=type=cache,target=/src/node_modules \
-  yarn run build && mkdir /out && cp -Rf dist /out/
+RUN --mount=target=/context \
+  --mount=type=cache,target=/src/.yarn/cache \
+  --mount=type=cache,target=/src/node_modules <<EOT
+  set -e
+  rsync -a /context/. .
+  rm -rf dist
+  yarn run build
+  mkdir /out
+  cp -r dist /out
+EOT
 
 FROM scratch AS build-update
 COPY --from=build /out /
 
 FROM build AS build-validate
-RUN --mount=type=bind,target=.,rw <<EOT
+RUN --mount=target=/context \
+  --mount=target=.,type=tmpfs <<EOT
   set -e
+  rsync -a /context/. .
   git add -A
+  rm -rf dist
   cp -rf /out/* .
   if [ -n "$(git status --porcelain -- dist)" ]; then
     echo >&2 'ERROR: Build result differs. Please build first with "docker buildx bake build"'
@@ -48,24 +66,24 @@ EOT
 
 FROM deps AS format
 RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/.yarn/cache \
   --mount=type=cache,target=/src/node_modules \
-  yarn run format \
-  && mkdir /out && find . -name '*.ts' -not -path './node_modules/*' | cpio -pdm /out
+  yarn run format && mkdir /out && find . -name '*.ts' -not -path './node_modules/*' -not -path './.yarn/*' | cpio -pdm /out
 
 FROM scratch AS format-update
 COPY --from=format /out /
 
 FROM deps AS lint
 RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/.yarn/cache \
   --mount=type=cache,target=/src/node_modules \
   yarn run lint
 
 FROM deps AS test
-ENV RUNNER_TEMP=/tmp/github_runner
-ENV RUNNER_TOOL_CACHE=/tmp/github_tool_cache
 RUN --mount=type=bind,target=.,rw \
+  --mount=type=cache,target=/src/.yarn/cache \
   --mount=type=cache,target=/src/node_modules \
-  yarn run test --coverage --coverageDirectory=/tmp/coverage
+  yarn run test --coverage --coverage.reportsDirectory=/tmp/coverage
 
 FROM scratch AS test-coverage
 COPY --from=test /tmp/coverage /

docker-bake.hcl

@@ -1,9 +1,15 @@
+target "_common" {
+  args = {
+    BUILDKIT_CONTEXT_KEEP_GIT_DIR = 1
+  }
+}
+
 group "default" {
   targets = ["build"]
 }
 
 group "pre-checkin" {
-  targets = ["vendor-update", "format", "build"]
+  targets = ["vendor", "format", "build"]
 }
 
 group "validate" {
@@ -11,42 +17,49 @@ group "validate" {
 }
 
 target "build" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "build-update"
   output = ["."]
 }
 
 target "build-validate" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "build-validate"
   output = ["type=cacheonly"]
 }
 
 target "format" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "format-update"
   output = ["."]
 }
 
 target "lint" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "lint"
   output = ["type=cacheonly"]
 }
 
-target "vendor-update" {
+target "vendor" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "vendor-update"
   output = ["."]
 }
 
 target "vendor-validate" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "vendor-validate"
   output = ["type=cacheonly"]
 }
 
 target "test" {
+  inherits = ["_common"]
   dockerfile = "dev.Dockerfile"
   target = "test-coverage"
   output = ["./coverage"]

eslint.config.mjs

@@ -0,0 +1,52 @@
+import {defineConfig} from 'eslint/config';
+import js from '@eslint/js';
+import tseslint from '@typescript-eslint/eslint-plugin';
+import vitest from '@vitest/eslint-plugin';
+import globals from 'globals';
+import eslintConfigPrettier from 'eslint-config-prettier/flat';
+import eslintPluginPrettier from 'eslint-plugin-prettier';
+
+export default defineConfig([
+  {
+    ignores: ['.yarn/**/*', 'coverage/**/*', 'dist/**/*']
+  },
+  js.configs.recommended,
+  ...tseslint.configs['flat/recommended'],
+  eslintConfigPrettier,
+  {
+    languageOptions: {
+      globals: {
+        ...globals.node
+      }
+    }
+  },
+  {
+    files: ['__tests__/**'],
+    ...vitest.configs.recommended,
+    languageOptions: {
+      globals: {
+        ...globals.node,
+        ...vitest.environments.env.globals
+      }
+    },
+    rules: {
+      ...vitest.configs.recommended.rules,
+      'vitest/no-conditional-expect': 'error',
+      'vitest/no-disabled-tests': 0
+    }
+  },
+  {
+    plugins: {
+      prettier: eslintPluginPrettier
+    },
+    rules: {
+      'prettier/prettier': 'error',
+      '@typescript-eslint/no-require-imports': [
+        'error',
+        {
+          allowAsImport: true
+        }
+      ]
+    }
+  }
+]);

jest.config.ts

@@ -1,31 +0,0 @@
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-
-const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'docker-metadata-action-'));
-
-process.env = Object.assign({}, process.env, {
-  TEMP: tmpDir,
-  GITHUB_REPOSITORY: 'docker/metadata-action',
-  RUNNER_TEMP: path.join(tmpDir, 'runner-temp'),
-  RUNNER_TOOL_CACHE: path.join(tmpDir, 'runner-tool-cache')
-}) as {
-  [key: string]: string;
-};
-
-module.exports = {
-  clearMocks: true,
-  testEnvironment: 'node',
-  moduleFileExtensions: ['js', 'ts'],
-  setupFiles: ['dotenv/config'],
-  testMatch: ['**/*.test.ts'],
-  transform: {
-    '^.+\\.ts$': 'ts-jest'
-  },
-  moduleNameMapper: {
-    '^csv-parse/sync': '<rootDir>/node_modules/csv-parse/dist/cjs/sync.cjs'
-  },
-  collectCoverageFrom: ['src/**/{!(main.ts),}.ts'],
-  coveragePathIgnorePatterns: ['lib/', 'node_modules/', '__mocks__/', '__tests__/'],
-  verbose: true
-};

package.json

@@ -1,17 +1,14 @@
 {
   "name": "docker-metadata-action",
   "description": "GitHub Action to extract metadata (tags, labels) for Docker",
-  "main": "lib/main.js",
+  "type": "module",
+  "main": "src/main.ts",
   "scripts": {
-    "build": "ncc build src/main.ts --source-map --minify --license licenses.txt",
-    "lint": "yarn run prettier && yarn run eslint",
-    "format": "yarn run prettier:fix && yarn run eslint:fix",
-    "eslint": "eslint --max-warnings=0 .",
-    "eslint:fix": "eslint --fix .",
-    "prettier": "prettier --check \"./**/*.ts\"",
-    "prettier:fix": "prettier --write \"./**/*.ts\"",
-    "test": "jest",
-    "all": "yarn run build && yarn run format && yarn test"
+    "build": "esbuild src/main.ts --bundle --platform=node --target=node24 --format=cjs --outfile=dist/index.cjs --sourcemap --minify && yarn run license",
+    "lint": "eslint --max-warnings=0 .",
+    "format": "eslint --fix .",
+    "test": "vitest run",
+    "license": "generate-license-file --input package.json --output dist/licenses.txt --overwrite --ci --no-spinner --eol lf"
   },
   "repository": {
     "type": "git",
@@ -26,33 +23,35 @@
   ],
   "author": "Docker Inc.",
   "license": "Apache-2.0",
+  "packageManager": "yarn@4.9.2",
   "dependencies": {
-    "@actions/core": "^1.10.1",
-    "@actions/github": "^6.0.0",
-    "@docker/actions-toolkit": "^0.14.0",
+    "@actions/core": "^3.0.0",
+    "@actions/github": "^9.0.0",
+    "@docker/actions-toolkit": "^0.79.0",
     "@renovate/pep440": "^1.0.0",
-    "csv-parse": "^5.5.2",
+    "csv-parse": "^6.1.0",
     "handlebars": "^4.7.8",
-    "moment": "^2.29.4",
-    "moment-timezone": "^0.5.43",
-    "semver": "^7.5.4"
+    "moment": "^2.30.1",
+    "moment-timezone": "^0.6.1",
+    "semver": "^7.7.4"
   },
   "devDependencies": {
-    "@types/csv-parse": "^1.2.2",
-    "@types/node": "^20.5.9",
-    "@types/semver": "^7.5.1",
-    "@typescript-eslint/eslint-plugin": "^6.6.0",
-    "@typescript-eslint/parser": "^6.6.0",
-    "@vercel/ncc": "^0.38.0",
-    "dotenv": "^16.3.1",
-    "eslint": "^8.48.0",
-    "eslint-config-prettier": "^9.0.0",
-    "eslint-plugin-jest": "^27.2.3",
-    "eslint-plugin-prettier": "^5.0.0",
-    "jest": "^29.6.4",
-    "prettier": "^3.0.3",
-    "ts-jest": "^29.1.1",
-    "ts-node": "^10.9.1",
-    "typescript": "^5.2.2"
+    "@eslint/js": "^9.39.3",
+    "@types/node": "^24.11.0",
+    "@types/semver": "^7.7.1",
+    "@typescript-eslint/eslint-plugin": "^8.56.1",
+    "@typescript-eslint/parser": "^8.56.1",
+    "@vitest/coverage-v8": "^4.0.18",
+    "@vitest/eslint-plugin": "^1.6.9",
+    "dotenv": "^17.3.1",
+    "esbuild": "^0.28.0",
+    "eslint": "^9.39.3",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-prettier": "^5.5.5",
+    "generate-license-file": "^4.1.1",
+    "globals": "^17.3.0",
+    "prettier": "^3.8.1",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.18"
   }
 }

src/context.ts

@@ -1,8 +1,15 @@
 import * as core from '@actions/core';
-import {Context} from '@actions/github/lib/context';
-import {Util} from '@docker/actions-toolkit/lib/util';
-import {Git} from '@docker/actions-toolkit/lib/git';
-import {GitHub} from '@docker/actions-toolkit/lib/github';
+
+import {Util} from '@docker/actions-toolkit/lib/util.js';
+import {Git} from '@docker/actions-toolkit/lib/git.js';
+import {GitHub} from '@docker/actions-toolkit/lib/github/github.js';
+import {Toolkit} from '@docker/actions-toolkit/lib/toolkit.js';
+
+type GithubContext = typeof GitHub.context;
+
+export interface Context extends GithubContext {
+  commitDate: Date;
+}
 
 export interface Inputs {
   context: ContextSource;
@@ -10,8 +17,10 @@ export interface Inputs {
   tags: string[];
   flavor: string[];
   labels: string[];
+  annotations: string[];
   sepTags: string;
   sepLabels: string;
+  sepAnnotations: string;
   bakeTarget: string;
   githubToken: string;
 }
@@ -19,12 +28,14 @@ export interface Inputs {
 export function getInputs(): Inputs {
   return {
     context: (core.getInput('context') || ContextSource.workflow) as ContextSource,
-    images: Util.getInputList('images', {ignoreComma: true, comment: '#'}),
-    tags: Util.getInputList('tags', {ignoreComma: true, comment: '#'}),
-    flavor: Util.getInputList('flavor', {ignoreComma: true, comment: '#'}),
-    labels: Util.getInputList('labels', {ignoreComma: true, comment: '#'}),
+    images: Util.getInputList('images', {ignoreComma: true, comment: '#', commentNoInfix: true}),
+    tags: Util.getInputList('tags', {ignoreComma: true, comment: '#', commentNoInfix: true}),
+    flavor: Util.getInputList('flavor', {ignoreComma: true, comment: '#', commentNoInfix: true}),
+    labels: Util.getInputList('labels', {ignoreComma: true, comment: '#', commentNoInfix: true}),
+    annotations: Util.getInputList('annotations', {ignoreComma: true, comment: '#', commentNoInfix: true}),
     sepTags: core.getInput('sep-tags', {trimWhitespace: false}) || `\n`,
     sepLabels: core.getInput('sep-labels', {trimWhitespace: false}) || `\n`,
+    sepAnnotations: core.getInput('sep-annotations', {trimWhitespace: false}) || `\n`,
     bakeTarget: core.getInput('bake-target') || `docker-metadata-action`,
     githubToken: core.getInput('github-token')
   };
@@ -35,10 +46,10 @@ export enum ContextSource {
   git = 'git'
 }
 
-export async function getContext(source: ContextSource): Promise<Context> {
+export async function getContext(source: ContextSource, toolkit: Toolkit): Promise<Context> {
   switch (source) {
     case ContextSource.workflow:
-      return getContextFromWorkflow();
+      return await getContextFromWorkflow(toolkit);
     case ContextSource.git:
       return await getContextFromGit();
     default:
@@ -46,7 +57,7 @@ export async function getContext(source: ContextSource): Promise<Context> {
   }
 }
 
-function getContextFromWorkflow(): Context {
+async function getContextFromWorkflow(toolkit: Toolkit): Promise<Context> {
   const context = GitHub.context;
 
   // Needs to override Git reference with pr ref instead of upstream branch ref
@@ -65,9 +76,63 @@ function getContextFromWorkflow(): Context {
     }
   }
 
-  return context;
+  return {
+    commitDate: await getCommitDateFromWorkflow(context.sha, toolkit),
+    ...context
+  } as Context;
 }
 
 async function getContextFromGit(): Promise<Context> {
-  return await Git.context();
+  const ctx = await Git.context();
+
+  return {
+    commitDate: await Git.commitDate(ctx.sha),
+    ...ctx
+  } as Context;
+}
+
+async function getCommitDateFromWorkflow(sha: string, toolkit: Toolkit): Promise<Date> {
+  const event = GitHub.context.payload as unknown as {
+    // branch push
+    commits?: Array<{
+      timestamp: string;
+      // commit sha
+      id: string;
+    }>;
+    // tags
+    head_commit?: {
+      timestamp: string;
+      // commit sha
+      id: string;
+    };
+  };
+
+  if (event.commits) {
+    const commitDate = event.commits.find(x => x.id === sha)?.timestamp;
+    if (commitDate) {
+      return new Date(commitDate);
+    }
+  }
+
+  if (event.head_commit) {
+    if (event.head_commit.id === sha) {
+      return new Date(event.head_commit.timestamp);
+    }
+  }
+
+  // fallback to github api for commit date
+  try {
+    const commit = await toolkit.github.octokit.rest.repos.getCommit({
+      owner: GitHub.context.repo.owner,
+      repo: GitHub.context.repo.repo,
+      ref: sha
+    });
+    if (commit.data.commit.committer?.date) {
+      return new Date(commit.data.commit.committer.date);
+    }
+    throw new Error('Committer date not found');
+  } catch (error) {
+    core.debug(`Failed to get commit date from GitHub API: ${error.message}`);
+    return new Date();
+  }
 }

src/main.ts

@@ -1,23 +1,20 @@
 import * as fs from 'fs';
 import * as core from '@actions/core';
 import * as actionsToolkit from '@docker/actions-toolkit';
-import {Toolkit} from '@docker/actions-toolkit/lib/toolkit';
+import {Toolkit} from '@docker/actions-toolkit/lib/toolkit.js';
+import {Util} from '@docker/actions-toolkit/lib/util.js';
 
-import {getContext, getInputs, Inputs} from './context';
-import {Meta, Version} from './meta';
-
-function setOutput(name: string, value: string) {
-  core.setOutput(name, value);
-  core.exportVariable(`DOCKER_METADATA_OUTPUT_${name.replace(/\W/g, '_').toUpperCase()}`, value);
-}
+import {getContext, getInputs, Inputs} from './context.js';
+import {Meta, Version} from './meta.js';
 
 actionsToolkit.run(
   // main
   async () => {
     const inputs: Inputs = getInputs();
     const toolkit = new Toolkit({githubToken: inputs.githubToken});
-    const context = await getContext(inputs.context);
+    const context = await getContext(inputs.context, toolkit);
     const repo = await toolkit.github.repoData();
+    const setOutput = outputEnvEnabled() ? setOutputAndEnv : core.setOutput;
 
     await core.group(`Context info`, async () => {
       core.info(`eventName: ${context.eventName}`);
@@ -28,6 +25,7 @@ actionsToolkit.run(
       core.info(`actor: ${context.actor}`);
       core.info(`runNumber: ${context.runNumber}`);
       core.info(`runId: ${context.runId}`);
+      core.info(`commitDate: ${context.commitDate}`);
     });
 
     if (core.isDebug()) {
@@ -49,7 +47,7 @@ actionsToolkit.run(
     setOutput('version', version.main || '');
 
     // Docker tags
-    const tags: Array<string> = meta.getTags();
+    const tags = meta.getTags();
     if (tags.length == 0) {
       core.warning('No Docker tag has been generated. Check tags input.');
     } else {
@@ -60,6 +58,7 @@ actionsToolkit.run(
       });
     }
     setOutput('tags', tags.join(inputs.sepTags));
+    setOutput('tag-names', meta.getTags(true).join(inputs.sepTags));
 
     // Docker labels
     const labels: Array<string> = meta.getLabels();
@@ -71,32 +70,31 @@ actionsToolkit.run(
     });
 
     // Annotations
-    const alevels = process.env.DOCKER_METADATA_ANNOTATIONS_LEVELS || 'manifest';
-    if (labels.length > 0) {
-      await core.group(`Annotations`, async () => {
-        const annotations: Array<string> = [];
-        for (const level of alevels.split(',')) {
-          annotations.push(
-            ...labels.map(label => {
-              const v = `${level}:${label}`;
-              core.info(v);
-              return v;
-            })
-          );
-        }
-        setOutput(`annotations`, annotations.join(inputs.sepLabels));
-      });
-    }
+    const annotationsRaw: Array<string> = meta.getAnnotations();
+    const annotationsLevels = process.env.DOCKER_METADATA_ANNOTATIONS_LEVELS || 'manifest';
+    await core.group(`Annotations`, async () => {
+      const annotations: Array<string> = [];
+      for (const level of annotationsLevels.split(',')) {
+        annotations.push(
+          ...annotationsRaw.map(label => {
+            const v = `${level}:${label}`;
+            core.info(v);
+            return v;
+          })
+        );
+      }
+      setOutput(`annotations`, annotations.join(inputs.sepAnnotations));
+    });
 
     // JSON
-    const jsonOutput = meta.getJSON(alevels.split(','));
+    const jsonOutput = meta.getJSON(annotationsLevels.split(','));
     await core.group(`JSON output`, async () => {
       core.info(JSON.stringify(jsonOutput, null, 2));
       setOutput('json', JSON.stringify(jsonOutput));
     });
 
     // Bake files
-    for (const kind of ['tags', 'labels', 'annotations:' + alevels]) {
+    for (const kind of ['tags', 'labels', 'annotations:' + annotationsLevels]) {
       const outputName = kind.split(':')[0];
       const bakeFile: string = meta.getBakeFile(kind);
       await core.group(`Bake file definition (${outputName})`, async () => {
@@ -106,6 +104,18 @@ actionsToolkit.run(
     }
 
     // Bake file with tags and labels
-    setOutput(`bake-file`, meta.getBakeFileTagsLabels());
+    setOutput(`bake-file`, `${meta.getBakeFileTagsLabels()}`);
   }
 );
+
+function setOutputAndEnv(name: string, value: string) {
+  core.setOutput(name, value);
+  core.exportVariable(`DOCKER_METADATA_OUTPUT_${name.replace(/\W/g, '_').toUpperCase()}`, value);
+}
+
+function outputEnvEnabled(): boolean {
+  if (process.env.DOCKER_METADATA_SET_OUTPUT_ENV) {
+    return Util.parseBool(process.env.DOCKER_METADATA_SET_OUTPUT_ENV);
+  }
+  return true;
+}

src/meta.ts

@@ -5,14 +5,15 @@ import moment from 'moment-timezone';
 import * as pep440 from '@renovate/pep440';
 import * as semver from 'semver';
 import * as core from '@actions/core';
-import {Context} from '@actions/github/lib/context';
-import {Context as ToolkitContext} from '@docker/actions-toolkit/lib/context';
-import {GitHubRepo} from '@docker/actions-toolkit/lib/types/github';
+import {Context as ToolkitContext} from '@docker/actions-toolkit/lib/context.js';
+import {GitHubRepo} from '@docker/actions-toolkit/lib/types/github/github.js';
 
-import {Inputs} from './context';
-import * as icl from './image';
-import * as tcl from './tag';
-import * as fcl from './flavor';
+import {Inputs, Context} from './context.js';
+import * as icl from './image.js';
+import * as tcl from './tag.js';
+import * as fcl from './flavor.js';
+
+const defaultShortShaLength = 7;
 
 export interface Version {
   main: string | undefined;
@@ -113,6 +114,7 @@ export class Meta {
     }
 
     const currentDate = this.date;
+    const commitDate = this.context.commitDate;
     const vraw = this.setValue(
       handlebars.compile(tag.attrs['pattern'])({
         date: function (format, options) {
@@ -128,6 +130,20 @@ export class Meta {
             }
           });
           return m.tz(tz).format(format);
+        },
+        commit_date: function (format, options) {
+          const m = moment(commitDate);
+          let tz = 'UTC';
+          Object.keys(options.hash).forEach(key => {
+            switch (key) {
+              case 'tz':
+                tz = options.hash[key];
+                break;
+              default:
+                throw new Error(`Unknown ${key} attribute`);
+            }
+          });
+          return m.tz(tz).format(format);
         }
       }),
       tag
@@ -145,8 +161,20 @@ export class Meta {
     if (tag.attrs['value'].length > 0) {
       vraw = this.setGlobalExp(tag.attrs['value']);
     } else {
-      vraw = this.context.ref.replace(/^refs\/tags\//g, '').replace(/\//g, '-');
+      vraw = this.context.ref.replace(/^refs\/tags\//g, '');
     }
+
+    if (tag.attrs['match'].length > 0) {
+      const tmatch = vraw.match(tag.attrs['match']);
+      if (!tmatch) {
+        core.warning(`${tag.attrs['match']} does not match ${vraw}.`);
+      } else {
+        vraw = tmatch[1];
+      }
+    }
+
+    vraw = vraw.replace(/\//g, '-');
+
     if (!semver.valid(vraw)) {
       core.warning(`${vraw} is not a valid semver. More info: https://semver.org/`);
       return version;
@@ -179,8 +207,20 @@ export class Meta {
     if (tag.attrs['value'].length > 0) {
       vraw = this.setGlobalExp(tag.attrs['value']);
     } else {
-      vraw = this.context.ref.replace(/^refs\/tags\//g, '').replace(/\//g, '-');
+      vraw = this.context.ref.replace(/^refs\/tags\//g, '');
     }
+
+    if (tag.attrs['match'].length > 0) {
+      const tmatch = vraw.match(tag.attrs['match']);
+      if (!tmatch) {
+        core.warning(`${tag.attrs['match']} does not match ${vraw}.`);
+      } else {
+        vraw = tmatch[1];
+      }
+    }
+
+    vraw = vraw.replace(/\//g, '-');
+
     if (!pep440.valid(vraw)) {
       core.warning(`${vraw} does not conform to PEP 440. More info: https://www.python.org/dev/peps/pep-0440`);
       return version;
@@ -307,7 +347,7 @@ export class Meta {
 
     let val = this.context.sha;
     if (tag.attrs['format'] === tcl.ShaFormat.Short) {
-      val = this.context.sha.substring(0, 7);
+      val = Meta.shortSha(this.context.sha);
     }
 
     const vraw = this.setValue(val, tag);
@@ -336,7 +376,7 @@ export class Meta {
       if (hp.body.length == 1 && hp.body[0].type == 'MustacheStatement') {
         return hp.body[0]['path']['parts'].length == 1 && hp.body[0]['path']['parts'][0] == 'raw';
       }
-    } catch (err) {
+    } catch {
       return false;
     }
     return false;
@@ -356,9 +396,10 @@ export class Meta {
     return val;
   }
 
-  private setGlobalExp(val): string {
+  private setGlobalExp(val: string): string {
     const context = this.context;
     const currentDate = this.date;
+    const commitDate = this.context.commitDate;
     return handlebars.compile(val)({
       branch: function () {
         if (!/^refs\/heads\//.test(context.ref)) {
@@ -373,7 +414,7 @@ export class Meta {
         return context.ref.replace(/^refs\/tags\//g, '');
       },
       sha: function () {
-        return context.sha.substring(0, 7);
+        return Meta.shortSha(context.sha);
       },
       base_ref: function () {
         if (/^refs\/tags\//.test(context.ref) && context.payload?.base_ref != undefined) {
@@ -386,6 +427,20 @@ export class Meta {
         }
         return '';
       },
+      commit_date: function (format, options) {
+        const m = moment(commitDate);
+        let tz = 'UTC';
+        Object.keys(options.hash).forEach(key => {
+          switch (key) {
+            case 'tz':
+              tz = options.hash[key];
+              break;
+            default:
+              throw new Error(`Unknown ${key} attribute`);
+          }
+        });
+        return m.tz(tz).format(format);
+      },
       is_default_branch: function () {
         const branch = context.ref.replace(/^refs\/heads\//g, '');
         // TODO: "base_ref" is available in the push payload but doesn't always seem to
@@ -408,6 +463,9 @@ export class Meta {
         }
         return 'false';
       },
+      is_not_default_branch: function () {
+        return this.is_default_branch() === 'false' ? 'true' : 'false';
+      },
       date: function (format, options) {
         const m = moment(currentDate);
         let tz = 'UTC';
@@ -436,39 +494,51 @@ export class Meta {
     return images;
   }
 
-  public getTags(): Array<string> {
+  public getTags(namesOnly?: boolean): Array<string> {
     if (!this.version.main) {
       return [];
     }
-
-    const generateTags = (imageName: string, version: string): Array<string> => {
-      const tags: Array<string> = [];
-      const prefix = imageName !== '' ? `${imageName}:` : '';
-      tags.push(`${prefix}${version}`);
-      for (const partial of this.version.partial) {
-        tags.push(`${prefix}${partial}`);
-      }
-      if (this.version.latest) {
-        const latestTag = `${this.flavor.prefixLatest ? this.flavor.prefix : ''}latest${this.flavor.suffixLatest ? this.flavor.suffix : ''}`;
-        tags.push(`${prefix}${Meta.sanitizeTag(latestTag)}`);
-      }
-      return tags;
-    };
+    if (namesOnly) {
+      return this.generateTags(this.version.main);
+    }
 
     const tags: Array<string> = [];
     const images = this.getImageNames();
     if (images.length > 0) {
       for (const imageName of images) {
-        tags.push(...generateTags(imageName, this.version.main));
+        tags.push(...this.generateTags(this.version.main, imageName));
       }
     } else {
-      tags.push(...generateTags('', this.version.main));
+      tags.push(...this.generateTags(this.version.main));
+    }
+
+    return tags;
+  }
+
+  private generateTags(version: string, imageName?: string): Array<string> {
+    const tags: Array<string> = [];
+    const prefix = imageName ? `${imageName}:` : '';
+    tags.push(`${prefix}${version}`);
+    for (const partial of this.version.partial) {
+      tags.push(`${prefix}${partial}`);
+    }
+    if (this.version.latest) {
+      const latestTag = `${this.flavor.prefixLatest ? this.flavor.prefix : ''}latest${this.flavor.suffixLatest ? this.flavor.suffix : ''}`;
+      tags.push(`${prefix}${Meta.sanitizeTag(latestTag)}`);
     }
     return tags;
   }
 
   public getLabels(): Array<string> {
-    const labels: Array<string> = [
+    return this.getOCIAnnotationsWithCustoms(this.inputs.labels);
+  }
+
+  public getAnnotations(): Array<string> {
+    return this.getOCIAnnotationsWithCustoms(this.inputs.annotations);
+  }
+
+  private getOCIAnnotationsWithCustoms(extra: string[]): Array<string> {
+    const res: Array<string> = [
       `org.opencontainers.image.title=${this.repo.name || ''}`,
       `org.opencontainers.image.description=${this.repo.description || ''}`,
       `org.opencontainers.image.url=${this.repo.html_url || ''}`,
@@ -478,11 +548,13 @@ export class Meta {
       `org.opencontainers.image.revision=${this.context.sha || ''}`,
       `org.opencontainers.image.licenses=${this.repo.license?.spdx_id || ''}`
     ];
-    labels.push(...this.inputs.labels);
+    extra.forEach(label => {
+      res.push(this.setGlobalExp(label));
+    });
 
     return Array.from(
       new Map<string, string>(
-        labels
+        res
           .map(label => label.split('='))
           // eslint-disable-next-line @typescript-eslint/no-unused-vars
           .filter(([_key, ...values]) => values.length > 0)
@@ -496,10 +568,11 @@ export class Meta {
   public getJSON(alevels: string[]): unknown {
     const annotations: Array<string> = [];
     for (const level of alevels) {
-      annotations.push(...this.getLabels().map(label => `${level}:${label}`));
+      annotations.push(...this.getAnnotations().map(label => `${level}:${label}`));
     }
     return {
       tags: this.getTags(),
+      'tag-names': this.getTags(true),
       labels: this.getLabels().reduce((res, label) => {
         const matches = label.match(/([^=]*)=(.*)/);
         if (!matches) {
@@ -514,70 +587,66 @@ export class Meta {
 
   public getBakeFile(kind: string): string {
     if (kind == 'tags') {
-      return this.generateBakeFile(kind, {
-        tags: this.getTags(),
-        args: {
-          DOCKER_META_IMAGES: this.getImageNames().join(','),
-          DOCKER_META_VERSION: this.version.main
-        }
-      });
-    } else if (kind == 'labels') {
-      return this.generateBakeFile(kind, {
-        labels: this.getLabels().reduce((res, label) => {
-          const matches = label.match(/([^=]*)=(.*)/);
-          if (!matches) {
-            return res;
+      return this.generateBakeFile(
+        {
+          tags: this.getTags(),
+          args: {
+            DOCKER_META_IMAGES: this.getImageNames().join(','),
+            DOCKER_META_VERSION: this.version.main
           }
-          res[matches[1]] = matches[2];
-          return res;
-        }, {})
-      });
+        },
+        kind
+      );
+    } else if (kind == 'labels') {
+      return this.generateBakeFile(
+        {
+          labels: this.getLabels().reduce((res, label) => {
+            const matches = label.match(/([^=]*)=(.*)/);
+            if (!matches) {
+              return res;
+            }
+            res[matches[1]] = matches[2];
+            return res;
+          }, {})
+        },
+        kind
+      );
     } else if (kind.startsWith('annotations:')) {
       const name = kind.split(':')[0];
       const annotations: Array<string> = [];
       for (const level of kind.split(':')[1].split(',')) {
-        annotations.push(...this.getLabels().map(label => `${level}:${label}`));
+        annotations.push(...this.getAnnotations().map(label => `${level}:${label}`));
       }
-      return this.generateBakeFile(name, {
-        annotations: annotations
-      });
+      return this.generateBakeFile(
+        {
+          annotations: annotations
+        },
+        name
+      );
     }
     throw new Error(`Unknown bake file type: ${kind}`);
   }
 
   public getBakeFileTagsLabels(): string {
-    const bakeFile = path.join(ToolkitContext.tmpDir(), 'docker-metadata-action-bake.json');
-    fs.writeFileSync(
-      bakeFile,
-      JSON.stringify(
-        {
-          target: {
-            [this.inputs.bakeTarget]: {
-              tags: this.getTags(),
-              labels: this.getLabels().reduce((res, label) => {
-                const matches = label.match(/([^=]*)=(.*)/);
-                if (!matches) {
-                  return res;
-                }
-                res[matches[1]] = matches[2];
-                return res;
-              }, {}),
-              args: {
-                DOCKER_META_IMAGES: this.getImageNames().join(','),
-                DOCKER_META_VERSION: this.version.main
-              }
-            }
-          }
-        },
-        null,
-        2
-      )
-    );
-    return bakeFile;
+    return this.generateBakeFile({
+      tags: this.getTags(),
+      labels: this.getLabels().reduce((res, label) => {
+        const matches = label.match(/([^=]*)=(.*)/);
+        if (!matches) {
+          return res;
+        }
+        res[matches[1]] = matches[2];
+        return res;
+      }, {}),
+      args: {
+        DOCKER_META_IMAGES: this.getImageNames().join(','),
+        DOCKER_META_VERSION: this.version.main
+      }
+    });
   }
 
-  private generateBakeFile(name: string, dt): string {
-    const bakeFile = path.join(ToolkitContext.tmpDir(), `docker-metadata-action-bake-${name}.json`);
+  private generateBakeFile(dt, suffix?: string): string {
+    const bakeFile = path.join(ToolkitContext.tmpDir(), `docker-metadata-action-bake${suffix ? `-${suffix}` : ''}.json`);
     fs.writeFileSync(bakeFile, JSON.stringify({target: {[this.inputs.bakeTarget]: dt}}, null, 2));
     return bakeFile;
   }
@@ -589,4 +658,18 @@ export class Meta {
   private static sanitizeTag(tag: string): string {
     return tag.replace(/[^a-zA-Z0-9._-]+/g, '-');
   }
+
+  private static shortSha(sha: string): string {
+    let shortShaLength = defaultShortShaLength;
+    if (process.env.DOCKER_METADATA_SHORT_SHA_LENGTH) {
+      if (isNaN(Number(process.env.DOCKER_METADATA_SHORT_SHA_LENGTH))) {
+        throw new Error(`DOCKER_METADATA_SHORT_SHA_LENGTH is not a valid number: ${process.env.DOCKER_METADATA_SHORT_SHA_LENGTH}`);
+      }
+      shortShaLength = Number(process.env.DOCKER_METADATA_SHORT_SHA_LENGTH);
+    }
+    if (shortShaLength >= sha.length) {
+      return sha;
+    }
+    return sha.substring(0, shortShaLength);
+  }
 }

src/tag.ts

@@ -104,10 +104,10 @@ export function Parse(s: string): Tag {
       const value = parts[1];
       switch (key) {
         case 'type': {
-          if (!Object.values(Type).includes(value)) {
+          if (!Object.values(Type).includes(value as Type)) {
             throw new Error(`Unknown tag type attribute: ${value}`);
           }
-          tag.type = value;
+          tag.type = value as Type;
           break;
         }
         default: {
@@ -137,6 +137,9 @@ export function Parse(s: string): Tag {
       if (!Object.prototype.hasOwnProperty.call(tag.attrs, 'value')) {
         tag.attrs['value'] = '';
       }
+      if (!Object.prototype.hasOwnProperty.call(tag.attrs, 'match')) {
+        tag.attrs['match'] = '';
+      }
       break;
     }
     case Type.Match: {

test/output.Dockerfile

@@ -4,9 +4,11 @@ RUN apk add --no-cache coreutils jq
 ARG DOCKER_METADATA_OUTPUT_VERSION
 ARG DOCKER_METADATA_OUTPUT_TAGS
 ARG DOCKER_METADATA_OUTPUT_LABELS
+ARG DOCKER_METADATA_OUTPUT_ANNOTATIONS
 ARG DOCKER_METADATA_OUTPUT_JSON
 RUN printenv DOCKER_METADATA_OUTPUT_VERSION
 RUN printenv DOCKER_METADATA_OUTPUT_TAGS
 RUN printenv DOCKER_METADATA_OUTPUT_LABELS
+RUN printenv DOCKER_METADATA_OUTPUT_ANNOTATIONS
 RUN printenv DOCKER_METADATA_OUTPUT_JSON
 RUN echo $DOCKER_METADATA_OUTPUT_JSON | jq

tsconfig.json

@@ -1,9 +1,8 @@
 {
   "compilerOptions": {
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
     "esModuleInterop": true,
-    "target": "es6",
-    "module": "commonjs",
-    "strict": true,
     "newLine": "lf",
     "outDir": "./lib",
     "rootDir": "./src",
@@ -12,11 +11,7 @@
     "resolveJsonModule": true,
     "useUnknownInCatchVariables": false,
   },
-  "exclude": [
-    "./__mocks__/**/*",
-    "./__tests__/**/*",
-    "./lib/**/*",
-    "node_modules",
-    "jest.config.ts"
+  "include": [
+    "src/**/*.ts"
   ]
 }

vitest.config.ts

@@ -0,0 +1,16 @@
+import {defineConfig} from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    clearMocks: true,
+    environment: 'node',
+    setupFiles: ['./__tests__/setup.unit.ts'],
+    include: ['**/*.test.ts'],
+    coverage: {
+      provider: 'v8',
+      reporter: ['clover'],
+      include: ['src/**/*.ts'],
+      exclude: ['src/**/main.ts']
+    }
+  }
+});