Merge pull request #809 from crazy-max/git-query-url

build: git context query format support

.eslintignore

@@ -1,4 +0,0 @@
-/.yarn/**
-/lib/**
-/coverage/**
-/node_modules/**

.eslintrc.json

@@ -1,36 +0,0 @@
-{
-  "env": {
-    "node": true,
-    "es6": true,
-    "mocha": true,
-    "jest": true
-  },
-  "extends": [
-    "eslint:recommended",
-    "plugin:@typescript-eslint/eslint-recommended",
-    "plugin:@typescript-eslint/recommended",
-    "plugin:import/errors",
-    "plugin:import/typescript", // this is needed to allow importing typescript files from JS
-    "plugin:import/warnings",
-    "plugin:jest/recommended",
-    "plugin:prettier/recommended"
-  ],
-  "parser": "@typescript-eslint/parser",
-  "parserOptions": {
-    "ecmaVersion": 2023,
-    "sourceType": "module"
-  },
-  "plugins": [
-    "@typescript-eslint",
-    "jest",
-    "prettier"
-  ],
-  "rules": {
-    "import/no-unresolved": [
-      "error", {
-        "ignore": ["csv-parse/sync", "@octokit/openapi-types"]
-      }
-    ],
-    "jest/no-disabled-tests": 0
-  }
-}

.github/actions/macos-setup-qemu/action.yml

@@ -1,17 +0,0 @@
-name: 'Setup QEMU on macOS'
-description: 'Set up QEMU on macOS runners'
-
-# FIXME: Remove this composite once QEMU issue is fixed on macOS runners
-#  https://github.com/docker/actions-toolkit/issues/455
-
-runs:
-  using: composite
-  steps:
-    - run: |
-        set -ex
-        brew uninstall --ignore-dependencies qemu || true
-        brew autoremove || true
-        curl -o /tmp/qemu.rb https://raw.githubusercontent.com/Homebrew/homebrew-core/f1a9cf104a9a51779c7a532b658c490f69974839/Formula/q/qemu.rb
-        brew install /tmp/qemu.rb
-      continue-on-error: true
-      shell: bash

.github/dependabot.yml

@@ -1,6 +1,7 @@
 version: 2
 updates:
   - package-ecosystem: "github-actions"
+    open-pull-requests-limit: 20
     directory: "/"
     schedule:
       interval: "daily"
@@ -8,16 +9,13 @@ updates:
       - "dependencies"
       - "bot"
   - package-ecosystem: "npm"
+    open-pull-requests-limit: 20
     directory: "/"
     schedule:
       interval: "daily"
     versioning-strategy: "increase"
     allow:
       - dependency-type: "production"
-    ignore:
-      - # we want to match the same version as the one used by @actions/artifact
-        # https://github.com/actions/toolkit/blob/ae38557bb0dba824cdda26ce787bd6b66cf07a83/packages/artifact/package.json#L46
-        dependency-name: "@azure/storage-blob"
     labels:
       - "dependencies"
       - "bot"

.github/docker-releases.json

@@ -1,8 +1,428 @@
 {
   "latest": {
-    "id": 176167883,
-    "tag_name": "v27.3.1",
-    "html_url": "https://github.com/moby/moby/releases/tag/v27.3.1",
+    "id": 293527283,
+    "tag_name": "docker-v29.3.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.3.0",
+    "assets": []
+  },
+  "v29.3.0": {
+    "id": 293527283,
+    "tag_name": "docker-v29.3.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.3.0",
+    "assets": []
+  },
+  "edge": {
+    "id": 293527283,
+    "tag_name": "docker-v29.3.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.3.0",
+    "assets": []
+  },
+  "v29.3.0-rc.1": {
+    "id": 291481223,
+    "tag_name": "docker-v29.3.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.3.0-rc.1",
+    "assets": []
+  },
+  "v29.2.1": {
+    "id": 282275652,
+    "tag_name": "docker-v29.2.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.2.1",
+    "assets": []
+  },
+  "v29.2.0": {
+    "id": 280041206,
+    "tag_name": "docker-v29.2.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.2.0",
+    "assets": []
+  },
+  "v29.2.0-rc.2": {
+    "id": 277933908,
+    "tag_name": "docker-v29.2.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.2.0-rc.2",
+    "assets": []
+  },
+  "v29.1.5": {
+    "id": 277389559,
+    "tag_name": "docker-v29.1.5",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.1.5",
+    "assets": []
+  },
+  "v29.1.4": {
+    "id": 275290406,
+    "tag_name": "docker-v29.1.4",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.1.4",
+    "assets": []
+  },
+  "v29.2.0-rc.1": {
+    "id": 271147963,
+    "tag_name": "docker-v29.2.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.2.0-rc.1",
+    "assets": []
+  },
+  "v29.1.3": {
+    "id": 269884470,
+    "tag_name": "docker-v29.1.3",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.1.3",
+    "assets": []
+  },
+  "v29.1.2": {
+    "id": 266898070,
+    "tag_name": "docker-v29.1.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.1.2",
+    "assets": []
+  },
+  "v29.1.1": {
+    "id": 265971746,
+    "tag_name": "docker-v29.1.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.1.1",
+    "assets": []
+  },
+  "v29.1.0": {
+    "id": 265770897,
+    "tag_name": "docker-v29.1.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.1.0",
+    "assets": []
+  },
+  "v29.0.4": {
+    "id": 264940208,
+    "tag_name": "docker-v29.0.4",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.0.4",
+    "assets": []
+  },
+  "v29.0.3": {
+    "id": 264058657,
+    "tag_name": "docker-v29.0.3",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.0.3",
+    "assets": []
+  },
+  "v29.0.2": {
+    "id": 262951416,
+    "tag_name": "docker-v29.0.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.0.2",
+    "assets": []
+  },
+  "v29.1.0-rc.1": {
+    "id": 263125085,
+    "tag_name": "docker-v29.1.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.1.0-rc.1",
+    "assets": []
+  },
+  "v29.0.1": {
+    "id": 262245944,
+    "tag_name": "docker-v29.0.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.0.1",
+    "assets": []
+  },
+  "v29.0.0": {
+    "id": 261265152,
+    "tag_name": "docker-v29.0.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.0.0",
+    "assets": []
+  },
+  "v29.0.0-rc.3": {
+    "id": 260452080,
+    "tag_name": "docker-v29.0.0-rc.3",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.0.0-rc.3",
+    "assets": []
+  },
+  "v28.5.2": {
+    "id": 259852183,
+    "tag_name": "v28.5.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.5.2",
+    "assets": []
+  },
+  "v29.0.0-rc.2": {
+    "id": 258289954,
+    "tag_name": "docker-v29.0.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.0.0-rc.2",
+    "assets": []
+  },
+  "v29.0.0-rc.1": {
+    "id": 252020476,
+    "tag_name": "docker-v29.0.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/docker-v29.0.0-rc.1",
+    "assets": []
+  },
+  "v28.5.1": {
+    "id": 252833798,
+    "tag_name": "v28.5.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.5.1",
+    "assets": []
+  },
+  "v28.5.0": {
+    "id": 251798390,
+    "tag_name": "v28.5.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.5.0",
+    "assets": []
+  },
+  "v28.5.0-rc.1": {
+    "id": 249763924,
+    "tag_name": "v28.5.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.5.0-rc.1",
+    "assets": []
+  },
+  "v28.4.0": {
+    "id": 244504005,
+    "tag_name": "v28.4.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.4.0",
+    "assets": []
+  },
+  "v28.4.0-rc.2": {
+    "id": 244065281,
+    "tag_name": "v28.4.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.4.0-rc.2",
+    "assets": []
+  },
+  "v28.4.0-rc.1": {
+    "id": 243821467,
+    "tag_name": "v28.4.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.4.0-rc.1",
+    "assets": []
+  },
+  "v25.0.13": {
+    "id": 244806783,
+    "tag_name": "v25.0.13",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.13",
+    "assets": []
+  },
+  "v28.3.3": {
+    "id": 235196329,
+    "tag_name": "v28.3.3",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.3",
+    "assets": []
+  },
+  "v25.0.12": {
+    "id": 232634573,
+    "tag_name": "v25.0.12",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.12",
+    "assets": []
+  },
+  "v28.3.2": {
+    "id": 231184033,
+    "tag_name": "v28.3.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.2",
+    "assets": []
+  },
+  "v28.3.1": {
+    "id": 229534501,
+    "tag_name": "v28.3.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.1",
+    "assets": []
+  },
+  "v28.3.0": {
+    "id": 227302240,
+    "tag_name": "v28.3.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.0",
+    "assets": []
+  },
+  "v28.3.0-rc.2": {
+    "id": 226745561,
+    "tag_name": "v28.3.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.0-rc.2",
+    "assets": []
+  },
+  "v25.0.11": {
+    "id": 226304708,
+    "tag_name": "v25.0.11",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.11",
+    "assets": []
+  },
+  "v28.3.0-rc.1": {
+    "id": 225132759,
+    "tag_name": "v28.3.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.3.0-rc.1",
+    "assets": []
+  },
+  "v28.2.2": {
+    "id": 222034216,
+    "tag_name": "v28.2.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.2.2",
+    "assets": []
+  },
+  "v28.2.1": {
+    "id": 221664376,
+    "tag_name": "v28.2.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.2.1",
+    "assets": []
+  },
+  "v28.2.0": {
+    "id": 221225663,
+    "tag_name": "v28.2.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.2.0",
+    "assets": []
+  },
+  "v28.2.0-rc.2": {
+    "id": 220155575,
+    "tag_name": "v28.2.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.2.0-rc.2",
+    "assets": []
+  },
+  "v28.2.0-rc.1": {
+    "id": 218898330,
+    "tag_name": "v28.2.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.2.0-rc.1",
+    "assets": []
+  },
+  "v25.0.10": {
+    "id": 218958962,
+    "tag_name": "v25.0.10",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.10",
+    "assets": []
+  },
+  "v25.0.9": {
+    "id": 218957753,
+    "tag_name": "v25.0.9",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.9",
+    "assets": []
+  },
+  "v23.0.18": {
+    "id": 218962082,
+    "tag_name": "v23.0.18",
+    "html_url": "https://github.com/moby/moby/releases/tag/v23.0.18",
+    "assets": []
+  },
+  "v23.0.17": {
+    "id": 218961915,
+    "tag_name": "v23.0.17",
+    "html_url": "https://github.com/moby/moby/releases/tag/v23.0.17",
+    "assets": []
+  },
+  "v28.1.1": {
+    "id": 213296967,
+    "tag_name": "v28.1.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.1.1",
+    "assets": []
+  },
+  "v28.1.0": {
+    "id": 213053128,
+    "tag_name": "v28.1.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.1.0",
+    "assets": []
+  },
+  "v28.1.0-rc.2": {
+    "id": 212786864,
+    "tag_name": "v28.1.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.1.0-rc.2",
+    "assets": []
+  },
+  "v28.1.0-rc.1": {
+    "id": 211865941,
+    "tag_name": "v28.1.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.1.0-rc.1",
+    "assets": []
+  },
+  "v28.0.4": {
+    "id": 208163246,
+    "tag_name": "v28.0.4",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.4",
+    "assets": []
+  },
+  "v28.0.3": {
+    "id": 208121902,
+    "tag_name": "v28.0.3",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.3",
+    "assets": []
+  },
+  "v28.0.2": {
+    "id": 205678192,
+    "tag_name": "v28.0.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.2",
+    "assets": []
+  },
+  "v28.0.1": {
+    "id": 202550735,
+    "tag_name": "v28.0.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.1",
+    "assets": []
+  },
+  "v28.0.0": {
+    "id": 201152110,
+    "tag_name": "v28.0.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.0",
+    "assets": []
+  },
+  "v28.0.0-rc.3": {
+    "id": 201046359,
+    "tag_name": "v28.0.0-rc.3",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.0-rc.3",
+    "assets": []
+  },
+  "v28.0.0-rc.2": {
+    "id": 200732563,
+    "tag_name": "v28.0.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.0-rc.2",
+    "assets": []
+  },
+  "v28.0.0-rc.1": {
+    "id": 198950838,
+    "tag_name": "v28.0.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v28.0.0-rc.1",
+    "assets": []
+  },
+  "v25.0.8": {
+    "id": 198023936,
+    "tag_name": "v25.0.8",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.8",
+    "assets": []
+  },
+  "v27.5.1": {
+    "id": 196137348,
+    "tag_name": "v27.5.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v27.5.1",
+    "assets": []
+  },
+  "v27.5.0": {
+    "id": 194138446,
+    "tag_name": "v27.5.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v27.5.0",
+    "assets": []
+  },
+  "v27.5.0-rc.2": {
+    "id": 193567140,
+    "tag_name": "v27.5.0-rc.2",
+    "html_url": "https://github.com/moby/moby/releases/tag/v27.5.0-rc.2",
+    "assets": []
+  },
+  "v27.5.0-rc.1": {
+    "id": 192090825,
+    "tag_name": "v27.5.0-rc.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v27.5.0-rc.1",
+    "assets": []
+  },
+  "v27.4.1": {
+    "id": 190678909,
+    "tag_name": "v27.4.1",
+    "html_url": "https://github.com/moby/moby/releases/tag/v27.4.1",
+    "assets": []
+  },
+  "v27.4.0": {
+    "id": 189756585,
+    "tag_name": "v27.4.0",
+    "html_url": "https://github.com/moby/moby/releases/tag/v27.4.0",
+    "assets": []
+  },
+  "v25.0.7": {
+    "id": 189262441,
+    "tag_name": "v25.0.7",
+    "html_url": "https://github.com/moby/moby/releases/tag/v25.0.7",
+    "assets": []
+  },
+  "v23.0.16": {
+    "id": 189261618,
+    "tag_name": "v23.0.16",
+    "html_url": "https://github.com/moby/moby/releases/tag/v23.0.16",
+    "assets": []
+  },
+  "v27.4.0-rc.4": {
+    "id": 189120203,
+    "tag_name": "v27.4.0-rc.4",
+    "html_url": "https://github.com/moby/moby/releases/tag/v27.4.0-rc.4",
+    "assets": []
+  },
+  "v27.4.0-rc.3": {
+    "id": 188263557,
+    "tag_name": "v27.4.0-rc.3",
+    "html_url": "https://github.com/moby/moby/releases/tag/v27.4.0-rc.3",
     "assets": []
   },
   "v27.4.0-rc.2": {

.github/undock-releases.json

@@ -1,46 +1,178 @@
 {
   "latest": {
-    "id": 162880608,
-    "tag_name": "v0.8.0",
-    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.8.0",
+    "id": 273439938,
+    "tag_name": "v0.11.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.11.0",
     "assets": [
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/checksums.txt",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_darwin_amd64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_darwin_amd64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_darwin_amd64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_darwin_arm64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_darwin_arm64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_darwin_arm64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_amd64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_amd64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_amd64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_arm64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_arm64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_arm64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_armv5.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_armv5.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_armv5.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_armv6.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_armv6.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_armv6.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_armv7.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_armv7.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_armv7.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_ppc64le.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_ppc64le.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_ppc64le.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_riscv64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_riscv64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_riscv64.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_s390x.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_s390x.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_linux_s390x.tar.gz",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_windows_amd64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_windows_amd64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_windows_amd64.zip",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_windows_arm64.provenance.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_windows_arm64.sbom.json",
-      "https://github.com/crazy-max/undock/releases/download/v0.8.0/undock_0.8.0_windows_arm64.zip"
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv5.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv5.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv6.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv6.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv7.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv7.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_ppc64le.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_ppc64le.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_riscv64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_riscv64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_s390x.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_s390x.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_arm64.zip"
+    ]
+  },
+  "v0.11.0": {
+    "id": 273439938,
+    "tag_name": "v0.11.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.11.0",
+    "assets": [
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv5.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv5.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv6.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv6.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv7.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv7.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_ppc64le.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_ppc64le.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_riscv64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_riscv64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_s390x.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_s390x.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_arm64.zip"
+    ]
+  },
+  "v0.10.0": {
+    "id": 213293369,
+    "tag_name": "v0.10.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.10.0",
+    "assets": [
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.10.0/undock_0.10.0_windows_arm64.zip"
+    ]
+  },
+  "v0.9.0": {
+    "id": 192171889,
+    "tag_name": "v0.9.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.9.0",
+    "assets": [
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv5.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv5.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv6.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv6.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv7.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv7.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_ppc64le.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_ppc64le.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_riscv64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_riscv64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_s390x.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_s390x.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.9.0/undock_0.9.0_windows_arm64.zip"
     ]
   },
   "v0.8.0": {
@@ -108,6 +240,50 @@
       "https://github.com/crazy-max/undock/releases/download/v0.7.0/undock_0.7.0_windows_arm64.zip"
     ]
   },
+  "edge": {
+    "id": 273439938,
+    "tag_name": "v0.11.0",
+    "html_url": "https://github.com/crazy-max/undock/releases/tag/v0.11.0",
+    "assets": [
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/checksums.txt",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_darwin_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_amd64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_arm64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv5.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv5.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv5.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv6.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv6.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv6.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv7.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv7.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_armv7.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_ppc64le.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_ppc64le.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_ppc64le.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_riscv64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_riscv64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_riscv64.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_s390x.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_s390x.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_linux_s390x.tar.gz",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_amd64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_amd64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_amd64.zip",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_arm64.provenance.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_arm64.sbom.json",
+      "https://github.com/crazy-max/undock/releases/download/v0.11.0/undock_0.11.0_windows_arm64.zip"
+    ]
+  },
   "v0.7.0-rc.1": {
     "id": 134495651,
     "tag_name": "v0.7.0-rc.1",

.github/workflows/build.yml

@@ -19,15 +19,12 @@ jobs:
       fail-fast: false
       matrix:
         node_version:
+          - 24
           - 20
-          - 18
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
       -
         name: Build
-        uses: docker/bake-action@v5
+        uses: docker/bake-action@v7
         with:
           targets: build
         env:

.github/workflows/buildx-lab-releases-json.yml

@@ -17,7 +17,7 @@ on:
 
 jobs:
   generate:
-    uses: crazy-max/.github/.github/workflows/releases-json.yml@fa6141aedf23596fb8bdcceab9cce8dadaa31bd9
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@2842b806167c9dbacf5f972e0fcf47204a99d987
     with:
       repository: docker/buildx-desktop
       artifact_name: buildx-lab-releases-json
@@ -25,17 +25,17 @@ jobs:
     secrets: inherit
 
   open-pr:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     if: github.event_name != 'pull_request'
     needs:
       - generate
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       -
         name: Download
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: buildx-lab-releases-json
           path: .github
@@ -45,7 +45,7 @@ jobs:
           git add -A .
       -
         name: Create PR
-        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8.1.0
         with:
           base: main
           branch: bot/buildx-lab-releases-json

.github/workflows/buildx-releases-json.yml

@@ -17,7 +17,7 @@ on:
 
 jobs:
   generate:
-    uses: crazy-max/.github/.github/workflows/releases-json.yml@fa6141aedf23596fb8bdcceab9cce8dadaa31bd9
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@2842b806167c9dbacf5f972e0fcf47204a99d987
     with:
       repository: docker/buildx
       artifact_name: buildx-releases-json
@@ -25,17 +25,17 @@ jobs:
     secrets: inherit
 
   open-pr:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     if: github.event_name != 'pull_request'
     needs:
       - generate
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       -
         name: Download
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: buildx-releases-json
           path: .github
@@ -45,7 +45,7 @@ jobs:
           git add -A .
       -
         name: Create PR
-        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8.1.0
         with:
           base: main
           branch: bot/buildx-releases-json

.github/workflows/codeql.yml

@@ -12,7 +12,7 @@ permissions:
   security-events: write
 
 env:
-  NODE_VERSION: 20
+  NODE_VERSION: "24"
 
 jobs:
   analyze:
@@ -20,7 +20,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       -
         name: Enable corepack
         run: |
@@ -28,19 +28,19 @@ jobs:
           yarn --version
       -
         name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NODE_VERSION }}
       -
         name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: javascript-typescript
       -
         name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@v4
       -
         name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: "/language:javascript-typescript"

.github/workflows/compose-lab-releases-json.yml

@@ -0,0 +1,58 @@
+name: compose-lab-releases-json
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 */12 * * *'
+  push:
+    branches:
+      - 'main'
+  pull_request:
+    paths:
+      - '.github/workflows/compose-lab-releases-json.yml'
+
+jobs:
+  generate:
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@2842b806167c9dbacf5f972e0fcf47204a99d987
+    with:
+      repository: docker/compose-desktop
+      artifact_name: compose-lab-releases-json
+      filename: compose-lab-releases.json
+    secrets: inherit
+
+  open-pr:
+    runs-on: ubuntu-24.04
+    if: github.event_name != 'pull_request'
+    needs:
+      - generate
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+      -
+        name: Download
+        uses: actions/download-artifact@v8
+        with:
+          name: compose-lab-releases-json
+          path: .github
+      -
+        name: Commit changes
+        run: |
+          git add -A .
+      -
+        name: Create PR
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8.1.0
+        with:
+          base: main
+          branch: bot/compose-lab-releases-json
+          commit-message: "github: update .github/compose-lab-releases.json"
+          signoff: true
+          delete-branch: true
+          title: "Update `.github/compose-lab-releases.json`"
+          body: |
+            Update `.github/compose-lab-releases.json` to keep in sync with [https://github.com/docker/compose-desktop](https://github.com/docker/compose-desktop).
+          draft: false

.github/workflows/compose-releases-json.yml

@@ -0,0 +1,58 @@
+name: compose-releases-json
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 */12 * * *'
+  push:
+    branches:
+      - 'main'
+  pull_request:
+    paths:
+      - '.github/workflows/compose-releases-json.yml'
+
+jobs:
+  generate:
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@2842b806167c9dbacf5f972e0fcf47204a99d987
+    with:
+      repository: docker/compose
+      artifact_name: compose-releases-json
+      filename: compose-releases.json
+    secrets: inherit
+
+  open-pr:
+    runs-on: ubuntu-24.04
+    if: github.event_name != 'pull_request'
+    needs:
+      - generate
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+      -
+        name: Download
+        uses: actions/download-artifact@v8
+        with:
+          name: compose-releases-json
+          path: .github
+      -
+        name: Commit changes
+        run: |
+          git add -A .
+      -
+        name: Create PR
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8.1.0
+        with:
+          base: main
+          branch: bot/compose-releases-json
+          commit-message: "github: update .github/compose-releases.json"
+          signoff: true
+          delete-branch: true
+          title: "Update `.github/compose-releases.json`"
+          body: |
+            Update `.github/compose-releases.json` to keep in sync with [https://github.com/docker/compose](https://github.com/docker/compose).
+          draft: false

.github/workflows/cosign-releases-json.yml

@@ -0,0 +1,58 @@
+name: cosign-releases-json
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 */12 * * *'
+  push:
+    branches:
+      - 'main'
+  pull_request:
+    paths:
+      - '.github/workflows/cosign-releases-json.yml'
+
+jobs:
+  generate:
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@2842b806167c9dbacf5f972e0fcf47204a99d987
+    with:
+      repository: sigstore/cosign
+      artifact_name: cosign-releases-json
+      filename: cosign-releases.json
+    secrets: inherit
+
+  open-pr:
+    runs-on: ubuntu-24.04
+    if: github.event_name != 'pull_request'
+    needs:
+      - generate
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+      -
+        name: Download
+        uses: actions/download-artifact@v8
+        with:
+          name: cosign-releases-json
+          path: .github
+      -
+        name: Commit changes
+        run: |
+          git add -A .
+      -
+        name: Create PR
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8.1.0
+        with:
+          base: main
+          branch: bot/cosign-releases-json
+          commit-message: "github: update .github/cosign-releases.json"
+          signoff: true
+          delete-branch: true
+          title: "Update `.github/cosign-releases.json`"
+          body: |
+            Update `.github/cosign-releases.json` to keep in sync with [https://github.com/sigstore/cosign](https://github.com/sigstore/cosign).
+          draft: false

.github/workflows/docker-releases-json.yml

@@ -17,25 +17,28 @@ on:
 
 jobs:
   generate:
-    uses: crazy-max/.github/.github/workflows/releases-json.yml@fa6141aedf23596fb8bdcceab9cce8dadaa31bd9
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@2842b806167c9dbacf5f972e0fcf47204a99d987
     with:
       repository: moby/moby
       artifact_name: docker-releases-json
       filename: docker-releases.json
+      tag_patterns: |
+        ^docker-(.*)$
+        ^(v.*)$
     secrets: inherit
 
   open-pr:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     if: github.event_name != 'pull_request'
     needs:
       - generate
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       -
         name: Download
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: docker-releases-json
           path: .github
@@ -45,7 +48,7 @@ jobs:
           git add -A .
       -
         name: Create PR
-        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8.1.0
         with:
           base: main
           branch: bot/docker-releases-json

.github/workflows/pr-assign-author.yml

@@ -0,0 +1,17 @@
+name: pr-assign-author
+
+permissions:
+  contents: read
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+
+jobs:
+  run:
+    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@1b673f36fad86812f538c1df9794904038a23cbf
+    permissions:
+      contents: read
+      pull-requests: write

.github/workflows/publish.yml

@@ -1,5 +1,9 @@
 name: publish
 
+permissions:
+  id-token: write # required for OIDC
+  contents: write # required to create GitHub Release
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -9,20 +13,49 @@ on:
     tags:
       - 'v*'
 
+env:
+  NODE_VERSION: "24"
+
 jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        name: Enable corepack
+        run: |
+          corepack enable
+          yarn --version
+      -
+        name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'yarn'
+          package-manager-cache: false
+      -
+        name: Print versions
+        run: |
+          node --version
+          npm --version
+          yarn --version
+      -
+        name: Build
+        run: |
+          yarn install
+          yarn run build
       -
         name: Publish
-        uses: docker/bake-action@v5
+        run: |
+          npm version --no-git-tag-version ${GITHUB_REF#refs/tags/v}
+          npm publish --provenance --access public
+      -
+        name: Create Release
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b  # v2.5.0
         with:
-          targets: publish
+          draft: true
+          generate_release_notes: true
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/regclient-releases-json.yml

@@ -0,0 +1,58 @@
+name: regclient-releases-json
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 */12 * * *'
+  push:
+    branches:
+      - 'main'
+  pull_request:
+    paths:
+      - '.github/workflows/regclient-releases-json.yml'
+
+jobs:
+  generate:
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@2842b806167c9dbacf5f972e0fcf47204a99d987
+    with:
+      repository: regclient/regclient
+      artifact_name: regclient-releases-json
+      filename: regclient-releases.json
+    secrets: inherit
+
+  open-pr:
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request'
+    needs:
+      - generate
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+      -
+        name: Download
+        uses: actions/download-artifact@v8
+        with:
+          name: regclient-releases-json
+          path: .github
+      -
+        name: Commit changes
+        run: |
+          git add -A .
+      -
+        name: Create PR
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8.1.0
+        with:
+          base: main
+          branch: bot/regclient-releases-json
+          commit-message: "github: update .github/regclient-releases.json"
+          signoff: true
+          delete-branch: true
+          title: "Update `.github/regclient-releases.json`"
+          body: |
+            Update `.github/regclient-releases.json` to keep in sync with [https://github.com/regclient/regclient](https://github.com/regclient/regclient).
+          draft: false

.github/workflows/test.yml

@@ -14,31 +14,36 @@ on:
       - '.github/*-releases.json'
 
 env:
-  NODE_VERSION: "20"
-  BUILDX_VERSION: "v0.18.0"
-  BUILDKIT_IMAGE: "moby/buildkit:v0.17.2"
+  NODE_VERSION: "24"
+  BUILDX_VERSION: "v0.32.1"
+  BUILDKIT_IMAGE: "moby/buildkit:v0.28.0"
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
+        os:
+          - ubuntu-latest
+          - ubuntu-24.04-arm
         node_version:
+          - 24
           - 20
-          - 18
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       -
         name: Test
-        uses: docker/bake-action@v5
+        uses: docker/bake-action@v7
         with:
+          source: .
           targets: test-coverage
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NODE_VERSION: ${{ matrix.node_version }}
+          DOCKER_BUILD_SUMMARY: false
       -
         name: Check coverage
         run: |
@@ -64,7 +69,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       -
         name: Enable corepack
         run: |
@@ -72,7 +77,7 @@ jobs:
           yarn --version
       -
         name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'yarn'
@@ -82,7 +87,7 @@ jobs:
       -
         name: Create includes
         id: set
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             let tests = [];
@@ -101,14 +106,25 @@ jobs:
             });
             await core.group(`Set includes`, async () => {
               let includes = [];
-              for (const os of ['ubuntu-latest', 'macos-13', 'windows-latest']) {
+              for (const os of ['ubuntu-latest', 'ubuntu-24.04-arm', 'macos-15-intel', 'windows-latest']) {
                 for (const test of tests) {
-                  if (os === 'macos-13' && test === 'docker/install.test.itg.ts') {
-                    includes.push({ os: os, test: test, docker_install_type: 'image', docker_install_version: '27.3.1' });
-                    includes.push({ os: os, test: test, docker_install_type: 'image', docker_install_version: 'master' });
-                    includes.push({ os: os, test: test, docker_install_type: 'image', docker_install_version: 'latest' });
-                    includes.push({ os: os, test: test, docker_install_type: 'archive', docker_install_version: 'v26.1.4' });
-                    includes.push({ os: os, test: test, docker_install_type: 'archive', docker_install_version: 'latest' });
+                  if (test === 'docker/install.test.itg.ts') {
+                    if (os !== 'windows-latest') {
+                      includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'image', docker_install_version: '27.3.1' });
+                      includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'image', docker_install_version: 'master' });
+                      includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'image', docker_install_version: 'latest' });
+                    }
+                    includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'archive', docker_install_version: 'v26.1.4' });
+                    includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'archive', docker_install_version: 'latest' });
+                    includes.push({ os: os, test: test, test_name: 'root', docker_install_type: 'archive', docker_install_version: 'v29.0.0-rc.1', docker_install_channel: 'test' });
+                    if (os === 'ubuntu-latest') {
+                      includes.push({ os: os, test: test, test_name: 'rootless', docker_install_type: 'image', docker_install_version: 'latest' });
+                      includes.push({ os: os, test: test, test_name: 'rootless', docker_install_type: 'archive', docker_install_version: 'latest' });
+                    }
+                    if (os !== 'windows-latest') {
+                      includes.push({ os: os, test: test, test_name: 'tcp', docker_install_type: 'image', docker_install_version: 'latest' });
+                    }
+                    includes.push({ os: os, test: test, test_name: 'tcp', docker_install_type: 'archive', docker_install_version: 'latest' });
                   } else {
                     includes.push({ os: os, test: test });
                   }
@@ -130,20 +146,25 @@ jobs:
       fail-fast: false
       matrix:
         include: ${{ fromJson(needs.prepare-itg.outputs.includes) }}
+    permissions:
+      contents: read
+      id-token: write # needed for signing with GitHub OIDC Token
+      packages: write # needed for pushing to GitHub Container Registry
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       -
         name: Expose GitHub Runtime
-        uses: crazy-max/ghaction-github-runtime@v3
+        uses: crazy-max/ghaction-github-runtime@v4
       -
-        # FIXME: Needs to setup node twice on Windows due to a bug with runner
+        # FIXME: Needs to setup node twice on Windows: https://github.com/actions/setup-node/issues/1357#issuecomment-3254613964
         name: Setup Node
         if: startsWith(matrix.os, 'windows')
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NODE_VERSION }}
+          package-manager-cache: false
       -
         name: Enable corepack
         run: |
@@ -151,14 +172,14 @@ jobs:
           yarn --version
       -
         name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'yarn'
       -
         name: Set up Docker Buildx
         if: startsWith(matrix.os, 'ubuntu')
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver: docker
@@ -166,7 +187,7 @@ jobs:
         name: Set up container builder
         if: startsWith(matrix.os, 'ubuntu')
         id: builder
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           version: ${{ env.BUILDX_VERSION }}
           driver-opts: image=${{ env.BUILDKIT_IMAGE }}
@@ -176,14 +197,23 @@ jobs:
         run: yarn install
       -
         name: Test
-        run: |
-          yarn test:itg-coverage --runTestsByPath __tests__/${{ matrix.test }} --coverageDirectory=./coverage
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const testName = `${{ matrix.test_name }}`;
+            let args = ['test:itg-coverage'];
+            if (testName) {
+              args.push(`--testNamePattern=^${testName} `);
+            }
+            args.push(`__tests__/${{ matrix.test }}`, `--coverage.reportsDirectory=./coverage`);
+            await exec.exec('yarn', args);
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CTN_BUILDER_NAME: ${{ steps.builder.outputs.name }}
           TEST_FOR_SUMMARY: ${{ secrets.TEST_FOR_SUMMARY }}
           DOCKER_INSTALL_TYPE: ${{ matrix.docker_install_type }}
           DOCKER_INSTALL_VERSION: ${{ matrix.docker_install_version }}
+          DOCKER_INSTALL_CHANNEL: ${{ matrix.docker_install_channel }}
       -
         name: Check coverage
         run: |

.github/workflows/undock-releases-json.yml

@@ -17,7 +17,7 @@ on:
 
 jobs:
   generate:
-    uses: crazy-max/.github/.github/workflows/releases-json.yml@fa6141aedf23596fb8bdcceab9cce8dadaa31bd9
+    uses: crazy-max/.github/.github/workflows/releases-json.yml@2842b806167c9dbacf5f972e0fcf47204a99d987
     with:
       repository: crazy-max/undock
       artifact_name: undock-releases-json
@@ -25,17 +25,17 @@ jobs:
     secrets: inherit
 
   open-pr:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     if: github.event_name != 'pull_request'
     needs:
       - generate
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       -
         name: Download
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: undock-releases-json
           path: .github
@@ -45,7 +45,7 @@ jobs:
           git add -A .
       -
         name: Create PR
-        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8.1.0
         with:
           base: main
           branch: bot/undock-releases-json

.github/workflows/validate.yml

@@ -15,17 +15,17 @@ on:
 
 jobs:
   prepare:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     outputs:
-      targets: ${{ steps.generate.outputs.targets }}
+      matrix: ${{ steps.generate.outputs.matrix }}
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       -
-        name: List targets
+        name: Generate matrix
         id: generate
-        uses: docker/bake-action/subaction/list-targets@v5
+        uses: docker/bake-action/subaction/matrix@v7
         with:
           target: validate
 
@@ -36,13 +36,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: ${{ fromJson(needs.prepare.outputs.targets) }}
+        include: ${{ fromJson(needs.prepare.outputs.matrix) }}
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v4
       -
         name: Validate
-        uses: docker/bake-action@v5
+        uses: docker/bake-action@v7
         with:
           targets: ${{ matrix.target }}

.github/workflows/virtual-env.yml

@@ -23,7 +23,8 @@ jobs:
           - ubuntu-latest
           - ubuntu-24.04
           - ubuntu-22.04
-          - ubuntu-20.04
+          - ubuntu-24.04-arm
+          - ubuntu-22.04-arm
     steps:
       -
         name: File system

.gitignore

@@ -38,13 +38,6 @@ jspm_packages/
 # Yarn Integrity file
 .yarn-integrity
 
-# dotenv environment variable files
-.env
-.env.development.local
-.env.test.local
-.env.production.local
-.env.local
-
 # yarn v2
 .yarn/cache
 .yarn/unplugged

.prettierrc.json

@@ -6,6 +6,5 @@
   "singleQuote": true,
   "trailingComma": "none",
   "bracketSpacing": false,
-  "arrowParens": "avoid",
-  "parser": "typescript"
+  "arrowParens": "avoid"
 }

.yarnrc.yml

@@ -1,3 +1,9 @@
+# https://yarnpkg.com/configuration/yarnrc
+
+compressionLevel: mixed
+enableGlobalCache: false
+enableHardenedMode: true
+
 logFilters:
   - code: YN0013
     level: discard
@@ -5,11 +11,9 @@ logFilters:
     level: discard
   - code: YN0076
     level: discard
+  - code: YN0086
+    level: discard
 
 nodeLinker: node-modules
 
 npmAuthToken: "${NODE_AUTH_TOKEN:-fallback}"
-
-plugins:
-  - path: .yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
-    spec: "@yarnpkg/plugin-interactive-tools"

README.md

@@ -25,6 +25,8 @@ a library by most of our GitHub Actions:
 * [docker/login-action](https://github.com/docker/login-action)
 * [docker/metadata-action](https://github.com/docker/metadata-action)
 * [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action)
+* [docker/setup-compose-action](https://github.com/docker/setup-compose-action)
+* [docker/setup-docker-action](https://github.com/docker/setup-docker-action)
 * [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action)
 
 This toolkit provides some utilities and common logic when developing GitHub

__mocks__/@actions/github.ts

@@ -1,224 +0,0 @@
-/**
- * Copyright 2023 actions-toolkit authors
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import {jest} from '@jest/globals';
-
-export const context = {
-  repo: {
-    owner: 'docker',
-    repo: 'actions-toolkit'
-  },
-  ref: 'refs/heads/master',
-  runId: 2188748038,
-  runNumber: 15,
-  payload: {
-    after: '860c1904a1ce19322e91ac35af1ab07466440c37',
-    base_ref: null,
-    before: '5f3331d7f7044c18ca9f12c77d961c4d7cf3276a',
-    commits: [
-      {
-        author: {
-          email: 'crazy-max@users.noreply.github.com',
-          name: 'CrazyMax',
-          username: 'crazy-max'
-        },
-        committer: {
-          email: 'crazy-max@users.noreply.github.com',
-          name: 'CrazyMax',
-          username: 'crazy-max'
-        },
-        distinct: true,
-        id: '860c1904a1ce19322e91ac35af1ab07466440c37',
-        message: 'hello dev',
-        timestamp: '2022-04-19T11:27:24+02:00',
-        tree_id: 'd2c60af597e863787d2d27f569e30495b0b92820',
-        url: 'https://github.com/docker/test-docker-action/commit/860c1904a1ce19322e91ac35af1ab07466440c37'
-      }
-    ],
-    compare: 'https://github.com/docker/test-docker-action/compare/5f3331d7f704...860c1904a1ce',
-    created: false,
-    deleted: false,
-    forced: false,
-    head_commit: {
-      author: {
-        email: 'crazy-max@users.noreply.github.com',
-        name: 'CrazyMax',
-        username: 'crazy-max'
-      },
-      committer: {
-        email: 'crazy-max@users.noreply.github.com',
-        name: 'CrazyMax',
-        username: 'crazy-max'
-      },
-      distinct: true,
-      id: '860c1904a1ce19322e91ac35af1ab07466440c37',
-      message: 'hello dev',
-      timestamp: '2022-04-19T11:27:24+02:00',
-      tree_id: 'd2c60af597e863787d2d27f569e30495b0b92820',
-      url: 'https://github.com/docker/test-docker-action/commit/860c1904a1ce19322e91ac35af1ab07466440c37'
-    },
-    organization: {
-      avatar_url: 'https://avatars.githubusercontent.com/u/5429470?v=4',
-      description: 'Docker helps developers bring their ideas to life by conquering the complexity of app development.',
-      events_url: 'https://api.github.com/orgs/docker/events',
-      hooks_url: 'https://api.github.com/orgs/docker/hooks',
-      id: 5429470,
-      issues_url: 'https://api.github.com/orgs/docker/issues',
-      login: 'docker',
-      members_url: 'https://api.github.com/orgs/docker/members{/member}',
-      node_id: 'MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=',
-      public_members_url: 'https://api.github.com/orgs/docker/public_members{/member}',
-      repos_url: 'https://api.github.com/orgs/docker/repos',
-      url: 'https://api.github.com/orgs/docker'
-    },
-    pusher: {
-      email: 'github@crazymax.dev',
-      name: 'crazy-max'
-    },
-    ref: 'refs/heads/dev',
-    repository: {
-      allow_forking: true,
-      archive_url: 'https://api.github.com/repos/docker/test-docker-action/{archive_format}{/ref}',
-      archived: false,
-      assignees_url: 'https://api.github.com/repos/docker/test-docker-action/assignees{/user}',
-      blobs_url: 'https://api.github.com/repos/docker/test-docker-action/git/blobs{/sha}',
-      branches_url: 'https://api.github.com/repos/docker/test-docker-action/branches{/branch}',
-      clone_url: 'https://github.com/docker/test-docker-action.git',
-      collaborators_url: 'https://api.github.com/repos/docker/test-docker-action/collaborators{/collaborator}',
-      comments_url: 'https://api.github.com/repos/docker/test-docker-action/comments{/number}',
-      commits_url: 'https://api.github.com/repos/docker/test-docker-action/commits{/sha}',
-      compare_url: 'https://api.github.com/repos/docker/test-docker-action/compare/{base}...{head}',
-      contents_url: 'https://api.github.com/repos/docker/test-docker-action/contents/{+path}',
-      contributors_url: 'https://api.github.com/repos/docker/test-docker-action/contributors',
-      created_at: 1596792180,
-      default_branch: 'master',
-      deployments_url: 'https://api.github.com/repos/docker/test-docker-action/deployments',
-      description: 'Test "Docker" Actions',
-      disabled: false,
-      downloads_url: 'https://api.github.com/repos/docker/test-docker-action/downloads',
-      events_url: 'https://api.github.com/repos/docker/test-docker-action/events',
-      fork: false,
-      forks: 1,
-      forks_count: 1,
-      forks_url: 'https://api.github.com/repos/docker/test-docker-action/forks',
-      full_name: 'docker/test-docker-action',
-      git_commits_url: 'https://api.github.com/repos/docker/test-docker-action/git/commits{/sha}',
-      git_refs_url: 'https://api.github.com/repos/docker/test-docker-action/git/refs{/sha}',
-      git_tags_url: 'https://api.github.com/repos/docker/test-docker-action/git/tags{/sha}',
-      git_url: 'git://github.com/docker/test-docker-action.git',
-      has_downloads: true,
-      has_issues: true,
-      has_pages: false,
-      has_projects: true,
-      has_wiki: true,
-      homepage: '',
-      hooks_url: 'https://api.github.com/repos/docker/test-docker-action/hooks',
-      html_url: 'https://github.com/docker/test-docker-action',
-      id: 285789493,
-      is_template: false,
-      issue_comment_url: 'https://api.github.com/repos/docker/test-docker-action/issues/comments{/number}',
-      issue_events_url: 'https://api.github.com/repos/docker/test-docker-action/issues/events{/number}',
-      issues_url: 'https://api.github.com/repos/docker/test-docker-action/issues{/number}',
-      keys_url: 'https://api.github.com/repos/docker/test-docker-action/keys{/key_id}',
-      labels_url: 'https://api.github.com/repos/docker/test-docker-action/labels{/name}',
-      language: 'JavaScript',
-      languages_url: 'https://api.github.com/repos/docker/test-docker-action/languages',
-      license: {
-        key: 'mit',
-        name: 'MIT License',
-        node_id: 'MDc6TGljZW5zZTEz',
-        spdx_id: 'MIT',
-        url: 'https://api.github.com/licenses/mit'
-      },
-      master_branch: 'master',
-      merges_url: 'https://api.github.com/repos/docker/test-docker-action/merges',
-      milestones_url: 'https://api.github.com/repos/docker/test-docker-action/milestones{/number}',
-      mirror_url: null,
-      name: 'test-docker-action',
-      node_id: 'MDEwOlJlcG9zaXRvcnkyODU3ODk0OTM=',
-      notifications_url: 'https://api.github.com/repos/docker/test-docker-action/notifications{?since,all,participating}',
-      open_issues: 6,
-      open_issues_count: 6,
-      organization: 'docker',
-      owner: {
-        avatar_url: 'https://avatars.githubusercontent.com/u/5429470?v=4',
-        email: 'info@docker.com',
-        events_url: 'https://api.github.com/users/docker/events{/privacy}',
-        followers_url: 'https://api.github.com/users/docker/followers',
-        following_url: 'https://api.github.com/users/docker/following{/other_user}',
-        gists_url: 'https://api.github.com/users/docker/gists{/gist_id}',
-        gravatar_id: '',
-        html_url: 'https://github.com/docker',
-        id: 5429470,
-        login: 'docker',
-        name: 'docker',
-        node_id: 'MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=',
-        organizations_url: 'https://api.github.com/users/docker/orgs',
-        received_events_url: 'https://api.github.com/users/docker/received_events',
-        repos_url: 'https://api.github.com/users/docker/repos',
-        site_admin: false,
-        starred_url: 'https://api.github.com/users/docker/starred{/owner}{/repo}',
-        subscriptions_url: 'https://api.github.com/users/docker/subscriptions',
-        type: 'Organization',
-        url: 'https://api.github.com/users/docker'
-      },
-      private: true,
-      pulls_url: 'https://api.github.com/repos/docker/test-docker-action/pulls{/number}',
-      pushed_at: 1650360446,
-      releases_url: 'https://api.github.com/repos/docker/test-docker-action/releases{/id}',
-      size: 796,
-      ssh_url: 'git@github.com:docker/test-docker-action.git',
-      stargazers: 0,
-      stargazers_count: 0,
-      stargazers_url: 'https://api.github.com/repos/docker/test-docker-action/stargazers',
-      statuses_url: 'https://api.github.com/repos/docker/test-docker-action/statuses/{sha}',
-      subscribers_url: 'https://api.github.com/repos/docker/test-docker-action/subscribers',
-      subscription_url: 'https://api.github.com/repos/docker/test-docker-action/subscription',
-      svn_url: 'https://github.com/docker/test-docker-action',
-      tags_url: 'https://api.github.com/repos/docker/test-docker-action/tags',
-      teams_url: 'https://api.github.com/repos/docker/test-docker-action/teams',
-      topics: [],
-      trees_url: 'https://api.github.com/repos/docker/test-docker-action/git/trees{/sha}',
-      updated_at: '2022-04-19T09:05:09Z',
-      url: 'https://github.com/docker/test-docker-action',
-      visibility: 'private',
-      watchers: 0,
-      watchers_count: 0
-    },
-    sender: {
-      avatar_url: 'https://avatars.githubusercontent.com/u/1951866?v=4',
-      events_url: 'https://api.github.com/users/crazy-max/events{/privacy}',
-      followers_url: 'https://api.github.com/users/crazy-max/followers',
-      following_url: 'https://api.github.com/users/crazy-max/following{/other_user}',
-      gists_url: 'https://api.github.com/users/crazy-max/gists{/gist_id}',
-      gravatar_id: '',
-      html_url: 'https://github.com/crazy-max',
-      id: 1951866,
-      login: 'crazy-max',
-      node_id: 'MDQ6VXNlcjE5NTE4NjY=',
-      organizations_url: 'https://api.github.com/users/crazy-max/orgs',
-      received_events_url: 'https://api.github.com/users/crazy-max/received_events',
-      repos_url: 'https://api.github.com/users/crazy-max/repos',
-      site_admin: false,
-      starred_url: 'https://api.github.com/users/crazy-max/starred{/owner}{/repo}',
-      subscriptions_url: 'https://api.github.com/users/crazy-max/subscriptions',
-      type: 'User',
-      url: 'https://api.github.com/users/crazy-max'
-    }
-  }
-};
-
-export const getOctokit = jest.fn();

__tests__/.fixtures/bake-01-overrides.json

@@ -22,7 +22,9 @@
         "linux/amd64"
       ],
       "output": [
-        "type=docker"
+        {
+          "type": "docker"
+        }
       ]
     }
   }

__tests__/.fixtures/bake-01-validate.json

@@ -22,7 +22,9 @@
         "GO_VERSION": "1.20"
       },
       "output": [
-        "type=cacheonly"
+        {
+          "type": "cacheonly"
+        }
       ]
     },
     "validate-docs": {
@@ -36,7 +38,9 @@
       },
       "target": "validate",
       "output": [
-        "type=cacheonly"
+        {
+          "type": "cacheonly"
+        }
       ]
     },
     "validate-vendor": {
@@ -48,7 +52,9 @@
       },
       "target": "validate",
       "output": [
-        "type=cacheonly"
+        {
+          "type": "cacheonly"
+        }
       ]
     }
   }

__tests__/.fixtures/bake-03-default.json

@@ -0,0 +1,68 @@
+{
+  "group": {
+    "default": {
+      "targets": [
+        "default"
+      ]
+    }
+  },
+  "target": {
+    "default": {
+      "context": ".",
+      "dockerfile": "Dockerfile",
+      "attest": [
+        {
+          "mode": "max",
+          "type": "provenance"
+        },
+        {
+          "disabled": true,
+          "type": "sbom"
+        }
+      ],
+      "cache-from": [
+        {
+          "scope": "build",
+          "type": "gha"
+        },
+        {
+          "ref": "user/repo:cache",
+          "type": "registry"
+        }
+      ],
+      "cache-to": [
+        {
+          "mode": "max",
+          "scope": "build",
+          "type": "gha"
+        },
+        {
+          "type": "inline"
+        }
+      ],
+      "output": [
+        {
+          "dest": "./release-out",
+          "type": "local"
+        },
+        {
+          "ref": "user/app",
+          "type": "registry"
+        }
+      ],
+      "secret": [
+        {
+          "env": "GITHUB_TOKEN",
+          "id": "GITHUB_TOKEN"
+        },
+        {
+          "id": "aws",
+          "src": "__tests__/.fixtures/secret.txt"
+        },
+        {
+          "id": "GITHUB_REPOSITORY"
+        }
+      ]
+    }
+  }
+}

__tests__/.fixtures/bake-03.hcl

@@ -0,0 +1,37 @@
+// Copyright 2024 actions-toolkit authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+target "default" {
+  attest = [
+    "type=provenance,mode=max",
+    "type=sbom,disabled=true",
+  ]
+  cache-from = [
+    "type=gha,scope=build",
+    "user/repo:cache",
+  ]
+  cache-to = [
+    "type=gha,scope=build,mode=max",
+    "type=inline"
+  ]
+  output = [
+    "./release-out",
+    "type=registry,ref=user/app"
+  ]
+  secret = [
+    "id=GITHUB_TOKEN,env=GITHUB_TOKEN",
+    "id=aws,src=__tests__/.fixtures/secret.txt",
+    "id=GITHUB_REPOSITORY"
+  ]
+}

__tests__/.fixtures/bake-buildx-0.10.4-binaries-cross.json

@@ -29,7 +29,10 @@
         "windows/arm64"
       ],
       "output": [
-        "./bin/build"
+        {
+          "dest": "./bin/build",
+          "type": "local"
+        }
       ]
     }
   }

__tests__/.fixtures/cosign/verify-output-err1.txt

@@ -0,0 +1,96 @@
+2025/10/31 13:57:03 --> GET https://index.docker.io/v2/
+2025/10/31 13:57:03 GET /v2/ HTTP/1.1
+Host: index.docker.io
+User-Agent: cosign/v3.0.2 (linux; amd64) go-containerregistry/v0.20.6
+Accept-Encoding: gzip
+
+
+2025/10/31 13:57:03 <-- 401 https://index.docker.io/v2/ (191.948348ms)
+2025/10/31 13:57:03 HTTP/2.0 401 Unauthorized
+Content-Length: 87
+Content-Type: application/json
+Date: Fri, 31 Oct 2025 13:57:03 GMT
+Docker-Distribution-Api-Version: registry/2.0
+Strict-Transport-Security: max-age=31536000
+Www-Authenticate: ***"https://auth.docker.io/token",service="registry.docker.io"
+
+{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":null}]}
+
+2025/10/31 13:57:03 --> GET https://auth.docker.io/token?scope=repository%3Acrazymax%2Fgithub-builder-test%3Apull&service=registry.docker.io [body redacted: basic token response contains credentials]
+2025/10/31 13:57:03 GET /token?scope=repository%3Acrazymax%2Fgithub-builder-test%3Apull&service=registry.docker.io HTTP/1.1
+Host: auth.docker.io
+User-Agent: cosign/v3.0.2 (linux; amd64) go-containerregistry/v0.20.6
+Authorization: <redacted>
+Accept-Encoding: gzip
+
+
+2025/10/31 13:57:03 <-- 200 https://auth.docker.io/token?scope=repository%3Acrazymax%2Fgithub-builder-test%3Apull&service=registry.docker.io (180.01561ms) [body redacted: basic token response contains credentials]
+2025/10/31 13:57:03 HTTP/2.0 200 OK
+Connection: close
+Content-Type: application/json
+Date: Fri, 31 Oct 2025 13:57:03 GMT
+Strict-Transport-Security: max-age=31536000
+X-Trace-Id: 8d63fbce36baf5f2a0c5f2542efa7a7a
+X-Trace-Sampled: false
+
+
+2025/10/31 13:57:03 --> GET https://index.docker.io/v2/crazymax/github-builder-test/referrers/sha256:6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0
+2025/10/31 13:57:03 GET /v2/crazymax/github-builder-test/referrers/sha256:6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0 HTTP/1.1
+Host: index.docker.io
+User-Agent: cosign/v3.0.2 (linux; amd64) go-containerregistry/v0.20.6
+Accept: application/vnd.oci.image.index.v1+json
+Authorization: <redacted>
+Accept-Encoding: gzip
+
+
+2025/10/31 13:57:03 <-- 200 https://index.docker.io/v2/crazymax/github-builder-test/referrers/sha256:6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0 (84.160823ms)
+2025/10/31 13:57:03 HTTP/2.0 200 OK
+Content-Length: 89
+Content-Type: application/vnd.oci.image.index.v1+json
+Date: Fri, 31 Oct 2025 13:57:03 GMT
+Docker-Distribution-Api-Version: registry/2.0
+Strict-Transport-Security: max-age=31536000
+
+{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[]}
+
+2025/10/31 13:57:03 --> GET https://index.docker.io/v2/crazymax/github-builder-test/referrers/sha256:6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0
+2025/10/31 13:57:03 GET /v2/crazymax/github-builder-test/referrers/sha256:6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0 HTTP/1.1
+Host: index.docker.io
+User-Agent: cosign/v3.0.2 (linux; amd64) go-containerregistry/v0.20.6
+Accept: application/vnd.oci.image.index.v1+json
+Authorization: <redacted>
+Accept-Encoding: gzip
+
+
+2025/10/31 13:57:03 <-- 200 https://index.docker.io/v2/crazymax/github-builder-test/referrers/sha256:6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0 (95.303988ms)
+2025/10/31 13:57:03 HTTP/2.0 200 OK
+Content-Length: 89
+Content-Type: application/vnd.oci.image.index.v1+json
+Date: Fri, 31 Oct 2025 13:57:03 GMT
+Docker-Distribution-Api-Version: registry/2.0
+Strict-Transport-Security: max-age=31536000
+
+{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[]}
+
+2025/10/31 13:57:03 --> GET https://index.docker.io/v2/crazymax/github-builder-test/manifests/sha256-6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0.sig
+2025/10/31 13:57:03 GET /v2/crazymax/github-builder-test/manifests/sha256-6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0.sig HTTP/1.1
+Host: index.docker.io
+User-Agent: cosign/v3.0.2 (linux; amd64) go-containerregistry/v0.20.6
+Accept: application/vnd.docker.distribution.manifest.v1+json,application/vnd.docker.distribution.manifest.v1+prettyjws,application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.index.v1+json
+Authorization: <redacted>
+Accept-Encoding: gzip
+
+
+2025/10/31 13:57:03 <-- 404 https://index.docker.io/v2/crazymax/github-builder-test/manifests/sha256-6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0.sig (66.155995ms)
+2025/10/31 13:57:03 HTTP/2.0 404 Not Found
+Content-Length: 169
+Content-Type: application/json
+Date: Fri, 31 Oct 2025 13:57:03 GMT
+Docker-Distribution-Api-Version: registry/2.0
+Docker-Ratelimit-Source: d2fd3209-1e2e-451f-b428-29c5bbf3b4b7
+Strict-Transport-Security: max-age=31536000
+
+{"errors":[{"code":"MANIFEST_UNKNOWN","message":"manifest unknown","detail":"unknown tag=sha256-6cc021c733ae2760b2493f449d9885b1606002962b51a9c4f0d0d1568b6dc5c0.sig"}]}
+
+Error: no signatures found
+error during command execution: no signatures found

__tests__/.fixtures/imagetools-01.json

@@ -0,0 +1,74 @@
+{
+  "created": "2024-12-16T23:44:38.698098711Z",
+  "architecture": "amd64",
+  "os": "linux",
+  "config": {
+    "Env": [
+      "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+      "BUILDKIT_SETUP_CGROUPV2_ROOT=1"
+    ],
+    "Entrypoint": [
+      "buildkitd"
+    ],
+    "Volumes": {
+      "/var/lib/buildkit": {}
+    },
+    "WorkingDir": "/",
+    "ArgsEscaped": true
+  },
+  "rootfs": {
+    "type": "layers",
+    "diff_ids": [
+      "sha256:75654b8eeebd3beae97271a102f57cdeb794cc91e442648544963a7e951e9558",
+      "sha256:6a1b167dc4f30367cc713f6d48710dff20eb913bfaf14d7df23cfbe8a235319c",
+      "sha256:37453f29fa93eccde9d8ffa21c0b92c41a981c727ad6c32acee11caf4f5e42a8",
+      "sha256:cc4513cba548800cba786895e269f78eff73e7685e80b0447070f8c116652eea"
+    ]
+  },
+  "history": [
+    {
+      "created": "2024-09-06T12:05:36Z",
+      "created_by": "ADD alpine-minirootfs-3.20.3-x86_64.tar.gz / # buildkit",
+      "comment": "buildkit.dockerfile.v0"
+    },
+    {
+      "created": "2024-09-06T12:05:36Z",
+      "created_by": "CMD [\"/bin/sh\"]",
+      "comment": "buildkit.dockerfile.v0",
+      "empty_layer": true
+    },
+    {
+      "created": "2024-12-16T23:35:52.845698088Z",
+      "created_by": "RUN /bin/sh -c apk add --no-cache fuse3 git openssh pigz xz iptables ip6tables   \u0026\u0026 ln -s fusermount3 /usr/bin/fusermount # buildkit",
+      "comment": "buildkit.dockerfile.v0"
+    },
+    {
+      "created": "2024-12-16T23:35:49.452745107Z",
+      "created_by": "COPY examples/buildctl-daemonless/buildctl-daemonless.sh /usr/bin/ # buildkit",
+      "comment": "buildkit.dockerfile.v0"
+    },
+    {
+      "created": "2024-12-16T23:44:38.698098711Z",
+      "created_by": "VOLUME [/var/lib/buildkit]",
+      "comment": "buildkit.dockerfile.v0",
+      "empty_layer": true
+    },
+    {
+      "created": "2024-12-16T23:44:38.698098711Z",
+      "created_by": "COPY / /usr/bin/ # buildkit",
+      "comment": "buildkit.dockerfile.v0"
+    },
+    {
+      "created": "2024-12-16T23:44:38.698098711Z",
+      "created_by": "ENV BUILDKIT_SETUP_CGROUPV2_ROOT=1",
+      "comment": "buildkit.dockerfile.v0",
+      "empty_layer": true
+    },
+    {
+      "created": "2024-12-16T23:44:38.698098711Z",
+      "created_by": "ENTRYPOINT [\"buildkitd\"]",
+      "comment": "buildkit.dockerfile.v0",
+      "empty_layer": true
+    }
+  ]
+}

__tests__/.fixtures/imagetools-02.json

@@ -0,0 +1,447 @@
+{
+  "linux/amd64": {
+    "created": "2024-12-16T23:44:38.698098711Z",
+    "architecture": "amd64",
+    "os": "linux",
+    "config": {
+      "Env": [
+        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+        "BUILDKIT_SETUP_CGROUPV2_ROOT=1"
+      ],
+      "Entrypoint": [
+        "buildkitd"
+      ],
+      "Volumes": {
+        "/var/lib/buildkit": {}
+      },
+      "WorkingDir": "/",
+      "ArgsEscaped": true
+    },
+    "rootfs": {
+      "type": "layers",
+      "diff_ids": [
+        "sha256:75654b8eeebd3beae97271a102f57cdeb794cc91e442648544963a7e951e9558",
+        "sha256:6a1b167dc4f30367cc713f6d48710dff20eb913bfaf14d7df23cfbe8a235319c",
+        "sha256:37453f29fa93eccde9d8ffa21c0b92c41a981c727ad6c32acee11caf4f5e42a8",
+        "sha256:cc4513cba548800cba786895e269f78eff73e7685e80b0447070f8c116652eea"
+      ]
+    },
+    "history": [
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "ADD alpine-minirootfs-3.20.3-x86_64.tar.gz / # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "CMD [\"/bin/sh\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:35:52.845698088Z",
+        "created_by": "RUN /bin/sh -c apk add --no-cache fuse3 git openssh pigz xz iptables ip6tables   \u0026\u0026 ln -s fusermount3 /usr/bin/fusermount # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:35:49.452745107Z",
+        "created_by": "COPY examples/buildctl-daemonless/buildctl-daemonless.sh /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:38.698098711Z",
+        "created_by": "VOLUME [/var/lib/buildkit]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:38.698098711Z",
+        "created_by": "COPY / /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:38.698098711Z",
+        "created_by": "ENV BUILDKIT_SETUP_CGROUPV2_ROOT=1",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:38.698098711Z",
+        "created_by": "ENTRYPOINT [\"buildkitd\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      }
+    ]
+  },
+  "linux/arm/v7": {
+    "created": "2024-12-16T23:44:35.805758197Z",
+    "architecture": "arm",
+    "os": "linux",
+    "variant": "v7",
+    "config": {
+      "Env": [
+        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+        "BUILDKIT_SETUP_CGROUPV2_ROOT=1"
+      ],
+      "Entrypoint": [
+        "buildkitd"
+      ],
+      "Volumes": {
+        "/var/lib/buildkit": {}
+      },
+      "WorkingDir": "/",
+      "ArgsEscaped": true
+    },
+    "rootfs": {
+      "type": "layers",
+      "diff_ids": [
+        "sha256:0cee9b6e126689480f812b337d8926e8b051e2c1e40b3e36701ea2554f367b9d",
+        "sha256:4cfff05f912cc67c6ff688b2f53f84e6d74fe415725a228115a296634d919fd3",
+        "sha256:37453f29fa93eccde9d8ffa21c0b92c41a981c727ad6c32acee11caf4f5e42a8",
+        "sha256:e0962dfb9d203ce37963e41ec72119610633651f760570d20b0217db3632b5d5"
+      ]
+    },
+    "history": [
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "ADD alpine-minirootfs-3.20.3-armv7.tar.gz / # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "CMD [\"/bin/sh\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:36:02.690991835Z",
+        "created_by": "RUN /bin/sh -c apk add --no-cache fuse3 git openssh pigz xz iptables ip6tables   \u0026\u0026 ln -s fusermount3 /usr/bin/fusermount # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:35:49.452745107Z",
+        "created_by": "COPY examples/buildctl-daemonless/buildctl-daemonless.sh /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:35.805758197Z",
+        "created_by": "VOLUME [/var/lib/buildkit]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:35.805758197Z",
+        "created_by": "COPY / /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:35.805758197Z",
+        "created_by": "ENV BUILDKIT_SETUP_CGROUPV2_ROOT=1",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:35.805758197Z",
+        "created_by": "ENTRYPOINT [\"buildkitd\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      }
+    ]
+  },
+  "linux/arm64": {
+    "created": "2024-12-16T23:44:45.848423966Z",
+    "architecture": "arm64",
+    "os": "linux",
+    "config": {
+      "Env": [
+        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+        "BUILDKIT_SETUP_CGROUPV2_ROOT=1"
+      ],
+      "Entrypoint": [
+        "buildkitd"
+      ],
+      "Volumes": {
+        "/var/lib/buildkit": {}
+      },
+      "WorkingDir": "/",
+      "ArgsEscaped": true
+    },
+    "rootfs": {
+      "type": "layers",
+      "diff_ids": [
+        "sha256:651d9022c23486dfbd396c13db293af6845731cbd098a5f5606db4bc9f5573e8",
+        "sha256:9c138da7f7ea7cc8190f71ce15f125e2eb79fd360f4cc2d34513dad016cb1096",
+        "sha256:37453f29fa93eccde9d8ffa21c0b92c41a981c727ad6c32acee11caf4f5e42a8",
+        "sha256:9422ca7e65701d8eba4a5a31e325443dcbc753c2edef64e431c96702c94d2672"
+      ]
+    },
+    "history": [
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "ADD alpine-minirootfs-3.20.3-aarch64.tar.gz / # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "CMD [\"/bin/sh\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:36:03.586014466Z",
+        "created_by": "RUN /bin/sh -c apk add --no-cache fuse3 git openssh pigz xz iptables ip6tables   \u0026\u0026 ln -s fusermount3 /usr/bin/fusermount # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:35:49.452745107Z",
+        "created_by": "COPY examples/buildctl-daemonless/buildctl-daemonless.sh /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:45.848423966Z",
+        "created_by": "VOLUME [/var/lib/buildkit]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:45.848423966Z",
+        "created_by": "COPY / /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:45.848423966Z",
+        "created_by": "ENV BUILDKIT_SETUP_CGROUPV2_ROOT=1",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:45.848423966Z",
+        "created_by": "ENTRYPOINT [\"buildkitd\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      }
+    ]
+  },
+  "linux/ppc64le": {
+    "created": "2024-12-16T23:44:45.864267959Z",
+    "architecture": "ppc64le",
+    "os": "linux",
+    "config": {
+      "Env": [
+        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+        "BUILDKIT_SETUP_CGROUPV2_ROOT=1"
+      ],
+      "Entrypoint": [
+        "buildkitd"
+      ],
+      "Volumes": {
+        "/var/lib/buildkit": {}
+      },
+      "WorkingDir": "/",
+      "ArgsEscaped": true
+    },
+    "rootfs": {
+      "type": "layers",
+      "diff_ids": [
+        "sha256:fc80c1f6e8bee4861c27b2cee0f8edf887bd4d88d20063ba179f0caa93088770",
+        "sha256:e9fbfe005c7e2cd7d4f3159f07f6fbe82dad25c7e868a1ee2dd6503830d468c4",
+        "sha256:37453f29fa93eccde9d8ffa21c0b92c41a981c727ad6c32acee11caf4f5e42a8",
+        "sha256:86e0c30fb5e087f5cd324e082a0529c6326af1025f1a030fc1d2ac2979dec81c"
+      ]
+    },
+    "history": [
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "ADD alpine-minirootfs-3.20.3-ppc64le.tar.gz / # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "CMD [\"/bin/sh\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:36:03.82451378Z",
+        "created_by": "RUN /bin/sh -c apk add --no-cache fuse3 git openssh pigz xz iptables ip6tables   \u0026\u0026 ln -s fusermount3 /usr/bin/fusermount # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:35:49.452745107Z",
+        "created_by": "COPY examples/buildctl-daemonless/buildctl-daemonless.sh /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:45.864267959Z",
+        "created_by": "VOLUME [/var/lib/buildkit]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:45.864267959Z",
+        "created_by": "COPY / /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:45.864267959Z",
+        "created_by": "ENV BUILDKIT_SETUP_CGROUPV2_ROOT=1",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:45.864267959Z",
+        "created_by": "ENTRYPOINT [\"buildkitd\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      }
+    ]
+  },
+  "linux/riscv64": {
+    "created": "2024-12-16T23:44:51.369236518Z",
+    "architecture": "riscv64",
+    "os": "linux",
+    "config": {
+      "Env": [
+        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+        "BUILDKIT_SETUP_CGROUPV2_ROOT=1"
+      ],
+      "Entrypoint": [
+        "buildkitd"
+      ],
+      "Volumes": {
+        "/var/lib/buildkit": {}
+      },
+      "WorkingDir": "/",
+      "ArgsEscaped": true
+    },
+    "rootfs": {
+      "type": "layers",
+      "diff_ids": [
+        "sha256:f9a3c4be4be59ad69b98da83e848450a28193c63ecdb40736f854308873152f9",
+        "sha256:231aa6f6a7db1c4ac8dc807a8bdd250f92be3ffac79ef9fec89ca8ac2f78e688",
+        "sha256:37453f29fa93eccde9d8ffa21c0b92c41a981c727ad6c32acee11caf4f5e42a8",
+        "sha256:555c2f18bbe5d71e09387bdf745023055a8e5a6667905143c09a689e65f5ceff"
+      ]
+    },
+    "history": [
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "ADD alpine-minirootfs-3.20.3-riscv64.tar.gz / # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "CMD [\"/bin/sh\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:36:02.869897238Z",
+        "created_by": "RUN /bin/sh -c apk add --no-cache fuse3 git openssh pigz xz iptables ip6tables   \u0026\u0026 ln -s fusermount3 /usr/bin/fusermount # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:35:49.452745107Z",
+        "created_by": "COPY examples/buildctl-daemonless/buildctl-daemonless.sh /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:51.369236518Z",
+        "created_by": "VOLUME [/var/lib/buildkit]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:51.369236518Z",
+        "created_by": "COPY / /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:51.369236518Z",
+        "created_by": "ENV BUILDKIT_SETUP_CGROUPV2_ROOT=1",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:51.369236518Z",
+        "created_by": "ENTRYPOINT [\"buildkitd\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      }
+    ]
+  },
+  "linux/s390x": {
+    "created": "2024-12-16T23:44:38.777675109Z",
+    "architecture": "s390x",
+    "os": "linux",
+    "config": {
+      "Env": [
+        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+        "BUILDKIT_SETUP_CGROUPV2_ROOT=1"
+      ],
+      "Entrypoint": [
+        "buildkitd"
+      ],
+      "Volumes": {
+        "/var/lib/buildkit": {}
+      },
+      "WorkingDir": "/",
+      "ArgsEscaped": true
+    },
+    "rootfs": {
+      "type": "layers",
+      "diff_ids": [
+        "sha256:a772154591ea8d876b24f25db93db4753a9f05c6500413a5ff966d581957655e",
+        "sha256:920529bf8be4087e77ec129bbcd9f3c4a179ede2f35cac38c6f8517fc9e41b9b",
+        "sha256:37453f29fa93eccde9d8ffa21c0b92c41a981c727ad6c32acee11caf4f5e42a8",
+        "sha256:2b99eb6f0070abe514fde85b61fa4993f1edfb32365b2a246841521f24fc38c0"
+      ]
+    },
+    "history": [
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "ADD alpine-minirootfs-3.20.3-s390x.tar.gz / # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-09-06T12:05:36Z",
+        "created_by": "CMD [\"/bin/sh\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:36:04.705568496Z",
+        "created_by": "RUN /bin/sh -c apk add --no-cache fuse3 git openssh pigz xz iptables ip6tables   \u0026\u0026 ln -s fusermount3 /usr/bin/fusermount # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:35:49.452745107Z",
+        "created_by": "COPY examples/buildctl-daemonless/buildctl-daemonless.sh /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:38.777675109Z",
+        "created_by": "VOLUME [/var/lib/buildkit]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:38.777675109Z",
+        "created_by": "COPY / /usr/bin/ # buildkit",
+        "comment": "buildkit.dockerfile.v0"
+      },
+      {
+        "created": "2024-12-16T23:44:38.777675109Z",
+        "created_by": "ENV BUILDKIT_SETUP_CGROUPV2_ROOT=1",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      },
+      {
+        "created": "2024-12-16T23:44:38.777675109Z",
+        "created_by": "ENTRYPOINT [\"buildkitd\"]",
+        "comment": "buildkit.dockerfile.v0",
+        "empty_layer": true
+      }
+    ]
+  }
+}

__tests__/.fixtures/imagetools-03.json

@@ -0,0 +1,5 @@
+{
+  "mediaType": "application/vnd.oci.image.manifest.v1+json",
+  "digest": "sha256:dccc69dd895968c4f21aa9e43e715f25f0cedfce4b17f1014c88c307928e22fc",
+  "size": 1599
+}

__tests__/.fixtures/imagetools-04.json

@@ -0,0 +1,141 @@
+{
+  "schemaVersion": 2,
+  "mediaType": "application/vnd.oci.image.index.v1+json",
+  "digest": "sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6",
+  "size": 4654,
+  "manifests": [
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:dccc69dd895968c4f21aa9e43e715f25f0cedfce4b17f1014c88c307928e22fc",
+      "size": 1599,
+      "platform": {
+        "architecture": "amd64",
+        "os": "linux"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:1b6bce668653f08e2d0f9f7c9b646675b2cbce94ce8abdf4eb0eabaef4353045",
+      "size": 1599,
+      "platform": {
+        "architecture": "arm",
+        "os": "linux",
+        "variant": "v7"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:8f251fda6057e9dffc54f7874b249920f15f1813e9b1406a0cebeca5e4ab1ad9",
+      "size": 1599,
+      "platform": {
+        "architecture": "arm64",
+        "os": "linux"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:d306cbc2d506547f136c8e0ea040b929743f298fb2813d9030efdb9d9eee4d51",
+      "size": 1599,
+      "platform": {
+        "architecture": "s390x",
+        "os": "linux"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:9d195ff2dc9ef347bb52ebb1c2a6e6587d4bd87019d2ea11df3e7046a3d19708",
+      "size": 1599,
+      "platform": {
+        "architecture": "ppc64le",
+        "os": "linux"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:72410c2c4529fca9339ebbcc8db2a1d5cb4d72d72c669f50b6d45d8a0f79fc22",
+      "size": 1599,
+      "platform": {
+        "architecture": "riscv64",
+        "os": "linux"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:2ba4ad6eae1efcafee73a971953093c7c32b6938f2f9fd4998c8bf4d0fbe76f2",
+      "size": 1113,
+      "annotations": {
+        "vnd.docker.reference.digest": "sha256:dccc69dd895968c4f21aa9e43e715f25f0cedfce4b17f1014c88c307928e22fc",
+        "vnd.docker.reference.type": "attestation-manifest"
+      },
+      "platform": {
+        "architecture": "unknown",
+        "os": "unknown"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:0709528fae1747ce17638ad2978ee7936b38a294136eaadaf692e415f64b1e03",
+      "size": 1113,
+      "annotations": {
+        "vnd.docker.reference.digest": "sha256:1b6bce668653f08e2d0f9f7c9b646675b2cbce94ce8abdf4eb0eabaef4353045",
+        "vnd.docker.reference.type": "attestation-manifest"
+      },
+      "platform": {
+        "architecture": "unknown",
+        "os": "unknown"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:241b7159129d53923c89708bcc052b3398086a826519896be2f025545916e43e",
+      "size": 1113,
+      "annotations": {
+        "vnd.docker.reference.digest": "sha256:8f251fda6057e9dffc54f7874b249920f15f1813e9b1406a0cebeca5e4ab1ad9",
+        "vnd.docker.reference.type": "attestation-manifest"
+      },
+      "platform": {
+        "architecture": "unknown",
+        "os": "unknown"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:97f4a222a7992dba6dc1a43991d0cca1fcffdc25593033c6a3a7ff14c8651cbf",
+      "size": 1113,
+      "annotations": {
+        "vnd.docker.reference.digest": "sha256:d306cbc2d506547f136c8e0ea040b929743f298fb2813d9030efdb9d9eee4d51",
+        "vnd.docker.reference.type": "attestation-manifest"
+      },
+      "platform": {
+        "architecture": "unknown",
+        "os": "unknown"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:aa933713d8094b2708120e889acb6f7153dee4e0f3298ccd3e37a584cd0c260d",
+      "size": 1113,
+      "annotations": {
+        "vnd.docker.reference.digest": "sha256:9d195ff2dc9ef347bb52ebb1c2a6e6587d4bd87019d2ea11df3e7046a3d19708",
+        "vnd.docker.reference.type": "attestation-manifest"
+      },
+      "platform": {
+        "architecture": "unknown",
+        "os": "unknown"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:d95ca72d4f2a6bc416d4b2f3003b2af9d5f4dea99acec6ad3ab0c2082000a98c",
+      "size": 1113,
+      "annotations": {
+        "vnd.docker.reference.digest": "sha256:72410c2c4529fca9339ebbcc8db2a1d5cb4d72d72c669f50b6d45d8a0f79fc22",
+        "vnd.docker.reference.type": "attestation-manifest"
+      },
+      "platform": {
+        "architecture": "unknown",
+        "os": "unknown"
+      }
+    }
+  ]
+}

__tests__/.fixtures/imagetools-05.json

@@ -0,0 +1,80 @@
+[
+  {
+    "mediaType":"application/vnd.oci.image.manifest.v1+json",
+    "digest":"sha256:2ba4ad6eae1efcafee73a971953093c7c32b6938f2f9fd4998c8bf4d0fbe76f2",
+    "size":1113,
+    "annotations":{
+      "vnd.docker.reference.digest":"sha256:dccc69dd895968c4f21aa9e43e715f25f0cedfce4b17f1014c88c307928e22fc",
+      "vnd.docker.reference.type":"attestation-manifest"
+    },
+    "platform":{
+      "architecture":"unknown",
+      "os":"unknown"
+    }
+  },
+  {
+    "mediaType":"application/vnd.oci.image.manifest.v1+json",
+    "digest":"sha256:0709528fae1747ce17638ad2978ee7936b38a294136eaadaf692e415f64b1e03",
+    "size":1113,
+    "annotations":{
+      "vnd.docker.reference.digest":"sha256:1b6bce668653f08e2d0f9f7c9b646675b2cbce94ce8abdf4eb0eabaef4353045",
+      "vnd.docker.reference.type":"attestation-manifest"
+    },
+    "platform":{
+      "architecture":"unknown",
+      "os":"unknown"
+    }
+  },
+  {
+    "mediaType":"application/vnd.oci.image.manifest.v1+json",
+    "digest":"sha256:241b7159129d53923c89708bcc052b3398086a826519896be2f025545916e43e",
+    "size":1113,
+    "annotations":{
+      "vnd.docker.reference.digest":"sha256:8f251fda6057e9dffc54f7874b249920f15f1813e9b1406a0cebeca5e4ab1ad9",
+      "vnd.docker.reference.type":"attestation-manifest"
+    },
+    "platform":{
+      "architecture":"unknown",
+      "os":"unknown"
+    }
+  },
+  {
+    "mediaType":"application/vnd.oci.image.manifest.v1+json",
+    "digest":"sha256:97f4a222a7992dba6dc1a43991d0cca1fcffdc25593033c6a3a7ff14c8651cbf",
+    "size":1113,
+    "annotations":{
+      "vnd.docker.reference.digest":"sha256:d306cbc2d506547f136c8e0ea040b929743f298fb2813d9030efdb9d9eee4d51",
+      "vnd.docker.reference.type":"attestation-manifest"
+    },
+    "platform":{
+      "architecture":"unknown",
+      "os":"unknown"
+    }
+  },
+  {
+    "mediaType":"application/vnd.oci.image.manifest.v1+json",
+    "digest":"sha256:aa933713d8094b2708120e889acb6f7153dee4e0f3298ccd3e37a584cd0c260d",
+    "size":1113,
+    "annotations":{
+      "vnd.docker.reference.digest":"sha256:9d195ff2dc9ef347bb52ebb1c2a6e6587d4bd87019d2ea11df3e7046a3d19708",
+      "vnd.docker.reference.type":"attestation-manifest"
+    },
+    "platform":{
+      "architecture":"unknown",
+      "os":"unknown"
+    }
+  },
+  {
+    "mediaType":"application/vnd.oci.image.manifest.v1+json",
+    "digest":"sha256:d95ca72d4f2a6bc416d4b2f3003b2af9d5f4dea99acec6ad3ab0c2082000a98c",
+    "size":1113,
+    "annotations":{
+      "vnd.docker.reference.digest":"sha256:72410c2c4529fca9339ebbcc8db2a1d5cb4d72d72c669f50b6d45d8a0f79fc22",
+      "vnd.docker.reference.type":"attestation-manifest"
+    },
+    "platform":{
+      "architecture":"unknown",
+      "os":"unknown"
+    }
+  }
+]

__tests__/.fixtures/imagetools-06.json

@@ -0,0 +1,15 @@
+[
+  {
+    "mediaType":"application/vnd.oci.image.manifest.v1+json",
+    "digest":"sha256:2ba4ad6eae1efcafee73a971953093c7c32b6938f2f9fd4998c8bf4d0fbe76f2",
+    "size":1113,
+    "annotations":{
+      "vnd.docker.reference.digest":"sha256:dccc69dd895968c4f21aa9e43e715f25f0cedfce4b17f1014c88c307928e22fc",
+      "vnd.docker.reference.type":"attestation-manifest"
+    },
+    "platform":{
+      "architecture":"unknown",
+      "os":"unknown"
+    }
+  }
+]

__tests__/.fixtures/imagetools-07.json

@@ -0,0 +1,15 @@
+[
+  {
+    "mediaType": "application/vnd.oci.image.manifest.v1+json",
+    "digest": "sha256:0709528fae1747ce17638ad2978ee7936b38a294136eaadaf692e415f64b1e03",
+    "size": 1113,
+    "annotations": {
+      "vnd.docker.reference.digest": "sha256:1b6bce668653f08e2d0f9f7c9b646675b2cbce94ce8abdf4eb0eabaef4353045",
+      "vnd.docker.reference.type": "attestation-manifest"
+    },
+    "platform": {
+      "architecture": "unknown",
+      "os": "unknown"
+    }
+  }
+]

__tests__/.fixtures/inspect11.txt

@@ -37,3 +37,15 @@ GC Policy rule#2:
 GC Policy rule#3:
  All:        true
  Keep Bytes: 94.06GiB
+File#buildkitd.toml:
+ > debug = true
+ > insecure-entitlements = ["network.host", "security.insecure"]
+ > trace = true
+ >
+ > [log]
+ >   format = "text"
+ >
+File#foo.txt:
+ > foo = bar
+ > baz = qux
+ >

__tests__/.fixtures/inspect12.txt

@@ -0,0 +1,55 @@
+Name:          nvidia
+Driver:        docker-container
+Last Activity: 2025-02-14 15:57:45 +0000 UTC
+
+Nodes:
+Name:                  nvidia0
+Endpoint:              unix:///var/run/docker.sock
+Driver Options:        image="moby/buildkit:local"
+Status:                running
+BuildKit daemon flags: --allow-insecure-entitlement=network.host
+BuildKit version:      v0.20.0-rc2-4-gd30d8e22c.m
+Platforms:             linux/amd64, linux/amd64/v2, linux/amd64/v3, linux/arm64, linux/riscv64, linux/ppc64le, linux/s390x, linux/386, linux/arm/v7, linux/arm/v6
+Features:
+ Cache export:         true
+ Docker exporter:      true
+ Multi-platform build: true
+ OCI exporter:         true
+Labels:
+ org.mobyproject.buildkit.worker.executor:         oci
+ org.mobyproject.buildkit.worker.hostname:         76ac9a510d96
+ org.mobyproject.buildkit.worker.network:          host
+ org.mobyproject.buildkit.worker.oci.process-mode: sandbox
+ org.mobyproject.buildkit.worker.selinux.enabled:  false
+ org.mobyproject.buildkit.worker.snapshotter:      overlayfs
+Devices:
+ Name:                  nvidia.com/gpu=all
+ Automatically allowed: true
+ Annotations:
+  foo:                                       bar
+  org.mobyproject.buildkit.device.autoallow: true
+ Name:                  docker.com/gpu=venus
+ Automatically allowed: false
+ Annotations:
+  bar:                                       baz
+GC Policy rule#0:
+ All:            false
+ Filters:        type==source.local,type==exec.cachemount,type==source.git.checkout
+ Keep Duration:  48h0m0s
+ Max Used Space: 488.3MiB
+GC Policy rule#1:
+ All:            false
+ Keep Duration:  1440h0m0s
+ Reserved Space: 9.313GiB
+ Max Used Space: 93.13GiB
+ Min Free Space: 188.1GiB
+GC Policy rule#2:
+ All:            false
+ Reserved Space: 9.313GiB
+ Max Used Space: 93.13GiB
+ Min Free Space: 188.1GiB
+GC Policy rule#3:
+ All:            true
+ Reserved Space: 9.313GiB
+ Max Used Space: 93.13GiB
+ Min Free Space: 188.1GiB

__tests__/.fixtures/sigstore/multi/linux_amd64/hello.txt

@@ -0,0 +1 @@
+Hello, World! This is linux/amd64

__tests__/.fixtures/sigstore/multi/linux_amd64/provenance.json

@@ -0,0 +1,462 @@
+{
+  "_type": "https://in-toto.io/Statement/v0.1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "hello.txt",
+      "digest": {
+        "sha256": "1b37929e66644beb58b3d28d44fba0d82aa90cab03c55a492adb81fe6e833ec8"
+      }
+    }
+  ],
+  "predicate": {
+    "buildDefinition": {
+      "buildType": "https://github.com/moby/buildkit/blob/master/docs/attestations/slsa-definitions.md",
+      "resolvedDependencies": [
+        {
+          "uri": "pkg:docker/docker/buildkit-syft-scanner@stable-1",
+          "digest": {
+            "sha256": "e930c2697be77cb7271d316ecfa78768b5eac73de3b16018ed38eb0ea0b5a7cb"
+          }
+        },
+        {
+          "uri": "pkg:docker/alpine@latest?platform=linux%2Famd64",
+          "digest": {
+            "sha256": "4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412"
+          }
+        },
+        {
+          "uri": "https://github.com/docker/github-builder-test.git#bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe",
+          "digest": {
+            "sha1": "bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe"
+          }
+        }
+      ],
+      "externalParameters": {
+        "configSource": {
+          "uri": "https://github.com/docker/github-builder-test.git#bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe",
+          "digest": {
+            "sha1": "bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe"
+          },
+          "path": "hello.Dockerfile"
+        },
+        "request": {
+          "frontend": "dockerfile.v0",
+          "secrets": [
+            {
+              "id": "GIT_AUTH_HEADER",
+              "optional": true
+            },
+            {
+              "id": "GIT_AUTH_TOKEN",
+              "optional": true
+            }
+          ]
+        }
+      },
+      "internalParameters": {
+        "buildConfig": {
+          "digestMapping": {
+            "sha256:23dcbc3cce701a8a9bbb1e33f2ea88304527a4a935c89c4564af698095463ac2": "step3",
+            "sha256:3192c1bd53f90cca959db778dcee30edc9a79f8cd3f9a2c54adc4606507fd3b6": "step0",
+            "sha256:7f1c9e959980ea3e2cf4af8ef97b6c3797a0926752b436bff11474e436defe7f": "step1",
+            "sha256:c8737331fb8e5f5bcb6b22320012d975057514982c788e63db13332a4219b984": "step2"
+          },
+          "llbDefinition": [
+            {
+              "id": "step0",
+              "op": {
+                "Op": {
+                  "source": {
+                    "identifier": "docker-image://docker.io/library/alpine:latest@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412"
+                  }
+                },
+                "constraints": {},
+                "platform": {
+                  "Architecture": "amd64",
+                  "OS": "linux"
+                }
+              }
+            },
+            {
+              "id": "step1",
+              "inputs": [
+                "step0:0"
+              ],
+              "op": {
+                "Op": {
+                  "exec": {
+                    "meta": {
+                      "args": [
+                        "/bin/sh",
+                        "-c",
+                        "echo \"Hello, World! This is ${TARGETPLATFORM}\" \u003e /hello.txt"
+                      ],
+                      "cwd": "/",
+                      "env": [
+                        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+                        "TARGETPLATFORM=linux/amd64"
+                      ],
+                      "removeMountStubsRecursive": true
+                    },
+                    "mounts": [
+                      {
+                        "dest": "/"
+                      }
+                    ]
+                  }
+                },
+                "constraints": {},
+                "platform": {
+                  "Architecture": "amd64",
+                  "OS": "linux"
+                }
+              }
+            },
+            {
+              "id": "step2",
+              "inputs": [
+                "step1:0"
+              ],
+              "op": {
+                "Op": {
+                  "file": {
+                    "actions": [
+                      {
+                        "Action": {
+                          "copy": {
+                            "allowEmptyWildcard": true,
+                            "allowWildcard": true,
+                            "createDestPath": true,
+                            "dest": "/",
+                            "dirCopyContents": true,
+                            "followSymlink": true,
+                            "mode": -1,
+                            "src": "/hello.txt",
+                            "timestamp": -1
+                          }
+                        },
+                        "input": -1,
+                        "output": 0,
+                        "secondaryInput": 0
+                      }
+                    ]
+                  }
+                },
+                "constraints": {}
+              }
+            },
+            {
+              "id": "step3",
+              "inputs": [
+                "step2:0"
+              ],
+              "op": {
+                "Op": {}
+              }
+            }
+          ]
+        },
+        "builderPlatform": "linux/amd64",
+        "github_actor": "crazy-max",
+        "github_actor_id": "1951866",
+        "github_event_name": "workflow_dispatch",
+        "github_event_payload": {
+          "enterprise": {
+            "avatar_url": "https://avatars.githubusercontent.com/b/19176?v=4",
+            "created_at": "2022-12-30T23:53:17Z",
+            "description": null,
+            "html_url": "https://github.com/enterprises/docker",
+            "id": 19176,
+            "name": "Docker",
+            "node_id": "E_kgDNSug",
+            "slug": "docker",
+            "updated_at": "2025-10-20T20:39:05Z",
+            "website_url": null
+          },
+          "inputs": null,
+          "organization": {
+            "avatar_url": "https://avatars.githubusercontent.com/u/5429470?v=4",
+            "description": "Docker helps developers bring their ideas to life by conquering the complexity of app development.",
+            "events_url": "https://api.github.com/orgs/docker/events",
+            "hooks_url": "https://api.github.com/orgs/docker/hooks",
+            "id": 5429470,
+            "issues_url": "https://api.github.com/orgs/docker/issues",
+            "login": "docker",
+            "members_url": "https://api.github.com/orgs/docker/members{/member}",
+            "node_id": "MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=",
+            "public_members_url": "https://api.github.com/orgs/docker/public_members{/member}",
+            "repos_url": "https://api.github.com/orgs/docker/repos",
+            "url": "https://api.github.com/orgs/docker"
+          },
+          "ref": "refs/heads/main",
+          "repository": {
+            "allow_forking": true,
+            "archive_url": "https://api.github.com/repos/docker/github-builder-test/{archive_format}{/ref}",
+            "archived": false,
+            "assignees_url": "https://api.github.com/repos/docker/github-builder-test/assignees{/user}",
+            "blobs_url": "https://api.github.com/repos/docker/github-builder-test/git/blobs{/sha}",
+            "branches_url": "https://api.github.com/repos/docker/github-builder-test/branches{/branch}",
+            "clone_url": "https://github.com/docker/github-builder-test.git",
+            "collaborators_url": "https://api.github.com/repos/docker/github-builder-test/collaborators{/collaborator}",
+            "comments_url": "https://api.github.com/repos/docker/github-builder-test/comments{/number}",
+            "commits_url": "https://api.github.com/repos/docker/github-builder-test/commits{/sha}",
+            "compare_url": "https://api.github.com/repos/docker/github-builder-test/compare/{base}...{head}",
+            "contents_url": "https://api.github.com/repos/docker/github-builder-test/contents/{+path}",
+            "contributors_url": "https://api.github.com/repos/docker/github-builder-test/contributors",
+            "created_at": "2025-08-19T08:08:29Z",
+            "custom_properties": {},
+            "default_branch": "main",
+            "deployments_url": "https://api.github.com/repos/docker/github-builder-test/deployments",
+            "description": "Test repo for https://github.com/docker/github-builder-experimental",
+            "disabled": false,
+            "downloads_url": "https://api.github.com/repos/docker/github-builder-test/downloads",
+            "events_url": "https://api.github.com/repos/docker/github-builder-test/events",
+            "fork": false,
+            "forks": 0,
+            "forks_count": 0,
+            "forks_url": "https://api.github.com/repos/docker/github-builder-test/forks",
+            "full_name": "docker/github-builder-test",
+            "git_commits_url": "https://api.github.com/repos/docker/github-builder-test/git/commits{/sha}",
+            "git_refs_url": "https://api.github.com/repos/docker/github-builder-test/git/refs{/sha}",
+            "git_tags_url": "https://api.github.com/repos/docker/github-builder-test/git/tags{/sha}",
+            "git_url": "git://github.com/docker/github-builder-test.git",
+            "has_discussions": false,
+            "has_downloads": true,
+            "has_issues": false,
+            "has_pages": false,
+            "has_projects": false,
+            "has_wiki": false,
+            "homepage": null,
+            "hooks_url": "https://api.github.com/repos/docker/github-builder-test/hooks",
+            "html_url": "https://github.com/docker/github-builder-test",
+            "id": 1040594287,
+            "is_template": false,
+            "issue_comment_url": "https://api.github.com/repos/docker/github-builder-test/issues/comments{/number}",
+            "issue_events_url": "https://api.github.com/repos/docker/github-builder-test/issues/events{/number}",
+            "issues_url": "https://api.github.com/repos/docker/github-builder-test/issues{/number}",
+            "keys_url": "https://api.github.com/repos/docker/github-builder-test/keys{/key_id}",
+            "labels_url": "https://api.github.com/repos/docker/github-builder-test/labels{/name}",
+            "language": "Dockerfile",
+            "languages_url": "https://api.github.com/repos/docker/github-builder-test/languages",
+            "license": null,
+            "merges_url": "https://api.github.com/repos/docker/github-builder-test/merges",
+            "milestones_url": "https://api.github.com/repos/docker/github-builder-test/milestones{/number}",
+            "mirror_url": null,
+            "name": "github-builder-test",
+            "node_id": "R_kgDOPgY1bw",
+            "notifications_url": "https://api.github.com/repos/docker/github-builder-test/notifications{?since,all,participating}",
+            "open_issues": 0,
+            "open_issues_count": 0,
+            "owner": {
+              "avatar_url": "https://avatars.githubusercontent.com/u/5429470?v=4",
+              "events_url": "https://api.github.com/users/docker/events{/privacy}",
+              "followers_url": "https://api.github.com/users/docker/followers",
+              "following_url": "https://api.github.com/users/docker/following{/other_user}",
+              "gists_url": "https://api.github.com/users/docker/gists{/gist_id}",
+              "gravatar_id": "",
+              "html_url": "https://github.com/docker",
+              "id": 5429470,
+              "login": "docker",
+              "node_id": "MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=",
+              "organizations_url": "https://api.github.com/users/docker/orgs",
+              "received_events_url": "https://api.github.com/users/docker/received_events",
+              "repos_url": "https://api.github.com/users/docker/repos",
+              "site_admin": false,
+              "starred_url": "https://api.github.com/users/docker/starred{/owner}{/repo}",
+              "subscriptions_url": "https://api.github.com/users/docker/subscriptions",
+              "type": "Organization",
+              "url": "https://api.github.com/users/docker",
+              "user_view_type": "public"
+            },
+            "private": true,
+            "pulls_url": "https://api.github.com/repos/docker/github-builder-test/pulls{/number}",
+            "pushed_at": "2025-10-30T10:04:10Z",
+            "releases_url": "https://api.github.com/repos/docker/github-builder-test/releases{/id}",
+            "size": 25,
+            "ssh_url": "git@github.com:docker/github-builder-test.git",
+            "stargazers_count": 0,
+            "stargazers_url": "https://api.github.com/repos/docker/github-builder-test/stargazers",
+            "statuses_url": "https://api.github.com/repos/docker/github-builder-test/statuses/{sha}",
+            "subscribers_url": "https://api.github.com/repos/docker/github-builder-test/subscribers",
+            "subscription_url": "https://api.github.com/repos/docker/github-builder-test/subscription",
+            "svn_url": "https://github.com/docker/github-builder-test",
+            "tags_url": "https://api.github.com/repos/docker/github-builder-test/tags",
+            "teams_url": "https://api.github.com/repos/docker/github-builder-test/teams",
+            "topics": [],
+            "trees_url": "https://api.github.com/repos/docker/github-builder-test/git/trees{/sha}",
+            "updated_at": "2025-10-30T10:04:14Z",
+            "url": "https://api.github.com/repos/docker/github-builder-test",
+            "visibility": "internal",
+            "watchers": 0,
+            "watchers_count": 0,
+            "web_commit_signoff_required": false
+          },
+          "sender": {
+            "avatar_url": "https://avatars.githubusercontent.com/u/1951866?v=4",
+            "events_url": "https://api.github.com/users/crazy-max/events{/privacy}",
+            "followers_url": "https://api.github.com/users/crazy-max/followers",
+            "following_url": "https://api.github.com/users/crazy-max/following{/other_user}",
+            "gists_url": "https://api.github.com/users/crazy-max/gists{/gist_id}",
+            "gravatar_id": "",
+            "html_url": "https://github.com/crazy-max",
+            "id": 1951866,
+            "login": "crazy-max",
+            "node_id": "MDQ6VXNlcjE5NTE4NjY=",
+            "organizations_url": "https://api.github.com/users/crazy-max/orgs",
+            "received_events_url": "https://api.github.com/users/crazy-max/received_events",
+            "repos_url": "https://api.github.com/users/crazy-max/repos",
+            "site_admin": false,
+            "starred_url": "https://api.github.com/users/crazy-max/starred{/owner}{/repo}",
+            "subscriptions_url": "https://api.github.com/users/crazy-max/subscriptions",
+            "type": "User",
+            "url": "https://api.github.com/users/crazy-max",
+            "user_view_type": "public"
+          },
+          "workflow": ".github/workflows/ci.yml"
+        },
+        "github_job": "build",
+        "github_ref": "refs/heads/main",
+        "github_ref_name": "main",
+        "github_ref_protected": "false",
+        "github_ref_type": "branch",
+        "github_repository": "docker/github-builder-test",
+        "github_repository_id": "1040594287",
+        "github_repository_owner": "docker",
+        "github_repository_owner_id": "5429470",
+        "github_run_attempt": "1",
+        "github_run_id": "18937328894",
+        "github_run_number": "183",
+        "github_runner_arch": "X64",
+        "github_runner_environment": "github-hosted",
+        "github_runner_image_os": "ubuntu24",
+        "github_runner_image_version": "20250929.60.1",
+        "github_runner_name": "GitHub Actions 1002376925",
+        "github_runner_os": "Linux",
+        "github_runner_tracking_id": "github_7c0a7521-2999-41e5-af30-b7f0681f204f",
+        "github_server_url": "https://github.com",
+        "github_triggering_actor": "crazy-max",
+        "github_workflow": "ci",
+        "github_workflow_ref": "docker/github-builder-test/.github/workflows/ci.yml@refs/heads/main",
+        "github_workflow_sha": "bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe"
+      }
+    },
+    "runDetails": {
+      "builder": {
+        "id": "https://github.com/docker/github-builder-test/actions/runs/18937328894/attempts/1"
+      },
+      "metadata": {
+        "invocationID": "7qg2yuux3iklv02ktbmbtwgeb",
+        "startedOn": "2025-10-30T10:19:52.868710505Z",
+        "finishedOn": "2025-10-30T10:19:57.635810119Z",
+        "buildkit_metadata": {
+          "source": {
+            "locations": {
+              "step0": {
+                "locations": [
+                  {
+                    "ranges": [
+                      {
+                        "start": {
+                          "line": 1
+                        },
+                        "end": {
+                          "line": 1
+                        }
+                      }
+                    ]
+                  }
+                ]
+              },
+              "step1": {
+                "locations": [
+                  {
+                    "ranges": [
+                      {
+                        "start": {
+                          "line": 3
+                        },
+                        "end": {
+                          "line": 3
+                        }
+                      }
+                    ]
+                  }
+                ]
+              },
+              "step2": {
+                "locations": [
+                  {
+                    "ranges": [
+                      {
+                        "start": {
+                          "line": 7
+                        },
+                        "end": {
+                          "line": 7
+                        }
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            "infos": [
+              {
+                "filename": "hello.Dockerfile",
+                "language": "Dockerfile",
+                "data": "RlJPTSBhbHBpbmUgQVMgYmFzZQpBUkcgVEFSR0VUUExBVEZPUk0KUlVOIGVjaG8gIkhlbGxvLCBXb3JsZCEgVGhpcyBpcyAke1RBUkdFVFBMQVRGT1JNfSIgPiAvaGVsbG8udHh0CkFSRyBCVUlMREtJVF9TQk9NX1NDQU5fU1RBR0U9dHJ1ZQoKRlJPTSBzY3JhdGNoCkNPUFkgLS1mcm9tPWJhc2UgL2hlbGxvLnR4dCAvCg==",
+                "llbDefinition": [
+                  {
+                    "id": "step0",
+                    "op": {
+                      "Op": {
+                        "source": {
+                          "identifier": "git://github.com/docker/github-builder-test.git#bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe",
+                          "attrs": {
+                            "git.authheadersecret": "GIT_AUTH_HEADER",
+                            "git.authtokensecret": "GIT_AUTH_TOKEN",
+                            "git.fullurl": "https://github.com/docker/github-builder-test.git"
+                          }
+                        }
+                      },
+                      "constraints": {}
+                    }
+                  },
+                  {
+                    "id": "step1",
+                    "op": {
+                      "Op": {}
+                    },
+                    "inputs": [
+                      "step0:0"
+                    ]
+                  }
+                ],
+                "digestMapping": {
+                  "sha256:47540f0959d81a7ff2fc9742b9ef0bb37d7eca99c13aa6df83b883d06e808ef2": "step0",
+                  "sha256:96933c546ff00debd500304305864192fcb51d348e8c41b6a6e1569a051e66ed": "step1"
+                }
+              }
+            ]
+          },
+          "layers": {
+            "step0:0": [
+              [
+                {
+                  "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
+                  "digest": "sha256:2d35ebdb57d9971fea0cac1582aa78935adf8058b2cc32db163c98822e5dfa1b",
+                  "size": 3802452
+                }
+              ]
+            ]
+          }
+        },
+        "buildkit_completeness": {
+          "request": true,
+          "resolvedDependencies": true
+        }
+      }
+    }
+  }
+}

__tests__/.fixtures/sigstore/multi/linux_arm64/hello.txt

@@ -0,0 +1 @@
+Hello, World! This is linux/arm64

__tests__/.fixtures/sigstore/multi/linux_arm64/provenance.json

@@ -0,0 +1,462 @@
+{
+  "_type": "https://in-toto.io/Statement/v0.1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "hello.txt",
+      "digest": {
+        "sha256": "870e0065e68cbdeacbf9cec21b598bb579b0ef55bc48b65b71509667edb570bd"
+      }
+    }
+  ],
+  "predicate": {
+    "buildDefinition": {
+      "buildType": "https://github.com/moby/buildkit/blob/master/docs/attestations/slsa-definitions.md",
+      "resolvedDependencies": [
+        {
+          "uri": "pkg:docker/docker/buildkit-syft-scanner@stable-1",
+          "digest": {
+            "sha256": "e930c2697be77cb7271d316ecfa78768b5eac73de3b16018ed38eb0ea0b5a7cb"
+          }
+        },
+        {
+          "uri": "pkg:docker/alpine@latest?platform=linux%2Farm64",
+          "digest": {
+            "sha256": "4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412"
+          }
+        },
+        {
+          "uri": "https://github.com/docker/github-builder-test.git#bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe",
+          "digest": {
+            "sha1": "bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe"
+          }
+        }
+      ],
+      "externalParameters": {
+        "configSource": {
+          "uri": "https://github.com/docker/github-builder-test.git#bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe",
+          "digest": {
+            "sha1": "bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe"
+          },
+          "path": "hello.Dockerfile"
+        },
+        "request": {
+          "frontend": "dockerfile.v0",
+          "secrets": [
+            {
+              "id": "GIT_AUTH_HEADER",
+              "optional": true
+            },
+            {
+              "id": "GIT_AUTH_TOKEN",
+              "optional": true
+            }
+          ]
+        }
+      },
+      "internalParameters": {
+        "buildConfig": {
+          "digestMapping": {
+            "sha256:69f88b22af1cbbe236f4b5d834dfe9c4adb9535c1c602f726fd90212c302a7da": "step0",
+            "sha256:98c0e3a8b1a38f5aa8db558b99aace8e7645a18b0e24d6807018146d21788ae2": "step2",
+            "sha256:a560219f1e0cfb232a9727b9bbf9d6735c0b2190f8e00364f844cfc82bd42479": "step1",
+            "sha256:c7edeef726371083a69f15a3565d6c62be55a91e820f251d9a965f8e36fe3e32": "step3"
+          },
+          "llbDefinition": [
+            {
+              "id": "step0",
+              "op": {
+                "Op": {
+                  "source": {
+                    "identifier": "docker-image://docker.io/library/alpine:latest@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412"
+                  }
+                },
+                "constraints": {},
+                "platform": {
+                  "Architecture": "arm64",
+                  "OS": "linux"
+                }
+              }
+            },
+            {
+              "id": "step1",
+              "inputs": [
+                "step0:0"
+              ],
+              "op": {
+                "Op": {
+                  "exec": {
+                    "meta": {
+                      "args": [
+                        "/bin/sh",
+                        "-c",
+                        "echo \"Hello, World! This is ${TARGETPLATFORM}\" \u003e /hello.txt"
+                      ],
+                      "cwd": "/",
+                      "env": [
+                        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+                        "TARGETPLATFORM=linux/arm64"
+                      ],
+                      "removeMountStubsRecursive": true
+                    },
+                    "mounts": [
+                      {
+                        "dest": "/"
+                      }
+                    ]
+                  }
+                },
+                "constraints": {},
+                "platform": {
+                  "Architecture": "arm64",
+                  "OS": "linux"
+                }
+              }
+            },
+            {
+              "id": "step2",
+              "inputs": [
+                "step1:0"
+              ],
+              "op": {
+                "Op": {
+                  "file": {
+                    "actions": [
+                      {
+                        "Action": {
+                          "copy": {
+                            "allowEmptyWildcard": true,
+                            "allowWildcard": true,
+                            "createDestPath": true,
+                            "dest": "/",
+                            "dirCopyContents": true,
+                            "followSymlink": true,
+                            "mode": -1,
+                            "src": "/hello.txt",
+                            "timestamp": -1
+                          }
+                        },
+                        "input": -1,
+                        "output": 0,
+                        "secondaryInput": 0
+                      }
+                    ]
+                  }
+                },
+                "constraints": {}
+              }
+            },
+            {
+              "id": "step3",
+              "inputs": [
+                "step2:0"
+              ],
+              "op": {
+                "Op": {}
+              }
+            }
+          ]
+        },
+        "builderPlatform": "linux/amd64",
+        "github_actor": "crazy-max",
+        "github_actor_id": "1951866",
+        "github_event_name": "workflow_dispatch",
+        "github_event_payload": {
+          "enterprise": {
+            "avatar_url": "https://avatars.githubusercontent.com/b/19176?v=4",
+            "created_at": "2022-12-30T23:53:17Z",
+            "description": null,
+            "html_url": "https://github.com/enterprises/docker",
+            "id": 19176,
+            "name": "Docker",
+            "node_id": "E_kgDNSug",
+            "slug": "docker",
+            "updated_at": "2025-10-20T20:39:05Z",
+            "website_url": null
+          },
+          "inputs": null,
+          "organization": {
+            "avatar_url": "https://avatars.githubusercontent.com/u/5429470?v=4",
+            "description": "Docker helps developers bring their ideas to life by conquering the complexity of app development.",
+            "events_url": "https://api.github.com/orgs/docker/events",
+            "hooks_url": "https://api.github.com/orgs/docker/hooks",
+            "id": 5429470,
+            "issues_url": "https://api.github.com/orgs/docker/issues",
+            "login": "docker",
+            "members_url": "https://api.github.com/orgs/docker/members{/member}",
+            "node_id": "MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=",
+            "public_members_url": "https://api.github.com/orgs/docker/public_members{/member}",
+            "repos_url": "https://api.github.com/orgs/docker/repos",
+            "url": "https://api.github.com/orgs/docker"
+          },
+          "ref": "refs/heads/main",
+          "repository": {
+            "allow_forking": true,
+            "archive_url": "https://api.github.com/repos/docker/github-builder-test/{archive_format}{/ref}",
+            "archived": false,
+            "assignees_url": "https://api.github.com/repos/docker/github-builder-test/assignees{/user}",
+            "blobs_url": "https://api.github.com/repos/docker/github-builder-test/git/blobs{/sha}",
+            "branches_url": "https://api.github.com/repos/docker/github-builder-test/branches{/branch}",
+            "clone_url": "https://github.com/docker/github-builder-test.git",
+            "collaborators_url": "https://api.github.com/repos/docker/github-builder-test/collaborators{/collaborator}",
+            "comments_url": "https://api.github.com/repos/docker/github-builder-test/comments{/number}",
+            "commits_url": "https://api.github.com/repos/docker/github-builder-test/commits{/sha}",
+            "compare_url": "https://api.github.com/repos/docker/github-builder-test/compare/{base}...{head}",
+            "contents_url": "https://api.github.com/repos/docker/github-builder-test/contents/{+path}",
+            "contributors_url": "https://api.github.com/repos/docker/github-builder-test/contributors",
+            "created_at": "2025-08-19T08:08:29Z",
+            "custom_properties": {},
+            "default_branch": "main",
+            "deployments_url": "https://api.github.com/repos/docker/github-builder-test/deployments",
+            "description": "Test repo for https://github.com/docker/github-builder-experimental",
+            "disabled": false,
+            "downloads_url": "https://api.github.com/repos/docker/github-builder-test/downloads",
+            "events_url": "https://api.github.com/repos/docker/github-builder-test/events",
+            "fork": false,
+            "forks": 0,
+            "forks_count": 0,
+            "forks_url": "https://api.github.com/repos/docker/github-builder-test/forks",
+            "full_name": "docker/github-builder-test",
+            "git_commits_url": "https://api.github.com/repos/docker/github-builder-test/git/commits{/sha}",
+            "git_refs_url": "https://api.github.com/repos/docker/github-builder-test/git/refs{/sha}",
+            "git_tags_url": "https://api.github.com/repos/docker/github-builder-test/git/tags{/sha}",
+            "git_url": "git://github.com/docker/github-builder-test.git",
+            "has_discussions": false,
+            "has_downloads": true,
+            "has_issues": false,
+            "has_pages": false,
+            "has_projects": false,
+            "has_wiki": false,
+            "homepage": null,
+            "hooks_url": "https://api.github.com/repos/docker/github-builder-test/hooks",
+            "html_url": "https://github.com/docker/github-builder-test",
+            "id": 1040594287,
+            "is_template": false,
+            "issue_comment_url": "https://api.github.com/repos/docker/github-builder-test/issues/comments{/number}",
+            "issue_events_url": "https://api.github.com/repos/docker/github-builder-test/issues/events{/number}",
+            "issues_url": "https://api.github.com/repos/docker/github-builder-test/issues{/number}",
+            "keys_url": "https://api.github.com/repos/docker/github-builder-test/keys{/key_id}",
+            "labels_url": "https://api.github.com/repos/docker/github-builder-test/labels{/name}",
+            "language": "Dockerfile",
+            "languages_url": "https://api.github.com/repos/docker/github-builder-test/languages",
+            "license": null,
+            "merges_url": "https://api.github.com/repos/docker/github-builder-test/merges",
+            "milestones_url": "https://api.github.com/repos/docker/github-builder-test/milestones{/number}",
+            "mirror_url": null,
+            "name": "github-builder-test",
+            "node_id": "R_kgDOPgY1bw",
+            "notifications_url": "https://api.github.com/repos/docker/github-builder-test/notifications{?since,all,participating}",
+            "open_issues": 0,
+            "open_issues_count": 0,
+            "owner": {
+              "avatar_url": "https://avatars.githubusercontent.com/u/5429470?v=4",
+              "events_url": "https://api.github.com/users/docker/events{/privacy}",
+              "followers_url": "https://api.github.com/users/docker/followers",
+              "following_url": "https://api.github.com/users/docker/following{/other_user}",
+              "gists_url": "https://api.github.com/users/docker/gists{/gist_id}",
+              "gravatar_id": "",
+              "html_url": "https://github.com/docker",
+              "id": 5429470,
+              "login": "docker",
+              "node_id": "MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=",
+              "organizations_url": "https://api.github.com/users/docker/orgs",
+              "received_events_url": "https://api.github.com/users/docker/received_events",
+              "repos_url": "https://api.github.com/users/docker/repos",
+              "site_admin": false,
+              "starred_url": "https://api.github.com/users/docker/starred{/owner}{/repo}",
+              "subscriptions_url": "https://api.github.com/users/docker/subscriptions",
+              "type": "Organization",
+              "url": "https://api.github.com/users/docker",
+              "user_view_type": "public"
+            },
+            "private": true,
+            "pulls_url": "https://api.github.com/repos/docker/github-builder-test/pulls{/number}",
+            "pushed_at": "2025-10-30T10:04:10Z",
+            "releases_url": "https://api.github.com/repos/docker/github-builder-test/releases{/id}",
+            "size": 25,
+            "ssh_url": "git@github.com:docker/github-builder-test.git",
+            "stargazers_count": 0,
+            "stargazers_url": "https://api.github.com/repos/docker/github-builder-test/stargazers",
+            "statuses_url": "https://api.github.com/repos/docker/github-builder-test/statuses/{sha}",
+            "subscribers_url": "https://api.github.com/repos/docker/github-builder-test/subscribers",
+            "subscription_url": "https://api.github.com/repos/docker/github-builder-test/subscription",
+            "svn_url": "https://github.com/docker/github-builder-test",
+            "tags_url": "https://api.github.com/repos/docker/github-builder-test/tags",
+            "teams_url": "https://api.github.com/repos/docker/github-builder-test/teams",
+            "topics": [],
+            "trees_url": "https://api.github.com/repos/docker/github-builder-test/git/trees{/sha}",
+            "updated_at": "2025-10-30T10:04:14Z",
+            "url": "https://api.github.com/repos/docker/github-builder-test",
+            "visibility": "internal",
+            "watchers": 0,
+            "watchers_count": 0,
+            "web_commit_signoff_required": false
+          },
+          "sender": {
+            "avatar_url": "https://avatars.githubusercontent.com/u/1951866?v=4",
+            "events_url": "https://api.github.com/users/crazy-max/events{/privacy}",
+            "followers_url": "https://api.github.com/users/crazy-max/followers",
+            "following_url": "https://api.github.com/users/crazy-max/following{/other_user}",
+            "gists_url": "https://api.github.com/users/crazy-max/gists{/gist_id}",
+            "gravatar_id": "",
+            "html_url": "https://github.com/crazy-max",
+            "id": 1951866,
+            "login": "crazy-max",
+            "node_id": "MDQ6VXNlcjE5NTE4NjY=",
+            "organizations_url": "https://api.github.com/users/crazy-max/orgs",
+            "received_events_url": "https://api.github.com/users/crazy-max/received_events",
+            "repos_url": "https://api.github.com/users/crazy-max/repos",
+            "site_admin": false,
+            "starred_url": "https://api.github.com/users/crazy-max/starred{/owner}{/repo}",
+            "subscriptions_url": "https://api.github.com/users/crazy-max/subscriptions",
+            "type": "User",
+            "url": "https://api.github.com/users/crazy-max",
+            "user_view_type": "public"
+          },
+          "workflow": ".github/workflows/ci.yml"
+        },
+        "github_job": "build",
+        "github_ref": "refs/heads/main",
+        "github_ref_name": "main",
+        "github_ref_protected": "false",
+        "github_ref_type": "branch",
+        "github_repository": "docker/github-builder-test",
+        "github_repository_id": "1040594287",
+        "github_repository_owner": "docker",
+        "github_repository_owner_id": "5429470",
+        "github_run_attempt": "1",
+        "github_run_id": "18937328894",
+        "github_run_number": "183",
+        "github_runner_arch": "X64",
+        "github_runner_environment": "github-hosted",
+        "github_runner_image_os": "ubuntu24",
+        "github_runner_image_version": "20250929.60.1",
+        "github_runner_name": "GitHub Actions 1002376925",
+        "github_runner_os": "Linux",
+        "github_runner_tracking_id": "github_7c0a7521-2999-41e5-af30-b7f0681f204f",
+        "github_server_url": "https://github.com",
+        "github_triggering_actor": "crazy-max",
+        "github_workflow": "ci",
+        "github_workflow_ref": "docker/github-builder-test/.github/workflows/ci.yml@refs/heads/main",
+        "github_workflow_sha": "bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe"
+      }
+    },
+    "runDetails": {
+      "builder": {
+        "id": "https://github.com/docker/github-builder-test/actions/runs/18937328894/attempts/1"
+      },
+      "metadata": {
+        "invocationID": "7qg2yuux3iklv02ktbmbtwgeb",
+        "startedOn": "2025-10-30T10:19:52.868710505Z",
+        "finishedOn": "2025-10-30T10:19:57.635810119Z",
+        "buildkit_metadata": {
+          "source": {
+            "locations": {
+              "step0": {
+                "locations": [
+                  {
+                    "ranges": [
+                      {
+                        "start": {
+                          "line": 1
+                        },
+                        "end": {
+                          "line": 1
+                        }
+                      }
+                    ]
+                  }
+                ]
+              },
+              "step1": {
+                "locations": [
+                  {
+                    "ranges": [
+                      {
+                        "start": {
+                          "line": 3
+                        },
+                        "end": {
+                          "line": 3
+                        }
+                      }
+                    ]
+                  }
+                ]
+              },
+              "step2": {
+                "locations": [
+                  {
+                    "ranges": [
+                      {
+                        "start": {
+                          "line": 7
+                        },
+                        "end": {
+                          "line": 7
+                        }
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            "infos": [
+              {
+                "filename": "hello.Dockerfile",
+                "language": "Dockerfile",
+                "data": "RlJPTSBhbHBpbmUgQVMgYmFzZQpBUkcgVEFSR0VUUExBVEZPUk0KUlVOIGVjaG8gIkhlbGxvLCBXb3JsZCEgVGhpcyBpcyAke1RBUkdFVFBMQVRGT1JNfSIgPiAvaGVsbG8udHh0CkFSRyBCVUlMREtJVF9TQk9NX1NDQU5fU1RBR0U9dHJ1ZQoKRlJPTSBzY3JhdGNoCkNPUFkgLS1mcm9tPWJhc2UgL2hlbGxvLnR4dCAvCg==",
+                "llbDefinition": [
+                  {
+                    "id": "step0",
+                    "op": {
+                      "Op": {
+                        "source": {
+                          "identifier": "git://github.com/docker/github-builder-test.git#bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe",
+                          "attrs": {
+                            "git.authheadersecret": "GIT_AUTH_HEADER",
+                            "git.authtokensecret": "GIT_AUTH_TOKEN",
+                            "git.fullurl": "https://github.com/docker/github-builder-test.git"
+                          }
+                        }
+                      },
+                      "constraints": {}
+                    }
+                  },
+                  {
+                    "id": "step1",
+                    "op": {
+                      "Op": {}
+                    },
+                    "inputs": [
+                      "step0:0"
+                    ]
+                  }
+                ],
+                "digestMapping": {
+                  "sha256:47540f0959d81a7ff2fc9742b9ef0bb37d7eca99c13aa6df83b883d06e808ef2": "step0",
+                  "sha256:96933c546ff00debd500304305864192fcb51d348e8c41b6a6e1569a051e66ed": "step1"
+                }
+              }
+            ]
+          },
+          "layers": {
+            "step0:0": [
+              [
+                {
+                  "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
+                  "digest": "sha256:6b59a28fa20117e6048ad0616b8d8c901877ef15ff4c7f18db04e4f01f43bc39",
+                  "size": 4138069
+                }
+              ]
+            ]
+          }
+        },
+        "buildkit_completeness": {
+          "request": true,
+          "resolvedDependencies": true
+        }
+      }
+    }
+  }
+}

__tests__/.fixtures/sigstore/single/hello.txt

@@ -0,0 +1 @@
+Hello, World! This is linux/amd64

__tests__/.fixtures/sigstore/single/provenance.json

@@ -0,0 +1,462 @@
+{
+  "_type": "https://in-toto.io/Statement/v0.1",
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "subject": [
+    {
+      "name": "hello.txt",
+      "digest": {
+        "sha256": "1b37929e66644beb58b3d28d44fba0d82aa90cab03c55a492adb81fe6e833ec8"
+      }
+    }
+  ],
+  "predicate": {
+    "buildDefinition": {
+      "buildType": "https://github.com/moby/buildkit/blob/master/docs/attestations/slsa-definitions.md",
+      "resolvedDependencies": [
+        {
+          "uri": "pkg:docker/docker/buildkit-syft-scanner@stable-1",
+          "digest": {
+            "sha256": "e930c2697be77cb7271d316ecfa78768b5eac73de3b16018ed38eb0ea0b5a7cb"
+          }
+        },
+        {
+          "uri": "pkg:docker/alpine@latest?platform=linux%2Famd64",
+          "digest": {
+            "sha256": "4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412"
+          }
+        },
+        {
+          "uri": "https://github.com/docker/github-builder-test.git#bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe",
+          "digest": {
+            "sha1": "bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe"
+          }
+        }
+      ],
+      "externalParameters": {
+        "configSource": {
+          "uri": "https://github.com/docker/github-builder-test.git#bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe",
+          "digest": {
+            "sha1": "bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe"
+          },
+          "path": "hello.Dockerfile"
+        },
+        "request": {
+          "frontend": "dockerfile.v0",
+          "secrets": [
+            {
+              "id": "GIT_AUTH_HEADER",
+              "optional": true
+            },
+            {
+              "id": "GIT_AUTH_TOKEN",
+              "optional": true
+            }
+          ]
+        }
+      },
+      "internalParameters": {
+        "buildConfig": {
+          "digestMapping": {
+            "sha256:23dcbc3cce701a8a9bbb1e33f2ea88304527a4a935c89c4564af698095463ac2": "step3",
+            "sha256:3192c1bd53f90cca959db778dcee30edc9a79f8cd3f9a2c54adc4606507fd3b6": "step0",
+            "sha256:7f1c9e959980ea3e2cf4af8ef97b6c3797a0926752b436bff11474e436defe7f": "step1",
+            "sha256:c8737331fb8e5f5bcb6b22320012d975057514982c788e63db13332a4219b984": "step2"
+          },
+          "llbDefinition": [
+            {
+              "id": "step0",
+              "op": {
+                "Op": {
+                  "source": {
+                    "identifier": "docker-image://docker.io/library/alpine:latest@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412"
+                  }
+                },
+                "constraints": {},
+                "platform": {
+                  "Architecture": "amd64",
+                  "OS": "linux"
+                }
+              }
+            },
+            {
+              "id": "step1",
+              "inputs": [
+                "step0:0"
+              ],
+              "op": {
+                "Op": {
+                  "exec": {
+                    "meta": {
+                      "args": [
+                        "/bin/sh",
+                        "-c",
+                        "echo \"Hello, World! This is ${TARGETPLATFORM}\" \u003e /hello.txt"
+                      ],
+                      "cwd": "/",
+                      "env": [
+                        "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+                        "TARGETPLATFORM=linux/amd64"
+                      ],
+                      "removeMountStubsRecursive": true
+                    },
+                    "mounts": [
+                      {
+                        "dest": "/"
+                      }
+                    ]
+                  }
+                },
+                "constraints": {},
+                "platform": {
+                  "Architecture": "amd64",
+                  "OS": "linux"
+                }
+              }
+            },
+            {
+              "id": "step2",
+              "inputs": [
+                "step1:0"
+              ],
+              "op": {
+                "Op": {
+                  "file": {
+                    "actions": [
+                      {
+                        "Action": {
+                          "copy": {
+                            "allowEmptyWildcard": true,
+                            "allowWildcard": true,
+                            "createDestPath": true,
+                            "dest": "/",
+                            "dirCopyContents": true,
+                            "followSymlink": true,
+                            "mode": -1,
+                            "src": "/hello.txt",
+                            "timestamp": -1
+                          }
+                        },
+                        "input": -1,
+                        "output": 0,
+                        "secondaryInput": 0
+                      }
+                    ]
+                  }
+                },
+                "constraints": {}
+              }
+            },
+            {
+              "id": "step3",
+              "inputs": [
+                "step2:0"
+              ],
+              "op": {
+                "Op": {}
+              }
+            }
+          ]
+        },
+        "builderPlatform": "linux/amd64",
+        "github_actor": "crazy-max",
+        "github_actor_id": "1951866",
+        "github_event_name": "workflow_dispatch",
+        "github_event_payload": {
+          "enterprise": {
+            "avatar_url": "https://avatars.githubusercontent.com/b/19176?v=4",
+            "created_at": "2022-12-30T23:53:17Z",
+            "description": null,
+            "html_url": "https://github.com/enterprises/docker",
+            "id": 19176,
+            "name": "Docker",
+            "node_id": "E_kgDNSug",
+            "slug": "docker",
+            "updated_at": "2025-10-20T20:39:05Z",
+            "website_url": null
+          },
+          "inputs": null,
+          "organization": {
+            "avatar_url": "https://avatars.githubusercontent.com/u/5429470?v=4",
+            "description": "Docker helps developers bring their ideas to life by conquering the complexity of app development.",
+            "events_url": "https://api.github.com/orgs/docker/events",
+            "hooks_url": "https://api.github.com/orgs/docker/hooks",
+            "id": 5429470,
+            "issues_url": "https://api.github.com/orgs/docker/issues",
+            "login": "docker",
+            "members_url": "https://api.github.com/orgs/docker/members{/member}",
+            "node_id": "MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=",
+            "public_members_url": "https://api.github.com/orgs/docker/public_members{/member}",
+            "repos_url": "https://api.github.com/orgs/docker/repos",
+            "url": "https://api.github.com/orgs/docker"
+          },
+          "ref": "refs/heads/main",
+          "repository": {
+            "allow_forking": true,
+            "archive_url": "https://api.github.com/repos/docker/github-builder-test/{archive_format}{/ref}",
+            "archived": false,
+            "assignees_url": "https://api.github.com/repos/docker/github-builder-test/assignees{/user}",
+            "blobs_url": "https://api.github.com/repos/docker/github-builder-test/git/blobs{/sha}",
+            "branches_url": "https://api.github.com/repos/docker/github-builder-test/branches{/branch}",
+            "clone_url": "https://github.com/docker/github-builder-test.git",
+            "collaborators_url": "https://api.github.com/repos/docker/github-builder-test/collaborators{/collaborator}",
+            "comments_url": "https://api.github.com/repos/docker/github-builder-test/comments{/number}",
+            "commits_url": "https://api.github.com/repos/docker/github-builder-test/commits{/sha}",
+            "compare_url": "https://api.github.com/repos/docker/github-builder-test/compare/{base}...{head}",
+            "contents_url": "https://api.github.com/repos/docker/github-builder-test/contents/{+path}",
+            "contributors_url": "https://api.github.com/repos/docker/github-builder-test/contributors",
+            "created_at": "2025-08-19T08:08:29Z",
+            "custom_properties": {},
+            "default_branch": "main",
+            "deployments_url": "https://api.github.com/repos/docker/github-builder-test/deployments",
+            "description": "Test repo for https://github.com/docker/github-builder-experimental",
+            "disabled": false,
+            "downloads_url": "https://api.github.com/repos/docker/github-builder-test/downloads",
+            "events_url": "https://api.github.com/repos/docker/github-builder-test/events",
+            "fork": false,
+            "forks": 0,
+            "forks_count": 0,
+            "forks_url": "https://api.github.com/repos/docker/github-builder-test/forks",
+            "full_name": "docker/github-builder-test",
+            "git_commits_url": "https://api.github.com/repos/docker/github-builder-test/git/commits{/sha}",
+            "git_refs_url": "https://api.github.com/repos/docker/github-builder-test/git/refs{/sha}",
+            "git_tags_url": "https://api.github.com/repos/docker/github-builder-test/git/tags{/sha}",
+            "git_url": "git://github.com/docker/github-builder-test.git",
+            "has_discussions": false,
+            "has_downloads": true,
+            "has_issues": false,
+            "has_pages": false,
+            "has_projects": false,
+            "has_wiki": false,
+            "homepage": null,
+            "hooks_url": "https://api.github.com/repos/docker/github-builder-test/hooks",
+            "html_url": "https://github.com/docker/github-builder-test",
+            "id": 1040594287,
+            "is_template": false,
+            "issue_comment_url": "https://api.github.com/repos/docker/github-builder-test/issues/comments{/number}",
+            "issue_events_url": "https://api.github.com/repos/docker/github-builder-test/issues/events{/number}",
+            "issues_url": "https://api.github.com/repos/docker/github-builder-test/issues{/number}",
+            "keys_url": "https://api.github.com/repos/docker/github-builder-test/keys{/key_id}",
+            "labels_url": "https://api.github.com/repos/docker/github-builder-test/labels{/name}",
+            "language": "Dockerfile",
+            "languages_url": "https://api.github.com/repos/docker/github-builder-test/languages",
+            "license": null,
+            "merges_url": "https://api.github.com/repos/docker/github-builder-test/merges",
+            "milestones_url": "https://api.github.com/repos/docker/github-builder-test/milestones{/number}",
+            "mirror_url": null,
+            "name": "github-builder-test",
+            "node_id": "R_kgDOPgY1bw",
+            "notifications_url": "https://api.github.com/repos/docker/github-builder-test/notifications{?since,all,participating}",
+            "open_issues": 0,
+            "open_issues_count": 0,
+            "owner": {
+              "avatar_url": "https://avatars.githubusercontent.com/u/5429470?v=4",
+              "events_url": "https://api.github.com/users/docker/events{/privacy}",
+              "followers_url": "https://api.github.com/users/docker/followers",
+              "following_url": "https://api.github.com/users/docker/following{/other_user}",
+              "gists_url": "https://api.github.com/users/docker/gists{/gist_id}",
+              "gravatar_id": "",
+              "html_url": "https://github.com/docker",
+              "id": 5429470,
+              "login": "docker",
+              "node_id": "MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=",
+              "organizations_url": "https://api.github.com/users/docker/orgs",
+              "received_events_url": "https://api.github.com/users/docker/received_events",
+              "repos_url": "https://api.github.com/users/docker/repos",
+              "site_admin": false,
+              "starred_url": "https://api.github.com/users/docker/starred{/owner}{/repo}",
+              "subscriptions_url": "https://api.github.com/users/docker/subscriptions",
+              "type": "Organization",
+              "url": "https://api.github.com/users/docker",
+              "user_view_type": "public"
+            },
+            "private": true,
+            "pulls_url": "https://api.github.com/repos/docker/github-builder-test/pulls{/number}",
+            "pushed_at": "2025-10-30T10:04:10Z",
+            "releases_url": "https://api.github.com/repos/docker/github-builder-test/releases{/id}",
+            "size": 25,
+            "ssh_url": "git@github.com:docker/github-builder-test.git",
+            "stargazers_count": 0,
+            "stargazers_url": "https://api.github.com/repos/docker/github-builder-test/stargazers",
+            "statuses_url": "https://api.github.com/repos/docker/github-builder-test/statuses/{sha}",
+            "subscribers_url": "https://api.github.com/repos/docker/github-builder-test/subscribers",
+            "subscription_url": "https://api.github.com/repos/docker/github-builder-test/subscription",
+            "svn_url": "https://github.com/docker/github-builder-test",
+            "tags_url": "https://api.github.com/repos/docker/github-builder-test/tags",
+            "teams_url": "https://api.github.com/repos/docker/github-builder-test/teams",
+            "topics": [],
+            "trees_url": "https://api.github.com/repos/docker/github-builder-test/git/trees{/sha}",
+            "updated_at": "2025-10-30T10:04:14Z",
+            "url": "https://api.github.com/repos/docker/github-builder-test",
+            "visibility": "internal",
+            "watchers": 0,
+            "watchers_count": 0,
+            "web_commit_signoff_required": false
+          },
+          "sender": {
+            "avatar_url": "https://avatars.githubusercontent.com/u/1951866?v=4",
+            "events_url": "https://api.github.com/users/crazy-max/events{/privacy}",
+            "followers_url": "https://api.github.com/users/crazy-max/followers",
+            "following_url": "https://api.github.com/users/crazy-max/following{/other_user}",
+            "gists_url": "https://api.github.com/users/crazy-max/gists{/gist_id}",
+            "gravatar_id": "",
+            "html_url": "https://github.com/crazy-max",
+            "id": 1951866,
+            "login": "crazy-max",
+            "node_id": "MDQ6VXNlcjE5NTE4NjY=",
+            "organizations_url": "https://api.github.com/users/crazy-max/orgs",
+            "received_events_url": "https://api.github.com/users/crazy-max/received_events",
+            "repos_url": "https://api.github.com/users/crazy-max/repos",
+            "site_admin": false,
+            "starred_url": "https://api.github.com/users/crazy-max/starred{/owner}{/repo}",
+            "subscriptions_url": "https://api.github.com/users/crazy-max/subscriptions",
+            "type": "User",
+            "url": "https://api.github.com/users/crazy-max",
+            "user_view_type": "public"
+          },
+          "workflow": ".github/workflows/ci.yml"
+        },
+        "github_job": "build",
+        "github_ref": "refs/heads/main",
+        "github_ref_name": "main",
+        "github_ref_protected": "false",
+        "github_ref_type": "branch",
+        "github_repository": "docker/github-builder-test",
+        "github_repository_id": "1040594287",
+        "github_repository_owner": "docker",
+        "github_repository_owner_id": "5429470",
+        "github_run_attempt": "1",
+        "github_run_id": "18937328894",
+        "github_run_number": "183",
+        "github_runner_arch": "X64",
+        "github_runner_environment": "github-hosted",
+        "github_runner_image_os": "ubuntu24",
+        "github_runner_image_version": "20250929.60.1",
+        "github_runner_name": "GitHub Actions 1002376925",
+        "github_runner_os": "Linux",
+        "github_runner_tracking_id": "github_7c0a7521-2999-41e5-af30-b7f0681f204f",
+        "github_server_url": "https://github.com",
+        "github_triggering_actor": "crazy-max",
+        "github_workflow": "ci",
+        "github_workflow_ref": "docker/github-builder-test/.github/workflows/ci.yml@refs/heads/main",
+        "github_workflow_sha": "bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe"
+      }
+    },
+    "runDetails": {
+      "builder": {
+        "id": "https://github.com/docker/github-builder-test/actions/runs/18937328894/attempts/1"
+      },
+      "metadata": {
+        "invocationID": "7qg2yuux3iklv02ktbmbtwgeb",
+        "startedOn": "2025-10-30T10:19:52.868710505Z",
+        "finishedOn": "2025-10-30T10:19:57.635810119Z",
+        "buildkit_metadata": {
+          "source": {
+            "locations": {
+              "step0": {
+                "locations": [
+                  {
+                    "ranges": [
+                      {
+                        "start": {
+                          "line": 1
+                        },
+                        "end": {
+                          "line": 1
+                        }
+                      }
+                    ]
+                  }
+                ]
+              },
+              "step1": {
+                "locations": [
+                  {
+                    "ranges": [
+                      {
+                        "start": {
+                          "line": 3
+                        },
+                        "end": {
+                          "line": 3
+                        }
+                      }
+                    ]
+                  }
+                ]
+              },
+              "step2": {
+                "locations": [
+                  {
+                    "ranges": [
+                      {
+                        "start": {
+                          "line": 7
+                        },
+                        "end": {
+                          "line": 7
+                        }
+                      }
+                    ]
+                  }
+                ]
+              }
+            },
+            "infos": [
+              {
+                "filename": "hello.Dockerfile",
+                "language": "Dockerfile",
+                "data": "RlJPTSBhbHBpbmUgQVMgYmFzZQpBUkcgVEFSR0VUUExBVEZPUk0KUlVOIGVjaG8gIkhlbGxvLCBXb3JsZCEgVGhpcyBpcyAke1RBUkdFVFBMQVRGT1JNfSIgPiAvaGVsbG8udHh0CkFSRyBCVUlMREtJVF9TQk9NX1NDQU5fU1RBR0U9dHJ1ZQoKRlJPTSBzY3JhdGNoCkNPUFkgLS1mcm9tPWJhc2UgL2hlbGxvLnR4dCAvCg==",
+                "llbDefinition": [
+                  {
+                    "id": "step0",
+                    "op": {
+                      "Op": {
+                        "source": {
+                          "identifier": "git://github.com/docker/github-builder-test.git#bdb96fcfe8cc9e3a54800bc2537a4d4a14f0c5fe",
+                          "attrs": {
+                            "git.authheadersecret": "GIT_AUTH_HEADER",
+                            "git.authtokensecret": "GIT_AUTH_TOKEN",
+                            "git.fullurl": "https://github.com/docker/github-builder-test.git"
+                          }
+                        }
+                      },
+                      "constraints": {}
+                    }
+                  },
+                  {
+                    "id": "step1",
+                    "op": {
+                      "Op": {}
+                    },
+                    "inputs": [
+                      "step0:0"
+                    ]
+                  }
+                ],
+                "digestMapping": {
+                  "sha256:47540f0959d81a7ff2fc9742b9ef0bb37d7eca99c13aa6df83b883d06e808ef2": "step0",
+                  "sha256:96933c546ff00debd500304305864192fcb51d348e8c41b6a6e1569a051e66ed": "step1"
+                }
+              }
+            ]
+          },
+          "layers": {
+            "step0:0": [
+              [
+                {
+                  "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
+                  "digest": "sha256:2d35ebdb57d9971fea0cac1582aa78935adf8058b2cc32db163c98822e5dfa1b",
+                  "size": 3802452
+                }
+              ]
+            ]
+          }
+        },
+        "buildkit_completeness": {
+          "request": true,
+          "resolvedDependencies": true
+        }
+      }
+    }
+  }
+}

__tests__/.helpers/os.ts

@@ -0,0 +1,30 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {vi} from 'vitest';
+import os from 'os';
+
+export const mockPlatform = (platform: NodeJS.Platform) => {
+  return vi.spyOn(os, 'platform').mockImplementation(() => platform);
+};
+
+export const mockArch = (arch: string) => {
+  return vi.spyOn(os, 'arch').mockImplementation(() => arch);
+};
+
+export const mockHomedir = (dir: string) => {
+  return vi.spyOn(os, 'homedir').mockImplementation(() => dir);
+};

__tests__/.setup/list-itg-tests.mjs

@@ -0,0 +1,38 @@
+/**
+ * Copyright 2026 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+const testsRoot = path.resolve('__tests__');
+const results = [];
+
+const walk = dir => {
+  for (const entry of fs.readdirSync(dir, {withFileTypes: true})) {
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      walk(fullPath);
+      continue;
+    }
+    if (entry.isFile() && entry.name.endsWith('.test.itg.ts')) {
+      results.push(fullPath.replaceAll(path.sep, '/'));
+    }
+  }
+};
+
+walk(testsRoot);
+results.sort((a, b) => a.localeCompare(b));
+process.stdout.write(`${results.join('\n')}\n`);

__tests__/.setup/setup.unit.ts

@@ -0,0 +1,242 @@
+/**
+ * Copyright 2026 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import {vi} from 'vitest';
+
+const envTmpDir = process.env.DOCKER_ACTIONS_TOOLKIT_TMPDIR;
+const tmpDir = envTmpDir || fs.mkdtempSync(path.join(os.tmpdir(), 'docker-actions-toolkit-'));
+
+process.env = Object.assign({}, process.env, {
+  DOCKER_ACTIONS_TOOLKIT_TMPDIR: tmpDir,
+  TEMP: tmpDir,
+  GITHUB_REPOSITORY: 'docker/actions-toolkit',
+  GITHUB_RUN_ATTEMPT: '2',
+  GITHUB_RUN_ID: '2188748038',
+  GITHUB_RUN_NUMBER: '15',
+  RUNNER_TEMP: path.join(tmpDir, 'runner-temp'),
+  RUNNER_TOOL_CACHE: path.join(tmpDir, 'runner-tool-cache')
+});
+
+vi.mock('@actions/github', () => ({
+  context: {
+    repo: {
+      owner: 'docker',
+      repo: 'actions-toolkit'
+    },
+    ref: 'refs/heads/master',
+    runId: 2188748038,
+    runNumber: 15,
+    payload: {
+      after: '860c1904a1ce19322e91ac35af1ab07466440c37',
+      base_ref: null,
+      before: '5f3331d7f7044c18ca9f12c77d961c4d7cf3276a',
+      commits: [
+        {
+          author: {
+            email: 'crazy-max@users.noreply.github.com',
+            name: 'CrazyMax',
+            username: 'crazy-max'
+          },
+          committer: {
+            email: 'crazy-max@users.noreply.github.com',
+            name: 'CrazyMax',
+            username: 'crazy-max'
+          },
+          distinct: true,
+          id: '860c1904a1ce19322e91ac35af1ab07466440c37',
+          message: 'hello dev',
+          timestamp: '2022-04-19T11:27:24+02:00',
+          tree_id: 'd2c60af597e863787d2d27f569e30495b0b92820',
+          url: 'https://github.com/docker/test-docker-action/commit/860c1904a1ce19322e91ac35af1ab07466440c37'
+        }
+      ],
+      compare: 'https://github.com/docker/test-docker-action/compare/5f3331d7f704...860c1904a1ce',
+      created: false,
+      deleted: false,
+      forced: false,
+      head_commit: {
+        author: {
+          email: 'crazy-max@users.noreply.github.com',
+          name: 'CrazyMax',
+          username: 'crazy-max'
+        },
+        committer: {
+          email: 'crazy-max@users.noreply.github.com',
+          name: 'CrazyMax',
+          username: 'crazy-max'
+        },
+        distinct: true,
+        id: '860c1904a1ce19322e91ac35af1ab07466440c37',
+        message: 'hello dev',
+        timestamp: '2022-04-19T11:27:24+02:00',
+        tree_id: 'd2c60af597e863787d2d27f569e30495b0b92820',
+        url: 'https://github.com/docker/test-docker-action/commit/860c1904a1ce19322e91ac35af1ab07466440c37'
+      },
+      organization: {
+        avatar_url: 'https://avatars.githubusercontent.com/u/5429470?v=4',
+        description: 'Docker helps developers bring their ideas to life by conquering the complexity of app development.',
+        events_url: 'https://api.github.com/orgs/docker/events',
+        hooks_url: 'https://api.github.com/orgs/docker/hooks',
+        id: 5429470,
+        issues_url: 'https://api.github.com/orgs/docker/issues',
+        login: 'docker',
+        members_url: 'https://api.github.com/orgs/docker/members{/member}',
+        node_id: 'MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=',
+        public_members_url: 'https://api.github.com/orgs/docker/public_members{/member}',
+        repos_url: 'https://api.github.com/orgs/docker/repos',
+        url: 'https://api.github.com/orgs/docker'
+      },
+      pusher: {
+        email: 'github@crazymax.dev',
+        name: 'crazy-max'
+      },
+      ref: 'refs/heads/dev',
+      repository: {
+        allow_forking: true,
+        archive_url: 'https://api.github.com/repos/docker/test-docker-action/{archive_format}{/ref}',
+        archived: false,
+        assignees_url: 'https://api.github.com/repos/docker/test-docker-action/assignees{/user}',
+        blobs_url: 'https://api.github.com/repos/docker/test-docker-action/git/blobs{/sha}',
+        branches_url: 'https://api.github.com/repos/docker/test-docker-action/branches{/branch}',
+        clone_url: 'https://github.com/docker/test-docker-action.git',
+        collaborators_url: 'https://api.github.com/repos/docker/test-docker-action/collaborators{/collaborator}',
+        comments_url: 'https://api.github.com/repos/docker/test-docker-action/comments{/number}',
+        commits_url: 'https://api.github.com/repos/docker/test-docker-action/commits{/sha}',
+        compare_url: 'https://api.github.com/repos/docker/test-docker-action/compare/{base}...{head}',
+        contents_url: 'https://api.github.com/repos/docker/test-docker-action/contents/{+path}',
+        contributors_url: 'https://api.github.com/repos/docker/test-docker-action/contributors',
+        created_at: 1596792180,
+        default_branch: 'master',
+        deployments_url: 'https://api.github.com/repos/docker/test-docker-action/deployments',
+        description: 'Test "Docker" Actions',
+        disabled: false,
+        downloads_url: 'https://api.github.com/repos/docker/test-docker-action/downloads',
+        events_url: 'https://api.github.com/repos/docker/test-docker-action/events',
+        fork: false,
+        forks: 1,
+        forks_count: 1,
+        forks_url: 'https://api.github.com/repos/docker/test-docker-action/forks',
+        full_name: 'docker/test-docker-action',
+        git_commits_url: 'https://api.github.com/repos/docker/test-docker-action/git/commits{/sha}',
+        git_refs_url: 'https://api.github.com/repos/docker/test-docker-action/git/refs{/sha}',
+        git_tags_url: 'https://api.github.com/repos/docker/test-docker-action/git/tags{/sha}',
+        git_url: 'git://github.com/docker/test-docker-action.git',
+        has_downloads: true,
+        has_issues: true,
+        has_pages: false,
+        has_projects: true,
+        has_wiki: true,
+        homepage: '',
+        hooks_url: 'https://api.github.com/repos/docker/test-docker-action/hooks',
+        html_url: 'https://github.com/docker/test-docker-action',
+        id: 285789493,
+        is_template: false,
+        issue_comment_url: 'https://api.github.com/repos/docker/test-docker-action/issues/comments{/number}',
+        issue_events_url: 'https://api.github.com/repos/docker/test-docker-action/issues/events{/number}',
+        issues_url: 'https://api.github.com/repos/docker/test-docker-action/issues{/number}',
+        keys_url: 'https://api.github.com/repos/docker/test-docker-action/keys{/key_id}',
+        labels_url: 'https://api.github.com/repos/docker/test-docker-action/labels{/name}',
+        language: 'JavaScript',
+        languages_url: 'https://api.github.com/repos/docker/test-docker-action/languages',
+        license: {
+          key: 'mit',
+          name: 'MIT License',
+          node_id: 'MDc6TGljZW5zZTEz',
+          spdx_id: 'MIT',
+          url: 'https://api.github.com/licenses/mit'
+        },
+        master_branch: 'master',
+        merges_url: 'https://api.github.com/repos/docker/test-docker-action/merges',
+        milestones_url: 'https://api.github.com/repos/docker/test-docker-action/milestones{/number}',
+        mirror_url: null,
+        name: 'test-docker-action',
+        node_id: 'MDEwOlJlcG9zaXRvcnkyODU3ODk0OTM=',
+        notifications_url: 'https://api.github.com/repos/docker/test-docker-action/notifications{?since,all,participating}',
+        open_issues: 6,
+        open_issues_count: 6,
+        organization: 'docker',
+        owner: {
+          avatar_url: 'https://avatars.githubusercontent.com/u/5429470?v=4',
+          email: 'info@docker.com',
+          events_url: 'https://api.github.com/users/docker/events{/privacy}',
+          followers_url: 'https://api.github.com/users/docker/followers',
+          following_url: 'https://api.github.com/users/docker/following{/other_user}',
+          gists_url: 'https://api.github.com/users/docker/gists{/gist_id}',
+          gravatar_id: '',
+          html_url: 'https://github.com/docker',
+          id: 5429470,
+          login: 'docker',
+          name: 'docker',
+          node_id: 'MDEyOk9yZ2FuaXphdGlvbjU0Mjk0NzA=',
+          organizations_url: 'https://api.github.com/users/docker/orgs',
+          received_events_url: 'https://api.github.com/users/docker/received_events',
+          repos_url: 'https://api.github.com/users/docker/repos',
+          site_admin: false,
+          starred_url: 'https://api.github.com/users/docker/starred{/owner}{/repo}',
+          subscriptions_url: 'https://api.github.com/users/docker/subscriptions',
+          type: 'Organization',
+          url: 'https://api.github.com/users/docker'
+        },
+        private: true,
+        pulls_url: 'https://api.github.com/repos/docker/test-docker-action/pulls{/number}',
+        pushed_at: 1650360446,
+        releases_url: 'https://api.github.com/repos/docker/test-docker-action/releases{/id}',
+        size: 796,
+        ssh_url: 'git@github.com:docker/test-docker-action.git',
+        stargazers: 0,
+        stargazers_count: 0,
+        stargazers_url: 'https://api.github.com/repos/docker/test-docker-action/stargazers',
+        statuses_url: 'https://api.github.com/repos/docker/test-docker-action/statuses/{sha}',
+        subscribers_url: 'https://api.github.com/repos/docker/test-docker-action/subscribers',
+        subscription_url: 'https://api.github.com/repos/docker/test-docker-action/subscription',
+        svn_url: 'https://github.com/docker/test-docker-action',
+        tags_url: 'https://api.github.com/repos/docker/test-docker-action/tags',
+        teams_url: 'https://api.github.com/repos/docker/test-docker-action/teams',
+        topics: [],
+        trees_url: 'https://api.github.com/repos/docker/test-docker-action/git/trees{/sha}',
+        updated_at: '2022-04-19T09:05:09Z',
+        url: 'https://github.com/docker/test-docker-action',
+        visibility: 'private',
+        watchers: 0,
+        watchers_count: 0
+      },
+      sender: {
+        avatar_url: 'https://avatars.githubusercontent.com/u/1951866?v=4',
+        events_url: 'https://api.github.com/users/crazy-max/events{/privacy}',
+        followers_url: 'https://api.github.com/users/crazy-max/followers',
+        following_url: 'https://api.github.com/users/crazy-max/following{/other_user}',
+        gists_url: 'https://api.github.com/users/crazy-max/gists{/gist_id}',
+        gravatar_id: '',
+        html_url: 'https://github.com/crazy-max',
+        id: 1951866,
+        login: 'crazy-max',
+        node_id: 'MDQ6VXNlcjE5NTE4NjY=',
+        organizations_url: 'https://api.github.com/users/crazy-max/orgs',
+        received_events_url: 'https://api.github.com/users/crazy-max/received_events',
+        repos_url: 'https://api.github.com/users/crazy-max/repos',
+        site_admin: false,
+        starred_url: 'https://api.github.com/users/crazy-max/starred{/owner}{/repo}',
+        subscriptions_url: 'https://api.github.com/users/crazy-max/subscriptions',
+        type: 'User',
+        url: 'https://api.github.com/users/crazy-max'
+      }
+    }
+  },
+  getOctokit: vi.fn()
+}));

__tests__/.setup/skipped-reporter.d.mts

@@ -1,5 +1,5 @@
 /**
- * Copyright 2023 actions-toolkit authors
+ * Copyright 2026 actions-toolkit authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -14,6 +14,6 @@
  * limitations under the License.
  */
 
-import {Context as GitHubContext} from '@actions/github/lib/context';
+import type {Reporter} from 'vitest/node';
 
-export type Context = GitHubContext;
+export declare const vitestAllSkippedReporter: () => Reporter;

__tests__/.setup/skipped-reporter.mjs

@@ -0,0 +1,59 @@
+/**
+ * Copyright 2026 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const vitestAllSkippedReporter = () => {
+  let vitest;
+  let hasExecutedTest;
+  let hasAnyCollectedTest;
+
+  const getFlagPath = () => {
+    const reportsDirectory = vitest?.config?.coverage?.reportsDirectory ?? 'coverage';
+    return path.join(reportsDirectory, 'allSkipped.txt');
+  };
+
+  return {
+    onInit(ctx) {
+      vitest = ctx;
+      hasExecutedTest = false;
+      hasAnyCollectedTest = false;
+    },
+    onTestCaseReady() {
+      hasAnyCollectedTest = true;
+    },
+    onTestCaseResult(testCase) {
+      const state = testCase.result()?.state;
+      if (state === 'passed' || state === 'failed') {
+        hasExecutedTest = true;
+      }
+    },
+    onTestRunEnd() {
+      if (!vitest?.config?.coverage?.enabled) {
+        return;
+      }
+      const allSkipped = hasAnyCollectedTest && !hasExecutedTest;
+      const flagPath = getFlagPath();
+      if (allSkipped) {
+        fs.mkdirSync(path.dirname(flagPath), {recursive: true});
+        fs.writeFileSync(flagPath, '');
+      } else if (fs.existsSync(flagPath)) {
+        fs.rmSync(flagPath);
+      }
+    }
+  };
+};

__tests__/buildkit/buildkit.test.ts

@@ -14,14 +14,14 @@
  * limitations under the License.
  */
 
-import {describe, expect, it, jest, test} from '@jest/globals';
+import {describe, expect, it, vi, test} from 'vitest';
 
-import {BuildKit} from '../../src/buildkit/buildkit';
-import {Builder} from '../../src/buildx/builder';
+import {BuildKit} from '../../src/buildkit/buildkit.js';
+import {Builder} from '../../src/buildx/builder.js';
 
-import {BuilderInfo} from '../../src/types/buildx/builder';
+import {BuilderInfo} from '../../src/types/buildx/builder.js';
 
-jest.spyOn(Builder.prototype, 'inspect').mockImplementation(async (): Promise<BuilderInfo> => {
+vi.spyOn(Builder.prototype, 'inspect').mockImplementation(async (): Promise<BuilderInfo> => {
   return {
     name: 'builder2',
     driver: 'docker-container',
@@ -54,7 +54,7 @@ describe('satisfies', () => {
   test.each([
     ['builder2', '>=0.10.0', true],
     ['builder2', '>0.11.0', false]
-  ])('given %p', async (builderName, range, expected) => {
+  ])('given %o', async (builderName, range, expected) => {
     const buildkit = new BuildKit();
     expect(await buildkit.versionSatisfies(builderName, range)).toBe(expected);
   });

__tests__/buildkit/config.test.ts

@@ -14,25 +14,25 @@
  * limitations under the License.
  */
 
-import {describe, expect, jest, test, afterEach} from '@jest/globals';
+import {describe, expect, vi, test, afterEach} from 'vitest';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import * as rimraf from 'rimraf';
 
-import {BuildKit} from '../../src/buildkit/buildkit';
-import {Context} from '../../src/context';
+import {BuildKit} from '../../src/buildkit/buildkit.js';
+import {Context} from '../../src/context.js';
 
 const fixturesDir = path.join(__dirname, '..', '.fixtures');
 const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'buildkit-config-'));
-const tmpName = path.join(tmpDir, '.tmpname-jest');
+const tmpName = path.join(tmpDir, '.tmpname-vi');
 
-jest.spyOn(Context, 'tmpDir').mockImplementation((): string => {
+vi.spyOn(Context, 'tmpDir').mockImplementation((): string => {
   fs.mkdirSync(tmpDir, {recursive: true});
   return tmpDir;
 });
 
-jest.spyOn(Context, 'tmpName').mockImplementation((): string => {
+vi.spyOn(Context, 'tmpName').mockImplementation((): string => {
   return tmpName;
 });
 
@@ -53,7 +53,7 @@ describe('resolve', () => {
 `,
       null
     ]
-  ])('given %p config', async (val: string, file: boolean, exValue: string, error: Error | null) => {
+  ])('given %o config', async (val: string, file: boolean, exValue: string, error: Error | null) => {
     try {
       const buildkit = new BuildKit();
       let config: string;
@@ -66,7 +66,7 @@ describe('resolve', () => {
       const configValue = fs.readFileSync(tmpName, 'utf-8');
       expect(configValue).toEqual(exValue);
     } catch (e) {
-      // eslint-disable-next-line jest/no-conditional-expect
+      // eslint-disable-next-line vitest/no-conditional-expect
       expect(e.message).toEqual(error?.message);
     }
   });

__tests__/buildkit/git.test.ts

@@ -14,14 +14,14 @@
  * limitations under the License.
  */
 
-import {beforeEach, describe, expect, jest, test} from '@jest/globals';
+import {beforeEach, describe, expect, vi, test} from 'vitest';
 
-import {Git} from '../../src/buildkit/git';
+import {Git} from '../../src/buildkit/git.js';
 
-import {GitRef, GitURL} from '../../src/types/buildkit/git';
+import {GitRef, GitURL} from '../../src/types/buildkit/git.js';
 
 beforeEach(() => {
-  jest.restoreAllMocks();
+  vi.restoreAllMocks();
 });
 
 describe('parseURL', () => {
@@ -181,7 +181,7 @@ describe('parseURL', () => {
       } as GitURL,
       false
     ],
-  ])('given %p', async (ref: string, expected: GitURL, expectedErr: boolean) => {
+  ])('given %o', async (ref: string, expected: GitURL, expectedErr: boolean) => {
     try {
       const got = Git.parseURL(ref);
       expect(got.scheme).toEqual(expected.scheme);
@@ -195,7 +195,7 @@ describe('parseURL', () => {
       if (!expectedErr) {
         console.log(err);
       }
-      // eslint-disable-next-line jest/no-conditional-expect
+      // eslint-disable-next-line vitest/no-conditional-expect
       expect(expectedErr).toBeTruthy();
     }
   });
@@ -329,7 +329,7 @@ describe('parseRef', () => {
       '.git',
       undefined
     ],
-  ])('given %p', async (ref: string, expected: GitRef | undefined) => {
+  ])('given %o', async (ref: string, expected: GitRef | undefined) => {
     try {
       const got = Git.parseRef(ref);
       expect(got).toEqual(expected);
@@ -337,7 +337,7 @@ describe('parseRef', () => {
       if (expected) {
         console.log(err);
       }
-      // eslint-disable-next-line jest/no-conditional-expect
+      // eslint-disable-next-line vitest/no-conditional-expect
       expect(expected).toBeUndefined();
     }
   });

__tests__/buildx/bake.test.itg.ts

@@ -14,12 +14,12 @@
  * limitations under the License.
  */
 
-import {describe, expect, test} from '@jest/globals';
+import {describe, expect, test} from 'vitest';
 import * as fs from 'fs';
 import * as path from 'path';
 
-import {Bake} from '../../src/buildx/bake';
-import {BakeDefinition} from '../../src/types/buildx/bake';
+import {Bake} from '../../src/buildx/bake.js';
+import {BakeDefinition} from '../../src/types/buildx/bake.js';
 
 const fixturesDir = path.join(__dirname, '..', '.fixtures');
 
@@ -41,7 +41,7 @@ maybe('getDefinition', () => {
     //   path.join(fixturesDir, 'bake-test-docker-action-remote-private.json'),
     //   true,
     // ]
-  ])('given %p', async (source: string, targets: string[], out: string, auth) => {
+  ])('given %o', async (source: string, targets: string[], out: string, auth) => {
     const gitAuthToken = process.env.GITHUB_TOKEN || '';
     if (auth && !gitAuthToken) {
       console.log(`Git auth token not available, skipping test`);

__tests__/buildx/bake.test.ts

@@ -14,30 +14,30 @@
  * limitations under the License.
  */
 
-import {afterEach, describe, expect, it, jest, test} from '@jest/globals';
+import {afterEach, describe, expect, it, vi, test} from 'vitest';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import * as rimraf from 'rimraf';
 
-import {Bake} from '../../src/buildx/bake';
-import {Context} from '../../src/context';
+import {Bake} from '../../src/buildx/bake.js';
+import {Context} from '../../src/context.js';
 
 import {ExecOptions} from '@actions/exec';
-import {BakeDefinition} from '../../src/types/buildx/bake';
-import {BuildMetadata} from '../../src/types/buildx/build';
+import {BakeDefinition} from '../../src/types/buildx/bake.js';
+import {BuildMetadata} from '../../src/types/buildx/build.js';
 
 const fixturesDir = path.join(__dirname, '..', '.fixtures');
 const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'buildx-bake-'));
-const tmpName = path.join(tmpDir, '.tmpname-jest');
+const tmpName = path.join(tmpDir, '.tmpname-vi');
 const metadata = JSON.parse(fs.readFileSync(path.join(fixturesDir, 'metadata-bake.json'), 'utf-8'));
 
-jest.spyOn(Context, 'tmpDir').mockImplementation((): string => {
+vi.spyOn(Context, 'tmpDir').mockImplementation((): string => {
   fs.mkdirSync(tmpDir, {recursive: true});
   return tmpDir;
 });
 
-jest.spyOn(Context, 'tmpName').mockImplementation((): string => {
+vi.spyOn(Context, 'tmpName').mockImplementation((): string => {
   return tmpName;
 });
 
@@ -94,8 +94,15 @@ describe('getDefinition', () => {
       ['*.output=type=docker', '*.platform=linux/amd64'],
       undefined,
       path.join(fixturesDir, 'bake-01-overrides.json')
-    ]
-  ])('given %p', async (files: string[], targets: string[], overrides: string[], execOptions: ExecOptions | undefined, out: string) => {
+    ],
+    [
+      [path.join(fixturesDir, 'bake-03.hcl')],
+      [],
+      [],
+      undefined,
+      path.join(fixturesDir, 'bake-03-default.json')
+    ],
+  ])('given %o', async (files: string[], targets: string[], overrides: string[], execOptions: ExecOptions | undefined, out: string) => {
     const bake = new Bake();
     const expectedDef = <BakeDefinition>JSON.parse(fs.readFileSync(out, {encoding: 'utf-8'}).trim())
     expect(await bake.getDefinition({
@@ -103,7 +110,7 @@ describe('getDefinition', () => {
       targets: targets,
       overrides: overrides
     }, execOptions)).toEqual(expectedDef);
-  });
+  }, 30 * 60 * 1000);
 });
 
 describe('hasLocalExporter', () => {
@@ -114,7 +121,9 @@ describe('hasLocalExporter', () => {
         "target": {
           "build": {
             "output": [
-              "type=docker"
+              {
+                "type": "docker"
+              }
             ]
           },
         }
@@ -136,7 +145,10 @@ describe('hasLocalExporter', () => {
         "target": {
           "local": {
             "output": [
-              "type=local,dest=./release-out"
+              {
+                "type": "local",
+                "dest": "./release-out"
+              }
             ]
           },
         }
@@ -148,19 +160,10 @@ describe('hasLocalExporter', () => {
         "target": {
           "tar": {
             "output": [
-              "type=tar,dest=/tmp/image.tar"
-            ]
-          },
-        }
-      } as unknown as BakeDefinition,
-      false
-    ],
-    [
-      {
-        "target": {
-          "tar": {
-            "output": [
-              '"type=tar","dest=/tmp/image.tar"',
+              {
+                "type": "tar",
+                "dest": "/tmp/image.tar"
+              }
             ]
           },
         }
@@ -172,26 +175,17 @@ describe('hasLocalExporter', () => {
         "target": {
           "local": {
             "output": [
-              '" type= local" , dest=./release-out',
-            ]
-          },
-        }
-      } as unknown as BakeDefinition,
-      true
-    ],
-    [
-      {
-        "target": {
-          "local": {
-            "output": [
-              ".",
+              {
+                "type": "local",
+                "dest": "."
+              }
             ]
           },
         }
       } as unknown as BakeDefinition,
       true
     ]
-  ])('given %o returns %p', async (def: BakeDefinition, expected: boolean) => {
+  ])('given %o returns %o', async (def: BakeDefinition, expected: boolean) => {
     expect(Bake.hasLocalExporter(def)).toEqual(expected);
   });
 });
@@ -204,7 +198,10 @@ describe('hasTarExporter', () => {
         "target": {
           "reg": {
             "output": [
-              "type=registry,ref=user/app"
+              {
+                "type": "registry",
+                "ref": "user/app"
+              }
             ]
           },
         }
@@ -216,7 +213,9 @@ describe('hasTarExporter', () => {
         "target": {
           "build": {
             "output": [
-              "type=docker"
+              {
+                "type": "docker"
+              }
             ]
           },
         }
@@ -228,7 +227,10 @@ describe('hasTarExporter', () => {
         "target": {
           "local": {
             "output": [
-              "type=local,dest=./release-out"
+              {
+                "type": "local",
+                "dest": "./release-out"
+              }
             ]
           },
         }
@@ -240,7 +242,10 @@ describe('hasTarExporter', () => {
         "target": {
           "tar": {
             "output": [
-              "type=tar,dest=/tmp/image.tar"
+              {
+                "type": "tar",
+                "dest": "/tmp/image.tar"
+              }
             ]
           },
         }
@@ -252,20 +257,13 @@ describe('hasTarExporter', () => {
         "target": {
           "multi": {
             "output": [
-              "type=docker",
-              "type=tar,dest=/tmp/image.tar"
-            ]
-          },
-        }
-      } as unknown as BakeDefinition,
-      true
-    ],
-    [
-      {
-        "target": {
-          "tar": {
-            "output": [
-              '"type=tar","dest=/tmp/image.tar"',
+              {
+                "type": "docker"
+              },
+              {
+                "type": "tar",
+                "dest": "/tmp/image.tar"
+              }
             ]
           },
         }
@@ -277,26 +275,17 @@ describe('hasTarExporter', () => {
         "target": {
           "local": {
             "output": [
-              '" type= local" , dest=./release-out',
+              {
+                "type": "local",
+                "dest": "."
+              }
             ]
           },
         }
       } as unknown as BakeDefinition,
       false
     ],
-    [
-      {
-        "target": {
-          "local": {
-            "output": [
-              ".",
-            ]
-          },
-        }
-      } as unknown as BakeDefinition,
-      false
-    ],
-  ])('given %o returns %p', async (def: BakeDefinition, expected: boolean) => {
+  ])('given %o returns %o', async (def: BakeDefinition, expected: boolean) => {
     expect(Bake.hasTarExporter(def)).toEqual(expected);
   });
 });
@@ -309,7 +298,10 @@ describe('hasDockerExporter', () => {
         "target": {
           "reg": {
             "output": [
-              "type=registry,ref=user/app"
+              {
+                "type": "registry",
+                "ref": "user/app"
+              }
             ]
           },
         }
@@ -322,7 +314,9 @@ describe('hasDockerExporter', () => {
         "target": {
           "build": {
             "output": [
-              "type=docker"
+              {
+                "type": "docker"
+              }
             ]
           },
         }
@@ -335,8 +329,13 @@ describe('hasDockerExporter', () => {
         "target": {
           "multi": {
             "output": [
-              "type=docker",
-              "type=tar,dest=/tmp/image.tar"
+              {
+                "type": "docker"
+              },
+              {
+                "type": "tar",
+                "dest": "/tmp/image.tar"
+              }
             ]
           },
         }
@@ -349,20 +348,10 @@ describe('hasDockerExporter', () => {
         "target": {
           "local": {
             "output": [
-              '" type= local" , dest=./release-out'
-            ]
-          },
-        }
-      } as unknown as BakeDefinition,
-      false,
-      undefined
-    ],
-    [
-      {
-        "target": {
-          "local": {
-            "output": [
-              "type=local,dest=./release-out"
+              {
+                "type": "local",
+                "dest": "./release-out"
+              }
             ]
           },
         }
@@ -375,7 +364,10 @@ describe('hasDockerExporter', () => {
         "target": {
           "tar": {
             "output": [
-              "type=tar,dest=/tmp/image.tar"
+              {
+                "type": "tar",
+                "dest": "/tmp/image.tar"
+              }
             ]
           },
         }
@@ -388,8 +380,13 @@ describe('hasDockerExporter', () => {
         "target": {
           "multi": {
             "output": [
-              "type=docker",
-              "type=tar,dest=/tmp/image.tar"
+              {
+                "type": "docker"
+              },
+              {
+                "type": "tar",
+                "dest": "/tmp/image.tar"
+              }
             ]
           },
         }
@@ -397,51 +394,14 @@ describe('hasDockerExporter', () => {
       true,
       undefined
     ],
-    [
-      {
-        "target": {
-          "tar": {
-            "output": [
-              '"type=tar","dest=/tmp/image.tar"'
-            ]
-          },
-        }
-      } as unknown as BakeDefinition,
-      false,
-      undefined
-    ],
-    [
-      {
-        "target": {
-          "tar": {
-            "output": [
-              '"type=tar","dest=/tmp/image.tar"'
-            ]
-          },
-        }
-      } as unknown as BakeDefinition,
-      false,
-      undefined
-    ],
-    [
-      {
-        "target": {
-          "local": {
-            "output": [
-              '" type= local" , dest=./release-out'
-            ]
-          },
-        }
-      } as unknown as BakeDefinition,
-      false,
-      undefined
-    ],
     [
       {
         "target": {
           "build": {
             "output": [
-              "type=docker"
+              {
+                "type": "docker"
+              }
             ]
           },
         }
@@ -454,7 +414,9 @@ describe('hasDockerExporter', () => {
         "target": {
           "build": {
             "output": [
-              "type=docker"
+              {
+                "type": "docker"
+              }
             ]
           },
         }
@@ -467,7 +429,10 @@ describe('hasDockerExporter', () => {
         "target": {
           "build": {
             "output": [
-              "."
+              {
+                "type": "local",
+                "dest": "."
+              }
             ]
           },
         }
@@ -475,7 +440,158 @@ describe('hasDockerExporter', () => {
       true,
       true
     ],
-  ])('given %o and load:%p returns %p', async (def: BakeDefinition, expected: boolean, load: boolean | undefined) => {
+  ])('given %o and load: %o returns %o', async (def: BakeDefinition, expected: boolean, load: boolean | undefined) => {
     expect(Bake.hasDockerExporter(def, load)).toEqual(expected);
   });
 });
+
+describe('hasGitAuthTokenSecret', () => {
+  // prettier-ignore
+  test.each([
+    [
+      {
+        "target": {
+          "reg": {
+            "secret": [
+              {
+                "id": "A_SECRET",
+                "env": "A_SECRET"
+              }
+            ]
+          },
+        }
+      } as unknown as BakeDefinition,
+      false
+    ],
+    [
+      {
+        "target": {
+          "reg": {
+            "secret": [
+              {
+                "id": "A_SECRET",
+                "env": "A_SECRET"
+              },
+              {
+                "id": "GIT_AUTH_TOKEN"
+              }
+            ]
+          },
+        }
+      } as unknown as BakeDefinition,
+      true
+    ],
+  ])('given %o returns %o', async (def: BakeDefinition, expected: boolean) => {
+    expect(Bake.hasGitAuthTokenSecret(def)).toEqual(expected);
+  });
+});
+
+describe('hasProvenanceAttestation', () => {
+  // prettier-ignore
+  test.each([
+    [
+      {
+        "target": {
+          "build": {
+            "attest": [
+              {
+                "type": "provenance",
+                "mode": "max"
+              }
+            ]
+          },
+        }
+      } as unknown as BakeDefinition,
+      true
+    ],
+    [
+      {
+        "target": {
+          "build": {
+            "attest": [
+              {
+                "type": "sbom"
+              }
+            ]
+          },
+        }
+      } as unknown as BakeDefinition,
+      false
+    ],
+    [
+      {
+        "target": {
+          "build": {
+            "attest": [
+              {
+                "type": "sbom"
+              },
+              {
+                "type": "provenance",
+                "mode": "max"
+              }
+            ]
+          },
+        }
+      } as unknown as BakeDefinition,
+      true
+    ]
+  ])('given %o returns %o', async (def: BakeDefinition, expected: boolean) => {
+    expect(Bake.hasProvenanceAttestation(def)).toEqual(expected);
+  });
+});
+
+describe('hasSBOMAttestation', () => {
+  // prettier-ignore
+  test.each([
+    [
+      {
+        "target": {
+          "build": {
+            "attest": [
+              {
+                "type": "provenance",
+                "mode": "max"
+              }
+            ]
+          },
+        }
+      } as unknown as BakeDefinition,
+      false
+    ],
+    [
+      {
+        "target": {
+          "build": {
+            "attest": [
+              {
+                "type": "sbom"
+              }
+            ]
+          },
+        }
+      } as unknown as BakeDefinition,
+      true
+    ],
+    [
+      {
+        "target": {
+          "build": {
+            "attest": [
+              {
+                "type": "sbom"
+              },
+              {
+                "type": "provenance",
+                "mode": "max"
+              }
+            ]
+          },
+        }
+      } as unknown as BakeDefinition,
+      true
+    ]
+  ])('given %o returns %o', async (def: BakeDefinition, expected: boolean) => {
+    expect(Bake.hasSBOMAttestation(def)).toEqual(expected);
+  });
+});

__tests__/buildx/build.test.ts

@@ -14,26 +14,29 @@
  * limitations under the License.
  */
 
-import {afterEach, beforeEach, describe, expect, it, jest, test} from '@jest/globals';
+import {afterEach, beforeEach, describe, expect, it, vi, test} from 'vitest';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import * as rimraf from 'rimraf';
 
-import {Context} from '../../src/context';
-import {Build} from '../../src/buildx/build';
+import {Context} from '../../src/context.js';
+import {Build} from '../../src/buildx/build.js';
+import {Buildx} from '../../src/buildx/buildx.js';
+
+import {GitContextFormat} from '../../src/types/buildx/build.js';
 
 const fixturesDir = path.join(__dirname, '..', '.fixtures');
 const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'buildx-build-'));
-const tmpName = path.join(tmpDir, '.tmpname-jest');
+const tmpName = path.join(tmpDir, '.tmpname-vi');
 const metadata = JSON.parse(fs.readFileSync(path.join(fixturesDir, 'metadata-build.json'), 'utf-8'));
 
-jest.spyOn(Context, 'tmpDir').mockImplementation((): string => {
+vi.spyOn(Context, 'tmpDir').mockImplementation((): string => {
   fs.mkdirSync(tmpDir, {recursive: true});
   return tmpDir;
 });
 
-jest.spyOn(Context, 'tmpName').mockImplementation((): string => {
+vi.spyOn(Context, 'tmpName').mockImplementation((): string => {
   return tmpName;
 });
 
@@ -41,6 +44,66 @@ afterEach(() => {
   rimraf.sync(tmpDir);
 });
 
+describe('gitContext', () => {
+  const originalEnv = process.env;
+  beforeEach(() => {
+    vi.resetModules();
+    process.env = {
+      ...originalEnv,
+      DOCKER_DEFAULT_GIT_CONTEXT_PR_HEAD_REF: '',
+      BUILDX_SEND_GIT_QUERY_AS_INPUT: ''
+    };
+  });
+  afterEach(() => {
+    process.env = originalEnv;
+  });
+
+  type GitContextTestCase = {
+    ref: string;
+    format: GitContextFormat | undefined;
+    prHeadRef: boolean;
+    sendGitQueryAsInput: boolean;
+    buildxQuerySupport: boolean;
+  };
+
+  // prettier-ignore
+  const gitContextCases: [GitContextTestCase, string][] = [
+    // no format set (defaults to fragment)
+    [{ref: 'refs/heads/master', format: undefined, prHeadRef: false, sendGitQueryAsInput: false, buildxQuerySupport: true}, 'https://github.com/docker/actions-toolkit.git#860c1904a1ce19322e91ac35af1ab07466440c37'],
+    [{ref: 'master', format: undefined, prHeadRef: false, sendGitQueryAsInput: false, buildxQuerySupport: true}, 'https://github.com/docker/actions-toolkit.git#860c1904a1ce19322e91ac35af1ab07466440c37'],
+    [{ref: 'refs/pull/15/merge', format: undefined, prHeadRef: false, sendGitQueryAsInput: false, buildxQuerySupport: true}, 'https://github.com/docker/actions-toolkit.git#refs/pull/15/merge'],
+    [{ref: 'refs/tags/v1.0.0', format: undefined, prHeadRef: false, sendGitQueryAsInput: false, buildxQuerySupport: true}, 'https://github.com/docker/actions-toolkit.git#860c1904a1ce19322e91ac35af1ab07466440c37'],
+    [{ref: 'refs/pull/15/merge', format: undefined, prHeadRef: true, sendGitQueryAsInput: false, buildxQuerySupport: true}, 'https://github.com/docker/actions-toolkit.git#refs/pull/15/head'],
+    // no format set (defaults to query only when client-side query resolution is enabled and supported)
+    [{ref: 'refs/heads/master', format: undefined, prHeadRef: false, sendGitQueryAsInput: true, buildxQuerySupport: true}, 'https://github.com/docker/actions-toolkit.git?ref=refs/heads/master&checksum=860c1904a1ce19322e91ac35af1ab07466440c37'],
+    [{ref: 'refs/pull/15/merge', format: undefined, prHeadRef: false, sendGitQueryAsInput: true, buildxQuerySupport: true}, 'https://github.com/docker/actions-toolkit.git?ref=refs/pull/15/merge&checksum=860c1904a1ce19322e91ac35af1ab07466440c37'],
+    [{ref: 'refs/pull/15/merge', format: undefined, prHeadRef: true, sendGitQueryAsInput: true, buildxQuerySupport: true}, 'https://github.com/docker/actions-toolkit.git?ref=refs/pull/15/head&checksum=860c1904a1ce19322e91ac35af1ab07466440c37'],
+    [{ref: 'refs/heads/master', format: undefined, prHeadRef: false, sendGitQueryAsInput: true, buildxQuerySupport: false}, 'https://github.com/docker/actions-toolkit.git#860c1904a1ce19322e91ac35af1ab07466440c37'],
+    // query format
+    [{ref: 'refs/heads/master', format: 'query', prHeadRef: false, sendGitQueryAsInput: false, buildxQuerySupport: true}, 'https://github.com/docker/actions-toolkit.git?ref=refs/heads/master&checksum=860c1904a1ce19322e91ac35af1ab07466440c37'],
+    [{ref: 'master', format: 'query', prHeadRef: false, sendGitQueryAsInput: false, buildxQuerySupport: true}, 'https://github.com/docker/actions-toolkit.git?ref=refs/heads/master&checksum=860c1904a1ce19322e91ac35af1ab07466440c37'],
+    [{ref: 'refs/pull/15/merge', format: 'query', prHeadRef: false, sendGitQueryAsInput: false, buildxQuerySupport: true}, 'https://github.com/docker/actions-toolkit.git?ref=refs/pull/15/merge&checksum=860c1904a1ce19322e91ac35af1ab07466440c37'],
+    [{ref: 'refs/tags/v1.0.0', format: 'query', prHeadRef: false, sendGitQueryAsInput: false, buildxQuerySupport: true}, 'https://github.com/docker/actions-toolkit.git?ref=refs/tags/v1.0.0&checksum=860c1904a1ce19322e91ac35af1ab07466440c37'],
+    [{ref: 'refs/pull/15/merge', format: 'query', prHeadRef: true, sendGitQueryAsInput: false, buildxQuerySupport: true}, 'https://github.com/docker/actions-toolkit.git?ref=refs/pull/15/head&checksum=860c1904a1ce19322e91ac35af1ab07466440c37'],
+    // fragment format
+    [{ref: 'refs/heads/master', format: 'fragment', prHeadRef: false, sendGitQueryAsInput: false, buildxQuerySupport: true}, 'https://github.com/docker/actions-toolkit.git#860c1904a1ce19322e91ac35af1ab07466440c37'],
+    [{ref: 'master', format: 'fragment', prHeadRef: false, sendGitQueryAsInput: false, buildxQuerySupport: true}, 'https://github.com/docker/actions-toolkit.git#860c1904a1ce19322e91ac35af1ab07466440c37'],
+    [{ref: 'refs/pull/15/merge', format: 'fragment', prHeadRef: false, sendGitQueryAsInput: false, buildxQuerySupport: true}, 'https://github.com/docker/actions-toolkit.git#refs/pull/15/merge'],
+    [{ref: 'refs/tags/v1.0.0', format: 'fragment', prHeadRef: false, sendGitQueryAsInput: false, buildxQuerySupport: true}, 'https://github.com/docker/actions-toolkit.git#860c1904a1ce19322e91ac35af1ab07466440c37'],
+    [{ref: 'refs/pull/15/merge', format: 'fragment', prHeadRef: true, sendGitQueryAsInput: false, buildxQuerySupport: true}, 'https://github.com/docker/actions-toolkit.git#refs/pull/15/head'],
+  ];
+
+  test.each(gitContextCases)('given %o should return %o', async (input: GitContextTestCase, expected: string) => {
+    const {ref, format, prHeadRef, sendGitQueryAsInput, buildxQuerySupport} = input;
+    process.env.DOCKER_DEFAULT_GIT_CONTEXT_PR_HEAD_REF = prHeadRef ? 'true' : '';
+    process.env.BUILDX_SEND_GIT_QUERY_AS_INPUT = sendGitQueryAsInput ? 'true' : '';
+    const buildx = new Buildx();
+    vi.spyOn(buildx, 'versionSatisfies').mockResolvedValue(buildxQuerySupport);
+    const build = new Build({buildx});
+    expect(await build.gitContext(ref, '860c1904a1ce19322e91ac35af1ab07466440c37', format)).toEqual(expected);
+  });
+});
+
 describe('resolveImageID', () => {
   it('matches', async () => {
     const imageID = 'sha256:bfb45ab72e46908183546477a08f8867fc40cebadd00af54b071b097aed127a9';
@@ -136,7 +199,7 @@ describe('getProvenanceInput', () => {
       '',
       ''
     ],
-  ])('given input %p', async (input: string, expected: string) => {
+  ])('given input %o', async (input: string, expected: string) => {
     setInput('provenance', input);
     expect(Build.getProvenanceInput('provenance')).toEqual(expected);
   });
@@ -165,7 +228,7 @@ describe('resolveProvenanceAttrs', () => {
       '',
       'builder-id=https://github.com/docker/actions-toolkit/actions/runs/2188748038/attempts/2'
     ],
-  ])('given %p', async (input: string, expected: string) => {
+  ])('given %o', async (input: string, expected: string) => {
     expect(Build.resolveProvenanceAttrs(input)).toEqual(expected);
   });
 });
@@ -180,7 +243,7 @@ describe('resolveSecret', () => {
     ['=bbbbbbb', false, '', '', new Error('=bbbbbbb is not a valid secret')],
     [`foo=${path.join(fixturesDir, 'secret.txt')}`, true, 'foo', 'bar', null],
     [`notfound=secret`, true, '', '', new Error('secret file secret not found')]
-  ])('given %p key and %p secret', async (kvp: string, file: boolean, exKey: string, exValue: string, error: Error | null) => {
+  ])('given %o key and %o secret', async (kvp: string, file: boolean, exKey: string, exValue: string, error: Error | null) => {
     try {
       let secret: string;
       if (file) {
@@ -191,7 +254,7 @@ describe('resolveSecret', () => {
       expect(secret).toEqual(`id=${exKey},src=${tmpName}`);
       expect(fs.readFileSync(tmpName, 'utf-8')).toEqual(exValue);
     } catch (e) {
-      // eslint-disable-next-line jest/no-conditional-expect
+      // eslint-disable-next-line vitest/no-conditional-expect
       expect(e.message).toEqual(error?.message);
     }
   });
@@ -201,12 +264,12 @@ describe('resolveSecret', () => {
     ['FOO=', 'FOO', '', new Error('FOO= is not a valid secret')],
     ['=bar', '', '', new Error('=bar is not a valid secret')],
     ['FOO=bar=baz', 'FOO', 'bar=baz', null]
-  ])('given %p key and %p env', async (kvp: string, exKey: string, exValue: string, error: Error | null) => {
+  ])('given %o key and %o env', async (kvp: string, exKey: string, exValue: string, error: Error | null) => {
     try {
       const secret = Build.resolveSecretEnv(kvp);
       expect(secret).toEqual(`id=${exKey},env=${exValue}`);
     } catch (e) {
-      // eslint-disable-next-line jest/no-conditional-expect
+      // eslint-disable-next-line vitest/no-conditional-expect
       expect(e.message).toEqual(error?.message);
     }
   });
@@ -255,7 +318,7 @@ describe('resolveCacheToAttrs', () => {
       'abcd1234',
       'type=gha,repository=foo/bar,mode=max,ghtoken=abcd1234',
     ],
-  ])('given %p', async (input: string, githubToken: string | undefined, expected: string) => {
+  ])('given %o', async (input: string, githubToken: string | undefined, expected: string) => {
     expect(Build.resolveCacheToAttrs(input, githubToken)).toEqual(expected);
   });
 });
@@ -271,7 +334,7 @@ describe('hasLocalExporter', () => {
     [['"type=tar","dest=/tmp/image.tar"'], false],
     [['" type= local" , dest=./release-out'], true],
     [['.'], true]
-  ])('given %p returns %p', async (exporters: Array<string>, expected: boolean) => {
+  ])('given %o returns %o', async (exporters: Array<string>, expected: boolean) => {
     expect(Build.hasLocalExporter(exporters)).toEqual(expected);
   });
 });
@@ -287,7 +350,7 @@ describe('hasTarExporter', () => {
     [['"type=tar","dest=/tmp/image.tar"'], true],
     [['" type= local" , dest=./release-out'], false],
     [['.'], false]
-  ])('given %p returns %p', async (exporters: Array<string>, expected: boolean) => {
+  ])('given %o returns %o', async (exporters: Array<string>, expected: boolean) => {
     expect(Build.hasTarExporter(exporters)).toEqual(expected);
   });
 });
@@ -305,7 +368,7 @@ describe('hasDockerExporter', () => {
     [['type=docker'], true, false],
     [['type=docker'], true, true],
     [['.'], true, true],
-  ])('given %p returns %p', async (exporters: Array<string>, expected: boolean, load: boolean | undefined) => {
+  ])('given %o returns %o', async (exporters: Array<string>, expected: boolean, load: boolean | undefined) => {
     expect(Build.hasDockerExporter(exporters, load)).toEqual(expected);
   });
 });
@@ -316,7 +379,7 @@ describe('hasAttestationType', () => {
     ['type=provenance,mode=min', 'provenance', true],
     ['type=sbom,true', 'sbom', true],
     ['type=foo,bar', 'provenance', false],
-  ])('given %p for %p returns %p', async (attrs: string, name: string, expected: boolean) => {
+  ])('given %o for %o returns %o', async (attrs: string, name: string, expected: boolean) => {
     expect(Build.hasAttestationType(name, attrs)).toEqual(expected);
   });
 });
@@ -340,7 +403,7 @@ describe('resolveAttestationAttrs', () => {
       '',
       ''
     ],
-  ])('given %p', async (input: string, expected: string) => {
+  ])('given %o', async (input: string, expected: string) => {
     expect(Build.resolveAttestationAttrs(input)).toEqual(expected);
   });
 });
@@ -348,10 +411,11 @@ describe('resolveAttestationAttrs', () => {
 describe('hasGitAuthTokenSecret', () => {
   // prettier-ignore
   test.each([
-    [['A_SECRET=abcdef0123456789'], false],
-    [['GIT_AUTH_TOKEN=abcdefghijklmno=0123456789'], true],
-  ])('given %p secret', async (kvp: Array<string>, expected: boolean) => {
-    expect(Build.hasGitAuthTokenSecret(kvp)).toBe(expected);
+    [['A_SECRET=abcdef0123456789'], undefined, false],
+    [['GIT_AUTH_TOKEN=abcdefghijklmno=0123456789'], undefined, true],
+    [['GIT_AUTH_TOKEN.github.com=abcdefghijklmno=0123456789'], 'github.com', true],
+  ])('given %o secret', async (kvp: Array<string>, domain: string | undefined, expected: boolean) => {
+    expect(Build.hasGitAuthTokenSecret(kvp, domain)).toBe(expected);
   });
 });
 

__tests__/buildx/builder.test.ts

@@ -14,18 +14,18 @@
  * limitations under the License.
  */
 
-import {describe, expect, it, jest, test} from '@jest/globals';
+import {describe, expect, it, vi, test} from 'vitest';
 import * as fs from 'fs';
 import * as path from 'path';
 
-import {Builder} from '../../src/buildx/builder';
-import {Exec} from '../../src/exec';
+import {Builder} from '../../src/buildx/builder.js';
+import {Exec} from '../../src/exec.js';
 
-import {BuilderInfo} from '../../src/types/buildx/builder';
+import {BuilderInfo} from '../../src/types/buildx/builder.js';
 
 const fixturesDir = path.join(__dirname, '..', '.fixtures');
 
-jest.spyOn(Builder.prototype, 'inspect').mockImplementation(async (): Promise<BuilderInfo> => {
+vi.spyOn(Builder.prototype, 'inspect').mockImplementation(async (): Promise<BuilderInfo> => {
   return {
     name: 'builder2',
     driver: 'docker-container',
@@ -46,10 +46,9 @@ jest.spyOn(Builder.prototype, 'inspect').mockImplementation(async (): Promise<Bu
 
 describe('exists', () => {
   it('valid', async () => {
-    const execSpy = jest.spyOn(Exec, 'getExecOutput');
+    const execSpy = vi.spyOn(Exec, 'getExecOutput');
     const builder = new Builder();
     await builder.exists('foo');
-    // eslint-disable-next-line jest/no-standalone-expect
     expect(execSpy).toHaveBeenCalledWith(`docker`, ['buildx', 'inspect', 'foo'], {
       silent: true,
       ignoreReturnCode: true
@@ -449,12 +448,107 @@ describe('parseInspect', () => {
                "all": true,
                "keepBytes": "94.06GiB",
              }
+           ],
+           "files": {
+             "buildkitd.toml": `debug = true
+insecure-entitlements = ["network.host", "security.insecure"]
+trace = true
+
+[log]
+  format = "text"
+`,
+             "foo.txt": `foo = bar
+baz = qux
+`,
+           }
+         }
+       ]
+     }
+    ],
+    [
+     'inspect12.txt',
+     {
+       "name": "nvidia",
+       "driver": "docker-container",
+       "lastActivity": new Date("2025-02-14T15:57:45.000Z"),
+       "nodes": [
+         {
+           "buildkit": "v0.20.0-rc2-4-gd30d8e22c.m",
+           "buildkitd-flags": "--allow-insecure-entitlement=network.host",
+           "driver-opts": [
+             "image=moby/buildkit:local",
+           ],
+           "endpoint": "unix:///var/run/docker.sock",
+           "name": "nvidia0",
+           "platforms": "linux/amd64,linux/amd64/v2,linux/amd64/v3,linux/arm64,linux/riscv64,linux/ppc64le,linux/s390x,linux/386,linux/arm/v7,linux/arm/v6",
+           "status": "running",
+           "features": {
+             "Cache export": true,
+             "Docker exporter": true,
+             "Multi-platform build": true,
+             "OCI exporter": true,
+           },
+           "labels": {
+             "org.mobyproject.buildkit.worker.executor": "oci",
+             "org.mobyproject.buildkit.worker.hostname": "76ac9a510d96",
+             "org.mobyproject.buildkit.worker.network": "host",
+             "org.mobyproject.buildkit.worker.oci.process-mode": "sandbox",
+             "org.mobyproject.buildkit.worker.selinux.enabled": "false",
+             "org.mobyproject.buildkit.worker.snapshotter": "overlayfs",
+           },
+           "devices": [
+             {
+               "annotations": {
+                 "foo": "bar",
+                 "org.mobyproject.buildkit.device.autoallow": "true"
+               },
+               "autoAllow": true,
+               "name": "nvidia.com/gpu=all"
+             },
+             {
+               "annotations": {
+                 "bar": "baz"
+               },
+               "autoAllow": false,
+               "name": "docker.com/gpu=venus"
+             }
+           ],
+           "gcPolicy": [
+             {
+               "all": false,
+               "filter": [
+                 "type==source.local",
+                 "type==exec.cachemount",
+                 "type==source.git.checkout"
+               ],
+               "keepDuration": "48h0m0s",
+               "maxUsedSpace": "488.3MiB",
+             },
+             {
+               "all": false,
+               "keepDuration": "1440h0m0s",
+               "maxUsedSpace": "93.13GiB",
+               "minFreeSpace": "188.1GiB",
+               "reservedSpace": "9.313GiB",
+             },
+             {
+               "all": false,
+               "maxUsedSpace": "93.13GiB",
+               "minFreeSpace": "188.1GiB",
+               "reservedSpace": "9.313GiB",
+             },
+             {
+               "all": true,
+               "maxUsedSpace": "93.13GiB",
+               "minFreeSpace": "188.1GiB",
+               "reservedSpace": "9.313GiB",
+             }
            ]
          }
        ]
      }
     ],
-  ])('given %p', async (inspectFile, expected) => {
+  ])('given %o', async (inspectFile, expected) => {
     expect(await Builder.parseInspect(fs.readFileSync(path.join(fixturesDir, inspectFile)).toString())).toEqual(expected);
   });
 });

__tests__/buildx/buildx.test.itg.ts

@@ -14,16 +14,16 @@
  * limitations under the License.
  */
 
-import {describe, expect, it} from '@jest/globals';
+import {describe, expect, it} from 'vitest';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import * as core from '@actions/core';
 
-import {Buildx} from '../../src/buildx/buildx';
-import {Build} from '../../src/buildx/build';
-import {Bake} from '../../src/buildx/bake';
-import {Exec} from '../../src/exec';
+import {Buildx} from '../../src/buildx/buildx.js';
+import {Build} from '../../src/buildx/build.js';
+import {Bake} from '../../src/buildx/bake.js';
+import {Exec} from '../../src/exec.js';
 
 const fixturesDir = path.join(__dirname, '..', '.fixtures');
 const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'buildx-buildx-itg-'));

__tests__/buildx/buildx.test.ts

@@ -14,29 +14,29 @@
  * limitations under the License.
  */
 
-import {describe, expect, it, jest, test, beforeEach, afterEach} from '@jest/globals';
+import {describe, expect, it, vi, test, beforeEach, afterEach} from 'vitest';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import * as rimraf from 'rimraf';
 import * as semver from 'semver';
 
-import {Buildx} from '../../src/buildx/buildx';
-import {Context} from '../../src/context';
-import {Exec} from '../../src/exec';
+import {Buildx} from '../../src/buildx/buildx.js';
+import {Context} from '../../src/context.js';
+import {Exec} from '../../src/exec.js';
 
-import {Cert, LocalState} from '../../src/types/buildx/buildx';
+import {Cert, LocalState} from '../../src/types/buildx/buildx.js';
 
 const fixturesDir = path.join(__dirname, '..', '.fixtures');
 const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'buildx-buildx-'));
-const tmpName = path.join(tmpDir, '.tmpname-jest');
+const tmpName = path.join(tmpDir, '.tmpname-vi');
 
-jest.spyOn(Context, 'tmpDir').mockImplementation((): string => {
+vi.spyOn(Context, 'tmpDir').mockImplementation((): string => {
   fs.mkdirSync(tmpDir, {recursive: true});
   return tmpDir;
 });
 
-jest.spyOn(Context, 'tmpName').mockImplementation((): string => {
+vi.spyOn(Context, 'tmpName').mockImplementation((): string => {
   return tmpName;
 });
 
@@ -47,7 +47,7 @@ afterEach(() => {
 describe('configDir', () => {
   const originalEnv = process.env;
   beforeEach(() => {
-    jest.resetModules();
+    vi.resetModules();
     process.env = {
       ...originalEnv,
       BUILDX_CONFIG: '/var/docker/buildx',
@@ -69,7 +69,7 @@ describe('configDir', () => {
 describe('certsDir', () => {
   const originalEnv = process.env;
   beforeEach(() => {
-    jest.resetModules();
+    vi.resetModules();
     process.env = {
       ...originalEnv,
       BUILDX_CONFIG: '/var/docker/buildx'
@@ -86,24 +86,22 @@ describe('certsDir', () => {
 
 describe('isAvailable', () => {
   it('docker cli', async () => {
-    const execSpy = jest.spyOn(Exec, 'getExecOutput');
+    const execSpy = vi.spyOn(Exec, 'getExecOutput');
     const buildx = new Buildx({
       standalone: false
     });
     await buildx.isAvailable();
-    // eslint-disable-next-line jest/no-standalone-expect
     expect(execSpy).toHaveBeenCalledWith(`docker`, ['buildx'], {
       silent: true,
       ignoreReturnCode: true
     });
   });
   it('standalone', async () => {
-    const execSpy = jest.spyOn(Exec, 'getExecOutput');
+    const execSpy = vi.spyOn(Exec, 'getExecOutput');
     const buildx = new Buildx({
       standalone: true
     });
     await buildx.isAvailable();
-    // eslint-disable-next-line jest/no-standalone-expect
     expect(execSpy).toHaveBeenCalledWith(`buildx`, [], {
       silent: true,
       ignoreReturnCode: true
@@ -113,7 +111,7 @@ describe('isAvailable', () => {
 
 describe('printVersion', () => {
   it('docker cli', async () => {
-    const execSpy = jest.spyOn(Exec, 'exec');
+    const execSpy = vi.spyOn(Exec, 'exec');
     const buildx = new Buildx({
       standalone: false
     });
@@ -123,7 +121,7 @@ describe('printVersion', () => {
     });
   });
   it('standalone', async () => {
-    const execSpy = jest.spyOn(Exec, 'exec');
+    const execSpy = vi.spyOn(Exec, 'exec');
     const buildx = new Buildx({
       standalone: true
     });
@@ -147,7 +145,7 @@ describe('parseVersion', () => {
     ['github.com/docker/buildx v0.4.1 bda4882a65349ca359216b135896bddc1d92461c', '0.4.1'],
     ['github.com/docker/buildx v0.4.2 fb7b670b764764dc4716df3eba07ffdae4cc47b2', '0.4.2'],
     ['github.com/docker/buildx f117971 f11797113e5a9b86bd976329c5dbb8a8bfdfadfa', 'f117971']
-  ])('given %p', async (stdout, expected) => {
+  ])('given %o', async (stdout, expected) => {
     expect(Buildx.parseVersion(stdout)).toEqual(expected);
   });
 });
@@ -157,7 +155,7 @@ describe('versionSatisfies', () => {
     ['0.4.1', '>=0.3.2', true],
     ['bda4882a65349ca359216b135896bddc1d92461c', '>0.1.0', false],
     ['f117971', '>0.6.0', true]
-  ])('given %p', async (version, range, expected) => {
+  ])('given %o', async (version, range, expected) => {
     const buildx = new Buildx();
     expect(await buildx.versionSatisfies(range, version)).toBe(expected);
   });
@@ -166,7 +164,7 @@ describe('versionSatisfies', () => {
 describe('resolveCertsDriverOpts', () => {
   const originalEnv = process.env;
   beforeEach(() => {
-    jest.resetModules();
+    vi.resetModules();
     process.env = {
       ...originalEnv,
       BUILDX_CONFIG: path.join(tmpDir, 'resolveCertsDriverOpts', 'buildx')
@@ -238,7 +236,7 @@ describe('resolveCertsDriverOpts', () => {
       ],
       []
     ],
-  ])('%p. given %p endpoint, %p driver', async (id: number, endpoint: string, driver: string, cert: Cert, expectedFiles: Array<string>, expectedOpts: Array<string>) => {
+  ])('%o. given %o endpoint, %o driver', async (id: number, endpoint: string, driver: string, cert: Cert, expectedFiles: Array<string>, expectedOpts: Array<string>) => {
     fs.mkdirSync(Buildx.certsDir, {recursive: true});
     expect(Buildx.resolveCertsDriverOpts(driver, endpoint, cert)).toEqual(expectedOpts);
     for (const k in expectedFiles) {
@@ -300,7 +298,7 @@ describe('localState', () => {
         DockerfilePath: '-'
       } as LocalState,
     ]
-  ])('given %p', async (ref: string, expected: LocalState) => {
+  ])('given %o', async (ref: string, expected: LocalState) => {
     const localState = Buildx.localState(ref, path.join(fixturesDir, 'buildx-refs'));
     expect(localState).toEqual(expected);
   });

__tests__/buildx/history.test.itg.ts

@@ -14,23 +14,65 @@
  * limitations under the License.
  */
 
-import {afterEach, beforeEach, describe, expect, it, jest, test} from '@jest/globals';
+import {describe, expect, it, test} from 'vitest';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
 
-import {Buildx} from '../../src/buildx/buildx';
-import {Bake} from '../../src/buildx/bake';
-import {Build} from '../../src/buildx/build';
-import {History} from '../../src/buildx/history';
-import {Exec} from '../../src/exec';
+import {Buildx} from '../../src/buildx/buildx.js';
+import {Bake} from '../../src/buildx/bake.js';
+import {Build} from '../../src/buildx/build.js';
+import {History} from '../../src/buildx/history.js';
+import {Exec} from '../../src/exec.js';
 
 const fixturesDir = path.join(__dirname, '..', '.fixtures');
 const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'buildx-history-itg-'));
 
 const maybe = !process.env.GITHUB_ACTIONS || (process.env.GITHUB_ACTIONS === 'true' && process.env.ImageOS && process.env.ImageOS.startsWith('ubuntu')) ? describe : describe.skip;
 
-maybe('exportBuild', () => {
+maybe('inspect', () => {
+  it('build', async () => {
+    const buildx = new Buildx();
+    const build = new Build({buildx: buildx});
+
+    fs.mkdirSync(tmpDir, {recursive: true});
+    await expect(
+      (async () => {
+        // prettier-ignore
+        const buildCmd = await buildx.getCommand([
+          '--builder', process.env.CTN_BUILDER_NAME ?? 'default',
+          'build', '-f', path.join(fixturesDir, 'hello.Dockerfile'),
+          '--metadata-file', build.getMetadataFilePath(),
+          fixturesDir
+        ]);
+        await Exec.exec(buildCmd.command, buildCmd.args);
+      })()
+    ).resolves.not.toThrow();
+
+    const metadata = build.resolveMetadata();
+    expect(metadata).toBeDefined();
+    const buildRef = build.resolveRef(metadata);
+    if (!buildRef) {
+      throw new Error('buildRef is undefined');
+    }
+    const [builderName, nodeName, ref] = buildRef.split('/');
+    expect(builderName).toBeDefined();
+    expect(nodeName).toBeDefined();
+    expect(ref).toBeDefined();
+
+    const history = new History({buildx: buildx});
+    const res = await history.inspect({
+      ref: ref,
+      builder: builderName
+    });
+
+    expect(res).toBeDefined();
+    expect(res?.Name).toBeDefined();
+    expect(res?.Ref).toBeDefined();
+  });
+});
+
+maybe('export', () => {
   // prettier-ignore
   test.each([
     [
@@ -50,7 +92,7 @@ maybe('exportBuild', () => {
         fixturesDir
       ],
     ]
-  ])('export build %p', async (_, bargs) => {
+  ])('export with build %p', async (_, bargs) => {
     const buildx = new Buildx();
     const build = new Build({buildx: buildx});
 
@@ -110,7 +152,7 @@ maybe('exportBuild', () => {
         'hello-matrix'
       ],
     ]
-  ])('export bake build %p', async (_, bargs) => {
+  ])('export with bake %p', async (_, bargs) => {
     const buildx = new Buildx();
     const bake = new Bake({buildx: buildx});
 
@@ -146,52 +188,3 @@ maybe('exportBuild', () => {
     expect(exportRes?.summaries).toBeDefined();
   });
 });
-
-maybe('exportBuild custom image', () => {
-  const originalEnv = process.env;
-  beforeEach(() => {
-    jest.resetModules();
-    process.env = {
-      ...originalEnv,
-      DOCKER_BUILD_EXPORT_BUILD_IMAGE: 'docker.io/dockereng/export-build:0.2.2'
-    };
-  });
-  afterEach(() => {
-    process.env = originalEnv;
-  });
-
-  it('with custom image', async () => {
-    const buildx = new Buildx();
-    const build = new Build({buildx: buildx});
-
-    fs.mkdirSync(tmpDir, {recursive: true});
-    await expect(
-      (async () => {
-        // prettier-ignore
-        const buildCmd = await buildx.getCommand([
-          '--builder', process.env.CTN_BUILDER_NAME ?? 'default',
-          'build', '-f', path.join(fixturesDir, 'hello.Dockerfile'),
-          '--metadata-file', build.getMetadataFilePath(),
-          fixturesDir
-        ]);
-        await Exec.exec(buildCmd.command, buildCmd.args);
-      })()
-    ).resolves.not.toThrow();
-
-    const metadata = build.resolveMetadata();
-    expect(metadata).toBeDefined();
-    const buildRef = build.resolveRef(metadata);
-    expect(buildRef).toBeDefined();
-
-    const history = new History({buildx: buildx});
-    const exportRes = await history.export({
-      refs: [buildRef ?? '']
-    });
-
-    expect(exportRes).toBeDefined();
-    expect(exportRes?.dockerbuildFilename).toBeDefined();
-    expect(exportRes?.dockerbuildSize).toBeDefined();
-    expect(fs.existsSync(exportRes?.dockerbuildFilename)).toBe(true);
-    expect(exportRes?.summaries).toBeDefined();
-  });
-});

__tests__/buildx/imagetools.test.itg.ts

@@ -0,0 +1,107 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it} from 'vitest';
+import * as fs from 'fs';
+import * as path from 'path';
+
+import {ImageTools} from '../../src/buildx/imagetools.js';
+
+import {Manifest as ImageToolsManifest} from '../../src/types/buildx/imagetools.js';
+import {Image} from '../../src/types/oci/config.js';
+import {Descriptor} from '../../src/types/oci/descriptor.js';
+
+const fixturesDir = path.join(__dirname, '..', '.fixtures');
+
+const maybe = !process.env.GITHUB_ACTIONS || (process.env.GITHUB_ACTIONS === 'true' && process.env.ImageOS && process.env.ImageOS.startsWith('ubuntu')) ? describe : describe.skip;
+
+maybe('inspectImage', () => {
+  it('inspect single platform', async () => {
+    const image = await new ImageTools().inspectImage('moby/buildkit:latest@sha256:5769c54b98840147b74128f38fb0b0a049e24b11a75bd81664131edd2854593f');
+    const expectedImage = <Image>JSON.parse(fs.readFileSync(path.join(fixturesDir, 'imagetools-01.json'), {encoding: 'utf-8'}).trim());
+    expect(image).toEqual(expectedImage);
+  });
+  it('inspect multi platform', async () => {
+    const image = await new ImageTools().inspectImage('moby/buildkit:latest@sha256:86c0ad9d1137c186e9d455912167df20e530bdf7f7c19de802e892bb8ca16552');
+    const expectedImage = <Record<string, Image>>JSON.parse(fs.readFileSync(path.join(fixturesDir, 'imagetools-02.json'), {encoding: 'utf-8'}).trim());
+    expect(image).toEqual(expectedImage);
+  });
+});
+
+maybe('inspectManifest', () => {
+  it('inspect descriptor', async () => {
+    const manifest = await new ImageTools().inspectManifest('moby/buildkit:latest@sha256:dccc69dd895968c4f21aa9e43e715f25f0cedfce4b17f1014c88c307928e22fc');
+    const expectedManifest = <Descriptor>JSON.parse(fs.readFileSync(path.join(fixturesDir, 'imagetools-03.json'), {encoding: 'utf-8'}).trim());
+    expect(manifest).toEqual(expectedManifest);
+  });
+  it('inspect index', async () => {
+    const manifest = await new ImageTools().inspectManifest('moby/buildkit:latest@sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6');
+    const expectedManifest = <ImageToolsManifest>JSON.parse(fs.readFileSync(path.join(fixturesDir, 'imagetools-04.json'), {encoding: 'utf-8'}).trim());
+    expect(manifest).toEqual(expectedManifest);
+  });
+});
+
+maybe('attestationDescriptors', () => {
+  it('returns buildkit attestations descriptors', async () => {
+    const attestations = await new ImageTools().attestationDescriptors('moby/buildkit:latest@sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6');
+    const expectedAttestations = <Array<Descriptor>>JSON.parse(fs.readFileSync(path.join(fixturesDir, 'imagetools-05.json'), {encoding: 'utf-8'}).trim());
+    expect(attestations).toEqual(expectedAttestations);
+  });
+  it('returns buildkit attestations descriptors for linux/amd64', async () => {
+    const attestations = await new ImageTools().attestationDescriptors('moby/buildkit:latest@sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6', {os: 'linux', architecture: 'amd64'});
+    const expectedAttestations = <Array<Descriptor>>JSON.parse(fs.readFileSync(path.join(fixturesDir, 'imagetools-06.json'), {encoding: 'utf-8'}).trim());
+    expect(attestations).toEqual(expectedAttestations);
+  });
+  it('returns buildkit attestations descriptors for linux/arm/v7', async () => {
+    const attestations = await new ImageTools().attestationDescriptors('moby/buildkit:latest@sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6', {os: 'linux', architecture: 'arm', variant: 'v7'});
+    const expectedAttestations = <Array<Descriptor>>JSON.parse(fs.readFileSync(path.join(fixturesDir, 'imagetools-07.json'), {encoding: 'utf-8'}).trim());
+    expect(attestations).toEqual(expectedAttestations);
+  });
+});
+
+maybe('attestationDigests', () => {
+  it('returns buildkit attestations digests', async () => {
+    const digests = await new ImageTools().attestationDigests('moby/buildkit:latest@sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6');
+    // prettier-ignore
+    expect(digests).toEqual([
+      'sha256:2ba4ad6eae1efcafee73a971953093c7c32b6938f2f9fd4998c8bf4d0fbe76f2',
+      'sha256:0709528fae1747ce17638ad2978ee7936b38a294136eaadaf692e415f64b1e03',
+      'sha256:241b7159129d53923c89708bcc052b3398086a826519896be2f025545916e43e',
+      'sha256:97f4a222a7992dba6dc1a43991d0cca1fcffdc25593033c6a3a7ff14c8651cbf',
+      'sha256:aa933713d8094b2708120e889acb6f7153dee4e0f3298ccd3e37a584cd0c260d',
+      'sha256:d95ca72d4f2a6bc416d4b2f3003b2af9d5f4dea99acec6ad3ab0c2082000a98c'
+    ]);
+  });
+  it('returns buildkit attestations digests for linux/amd64', async () => {
+    const digests = await new ImageTools().attestationDigests('moby/buildkit:latest@sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6', {os: 'linux', architecture: 'amd64'});
+    expect(digests).toEqual(['sha256:2ba4ad6eae1efcafee73a971953093c7c32b6938f2f9fd4998c8bf4d0fbe76f2']);
+  });
+  it('returns buildkit attestations digests for linux/arm/v7', async () => {
+    const digests = await new ImageTools().attestationDigests('moby/buildkit:latest@sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6', {os: 'linux', architecture: 'arm', variant: 'v7'});
+    expect(digests).toEqual(['sha256:0709528fae1747ce17638ad2978ee7936b38a294136eaadaf692e415f64b1e03']);
+  });
+});
+
+maybe('create', () => {
+  it('skips create command execution when skipExec is set', async () => {
+    const result = await new ImageTools().create({
+      sources: ['sha256:0709528fae1747ce17638ad2978ee7936b38a294136eaadaf692e415f64b1e03'],
+      tags: ['docker.io/user/app', 'docker.io/user/app2'],
+      skipExec: true
+    });
+    expect(result).toBeUndefined();
+  });
+});

__tests__/buildx/imagetools.test.ts

@@ -0,0 +1,141 @@
+/**
+ * Copyright 2026 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {afterEach, describe, expect, it, vi} from 'vitest';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import * as rimraf from 'rimraf';
+
+import {Buildx} from '../../src/buildx/buildx.js';
+import {ImageTools} from '../../src/buildx/imagetools.js';
+import {Context} from '../../src/context.js';
+import {Exec} from '../../src/exec.js';
+
+const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'buildx-imagetools-'));
+const metadataFile = path.join(tmpDir, 'imagetools-metadata.json');
+
+vi.spyOn(Context, 'tmpDir').mockImplementation((): string => {
+  fs.mkdirSync(tmpDir, {recursive: true});
+  return tmpDir;
+});
+
+vi.spyOn(Context, 'tmpName').mockImplementation((): string => {
+  return metadataFile;
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+  rimraf.sync(tmpDir);
+});
+
+describe('create', () => {
+  it('parses metadata and supports cwd sources', async () => {
+    const getCommand = vi.fn().mockResolvedValue({
+      command: 'docker',
+      args: ['buildx', 'imagetools', 'create']
+    });
+    const buildx = {getCommand} as unknown as Buildx;
+
+    fs.writeFileSync(
+      metadataFile,
+      JSON.stringify({
+        'containerimage.descriptor': {
+          mediaType: 'application/vnd.oci.image.index.v1+json',
+          digest: 'sha256:19ffeab6f8bc9293ac2c3fdf94ebe28396254c993aea0b5a542cfb02e0883fa3',
+          size: 4654
+        },
+        'image.name': 'docker.io/user/app,docker.io/user/app2'
+      })
+    );
+
+    const execSpy = vi.spyOn(Exec, 'getExecOutput').mockResolvedValue({
+      exitCode: 0,
+      stdout: '',
+      stderr: ''
+    });
+
+    const result = await new ImageTools({buildx}).create({
+      sources: ['cwd://descriptor.json', 'docker.io/library/alpine:latest'],
+      tags: ['docker.io/user/app:latest'],
+      silent: true
+    });
+
+    expect(getCommand).toHaveBeenCalledWith(['imagetools', 'create', '--tag', 'docker.io/user/app:latest', '--metadata-file', metadataFile, '--file', 'descriptor.json', 'docker.io/library/alpine:latest']);
+    expect(execSpy).toHaveBeenCalledWith('docker', ['buildx', 'imagetools', 'create'], {
+      ignoreReturnCode: true,
+      silent: true
+    });
+    expect(result).toEqual({
+      digest: 'sha256:19ffeab6f8bc9293ac2c3fdf94ebe28396254c993aea0b5a542cfb02e0883fa3',
+      descriptor: {
+        mediaType: 'application/vnd.oci.image.index.v1+json',
+        digest: 'sha256:19ffeab6f8bc9293ac2c3fdf94ebe28396254c993aea0b5a542cfb02e0883fa3',
+        size: 4654
+      },
+      imageNames: ['docker.io/user/app', 'docker.io/user/app2']
+    });
+  });
+
+  it('does not parse metadata in dry-run mode', async () => {
+    const getCommand = vi.fn().mockResolvedValue({
+      command: 'docker',
+      args: ['buildx', 'imagetools', 'create']
+    });
+    const buildx = {getCommand} as unknown as Buildx;
+
+    const execSpy = vi.spyOn(Exec, 'getExecOutput').mockResolvedValue({
+      exitCode: 0,
+      stdout: '',
+      stderr: ''
+    });
+
+    const result = await new ImageTools({buildx}).create({
+      sources: ['docker.io/library/alpine:latest'],
+      dryRun: true,
+      silent: true
+    });
+
+    expect(getCommand).toHaveBeenCalledWith(['imagetools', 'create', '--dry-run', 'docker.io/library/alpine:latest']);
+    expect(execSpy).toHaveBeenCalledWith('docker', ['buildx', 'imagetools', 'create'], {
+      ignoreReturnCode: true,
+      silent: true
+    });
+    expect(result).toBeUndefined();
+  });
+
+  it('skips command execution when skipExec is enabled', async () => {
+    const getCommand = vi.fn().mockResolvedValue({
+      command: 'docker',
+      args: ['buildx', 'imagetools', 'create']
+    });
+    const buildx = {getCommand} as unknown as Buildx;
+    const execSpy = vi.spyOn(Exec, 'getExecOutput').mockResolvedValue({
+      exitCode: 0,
+      stdout: '',
+      stderr: ''
+    });
+
+    const result = await new ImageTools({buildx}).create({
+      sources: ['docker.io/library/alpine:latest'],
+      skipExec: true
+    });
+
+    expect(getCommand).toHaveBeenCalledWith(['imagetools', 'create', '--metadata-file', metadataFile, 'docker.io/library/alpine:latest']);
+    expect(execSpy).not.toHaveBeenCalled();
+    expect(result).toBeUndefined();
+  });
+});

__tests__/buildx/install.test.itg.ts

@@ -14,10 +14,10 @@
  * limitations under the License.
  */
 
-import {describe, expect, test} from '@jest/globals';
+import {describe, expect, test} from 'vitest';
 import * as fs from 'fs';
 
-import {Install} from '../../src/buildx/install';
+import {Install} from '../../src/buildx/install.js';
 
 const maybe = !process.env.GITHUB_ACTIONS || (process.env.GITHUB_ACTIONS === 'true' && process.env.ImageOS && process.env.ImageOS.startsWith('ubuntu')) ? describe : describe.skip;
 
@@ -29,7 +29,12 @@ maybe('download', () => {
         const install = new Install({
           standalone: true
         });
-        const toolPath = await install.download(version);
+        const toolPath = await install.download({
+          version: version,
+          verifySignature: true,
+          ghaNoCache: true,
+          disableHtc: true
+        });
         if (!fs.existsSync(toolPath)) {
           throw new Error('toolPath does not exist');
         }

__tests__/buildx/install.test.ts

@@ -14,14 +14,15 @@
  * limitations under the License.
  */
 
-import {describe, expect, it, jest, test, afterEach} from '@jest/globals';
+import {describe, expect, it, test, afterEach} from 'vitest';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import * as rimraf from 'rimraf';
-import osm = require('os');
 
-import {Install} from '../../src/buildx/install';
+import {mockArch, mockPlatform} from '../.helpers/os.js';
+
+import {Install} from '../../src/buildx/install.js';
 
 const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'buildx-install-'));
 
@@ -36,20 +37,18 @@ describe('download', () => {
     ['v0.10.5', true],
     ['latest', true]
   ])(
-  'acquires %p of buildx (standalone: %p)', async (version, standalone) => {
-      const install = new Install({standalone: standalone});
-      const toolPath = await install.download(version);
-      expect(fs.existsSync(toolPath)).toBe(true);
-      let buildxBin: string;
-      if (standalone) {
-        buildxBin = await install.installStandalone(toolPath, tmpDir);
-      } else {
-        buildxBin = await install.installPlugin(toolPath, tmpDir);
-      }
-      expect(fs.existsSync(buildxBin)).toBe(true);
-    },
-    100000
-  );
+  'acquires %o of buildx (standalone: %o)', async (version, standalone) => {
+    const install = new Install({standalone: standalone});
+    const toolPath = await install.download({version});
+    expect(fs.existsSync(toolPath)).toBe(true);
+    let buildxBin: string;
+    if (standalone) {
+      buildxBin = await install.installStandalone(toolPath, tmpDir);
+    } else {
+      buildxBin = await install.installPlugin(toolPath, tmpDir);
+    }
+    expect(fs.existsSync(buildxBin)).toBe(true);
+  }, 100000);
 
   // prettier-ignore
   test.each([
@@ -57,22 +56,22 @@ describe('download', () => {
     ['v0.9.0'],
     ['v0.10.5'],
   ])(
-  'acquires %p of buildx with cache', async (version) => {
+  'acquires %o of buildx with cache', async (version) => {
     const install = new Install({standalone: false});
-    const toolPath = await install.download(version);
+    const toolPath = await install.download({version});
     expect(fs.existsSync(toolPath)).toBe(true);
-  });
+  }, 100000);
 
   // prettier-ignore
   test.each([
     ['v0.11.2'],
     ['v0.12.0'],
   ])(
-  'acquires %p of buildx without cache', async (version) => {
+  'acquires %o of buildx without cache', async (version) => {
     const install = new Install({standalone: false});
-    const toolPath = await install.download(version, true);
+    const toolPath = await install.download({version: version, ghaNoCache: true});
     expect(fs.existsSync(toolPath)).toBe(true);
-  });
+  }, 100000);
 
   // TODO: add tests for arm
   // prettier-ignore
@@ -87,18 +86,15 @@ describe('download', () => {
     ['linux', 's390x'],
   ])(
   'acquires buildx for %s/%s', async (os, arch) => {
-      jest.spyOn(osm, 'platform').mockImplementation(() => os as NodeJS.Platform);
-      jest.spyOn(osm, 'arch').mockImplementation(() => arch);
-      const install = new Install();
-      const buildxBin = await install.download('latest');
-      expect(fs.existsSync(buildxBin)).toBe(true);
-    },
-    100000
-  );
+    mockPlatform(os as NodeJS.Platform);
+    mockArch(arch);
+    const install = new Install();
+    const buildxBin = await install.download({version: 'latest'});
+    expect(fs.existsSync(buildxBin)).toBe(true);
+  }, 100000);
 });
 
 describe('build', () => {
-  // eslint-disable-next-line jest/no-disabled-tests
   it.skip('builds refs/pull/648/head', async () => {
     const install = new Install();
     const toolPath = await install.build('https://github.com/docker/buildx.git#refs/pull/648/head');
@@ -107,7 +103,6 @@ describe('build', () => {
     expect(fs.existsSync(buildxBin)).toBe(true);
   }, 100000);
 
-  // eslint-disable-next-line jest/no-disabled-tests
   it.skip('builds 67bd6f4dc82a9cd96f34133dab3f6f7af803bb14', async () => {
     const install = new Install();
     const toolPath = await install.build('https://github.com/docker/buildx.git#67bd6f4dc82a9cd96f34133dab3f6f7af803bb14');
@@ -123,7 +118,12 @@ describe('getDownloadVersion', () => {
     expect(version.key).toEqual('official');
     expect(version.version).toEqual('latest');
     expect(version.downloadURL).toEqual('https://github.com/docker/buildx/releases/download/v%s/%s');
-    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/buildx-releases.json');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/buildx-releases.json'
+    });
   });
 
   it('returns official v0.10.1 download version', async () => {
@@ -131,23 +131,51 @@ describe('getDownloadVersion', () => {
     expect(version.key).toEqual('official');
     expect(version.version).toEqual('v0.10.1');
     expect(version.downloadURL).toEqual('https://github.com/docker/buildx/releases/download/v%s/%s');
-    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/buildx-releases.json');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/buildx-releases.json'
+    });
   });
 
-  it('returns lab latest download version', async () => {
-    const version = await Install.getDownloadVersion('lab:latest');
-    expect(version.key).toEqual('lab');
+  it('returns cloud latest download version', async () => {
+    const version = await Install.getDownloadVersion('cloud:latest');
+    expect(version.key).toEqual('cloud');
     expect(version.version).toEqual('latest');
     expect(version.downloadURL).toEqual('https://github.com/docker/buildx-desktop/releases/download/v%s/%s');
-    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/buildx-lab-releases.json');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/buildx-lab-releases.json'
+    });
   });
 
-  it('returns lab v0.11.2-desktop.2 download version', async () => {
-    const version = await Install.getDownloadVersion('lab:v0.11.2-desktop.2');
-    expect(version.key).toEqual('lab');
+  it('returns cloud v0.11.2-desktop.2 download version', async () => {
+    const version = await Install.getDownloadVersion('cloud:v0.11.2-desktop.2');
+    expect(version.key).toEqual('cloud');
     expect(version.version).toEqual('v0.11.2-desktop.2');
     expect(version.downloadURL).toEqual('https://github.com/docker/buildx-desktop/releases/download/v%s/%s');
-    expect(version.releasesURL).toEqual('https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/buildx-lab-releases.json');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/buildx-lab-releases.json'
+    });
+  });
+
+  it('returns cloud for lab version', async () => {
+    const version = await Install.getDownloadVersion('lab:latest');
+    expect(version.key).toEqual('cloud');
+    expect(version.version).toEqual('latest');
+    expect(version.downloadURL).toEqual('https://github.com/docker/buildx-desktop/releases/download/v%s/%s');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/buildx-lab-releases.json'
+    });
   });
 
   it('unknown repo', async () => {
@@ -172,8 +200,8 @@ describe('getRelease', () => {
     expect(release?.html_url).toEqual('https://github.com/docker/buildx/releases/tag/v0.10.1');
   });
 
-  it('returns v0.11.2-desktop.2 lab GitHub release', async () => {
-    const version = await Install.getDownloadVersion('lab:v0.11.2-desktop.2');
+  it('returns v0.11.2-desktop.2 cloud GitHub release', async () => {
+    const version = await Install.getDownloadVersion('cloud:v0.11.2-desktop.2');
     const release = await Install.getRelease(version);
     expect(release).not.toBeNull();
     expect(release?.id).toEqual(118213369);
@@ -183,6 +211,6 @@ describe('getRelease', () => {
 
   it('unknown release', async () => {
     const version = await Install.getDownloadVersion('foo');
-    await expect(Install.getRelease(version)).rejects.toThrow(new Error('Cannot find Buildx release foo in https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/buildx-releases.json'));
+    await expect(Install.getRelease(version)).rejects.toThrow(new Error('Cannot find Buildx release foo in releases JSON'));
   });
 });

__tests__/cache.test.itg.ts

@@ -14,19 +14,33 @@
  * limitations under the License.
  */
 
-import {describe, expect, it} from '@jest/globals';
+import {describe, expect, it} from 'vitest';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
 
-import {Cache} from '../src/cache';
+import {Cache} from '../src/cache.js';
+import {Util} from '../src/util.js';
 
 const fixturesDir = path.join(__dirname, '.fixtures');
 const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'cache-itg-'));
 
 describe('cache', () => {
-  it('github-repo', async () => {
-    const r = (Math.random() + 1).toString(36).substring(7);
+  it('caches github-repo', async () => {
+    const r = Util.generateRandomString();
+    const htcName = `cache-test-github-repo-${r}`;
+    const c = new Cache({
+      htcName: htcName,
+      htcVersion: `v1.0.0+${r}`,
+      baseCacheDir: path.join(tmpDir, '.cache-test'),
+      cacheFile: 'github-repo.json'
+    });
+    expect(await c.save(path.join(fixturesDir, 'github-repo.json'), true)).not.toEqual('');
+    expect(await c.find()).not.toEqual('');
+  });
+
+  it('caches github-repo with post state', async () => {
+    const r = Util.generateRandomString();
     const htcName = `cache-test-github-repo-${r}`;
     const c = new Cache({
       htcName: htcName,
@@ -35,6 +49,7 @@ describe('cache', () => {
       cacheFile: 'github-repo.json'
     });
     expect(await c.save(path.join(fixturesDir, 'github-repo.json'))).not.toEqual('');
+    expect(await Cache.post()).not.toBeNull();
     expect(await c.find()).not.toEqual('');
   });
 });

__tests__/compose/compose.test.ts

@@ -0,0 +1,107 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it, vi, test, afterEach} from 'vitest';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import * as rimraf from 'rimraf';
+import * as semver from 'semver';
+
+import {Context} from '../../src/context.js';
+import {Exec} from '../../src/exec.js';
+
+import {Compose} from '../../src/compose/compose.js';
+
+const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'compose-compose-'));
+const tmpName = path.join(tmpDir, '.tmpname-vi');
+
+vi.spyOn(Context, 'tmpDir').mockImplementation((): string => {
+  fs.mkdirSync(tmpDir, {recursive: true});
+  return tmpDir;
+});
+
+vi.spyOn(Context, 'tmpName').mockImplementation((): string => {
+  return tmpName;
+});
+
+afterEach(() => {
+  rimraf.sync(tmpDir);
+});
+
+describe('isAvailable', () => {
+  it('docker cli', async () => {
+    const execSpy = vi.spyOn(Exec, 'getExecOutput');
+    const compose = new Compose({
+      standalone: false
+    });
+    await compose.isAvailable();
+    expect(execSpy).toHaveBeenCalledWith(`docker`, ['compose'], {
+      silent: true,
+      ignoreReturnCode: true
+    });
+  });
+  it('standalone', async () => {
+    const execSpy = vi.spyOn(Exec, 'getExecOutput');
+    const compose = new Compose({
+      standalone: true
+    });
+    await compose.isAvailable();
+    expect(execSpy).toHaveBeenCalledWith(`compose`, [], {
+      silent: true,
+      ignoreReturnCode: true
+    });
+  });
+});
+
+describe('printVersion', () => {
+  it('docker cli', async () => {
+    const execSpy = vi.spyOn(Exec, 'exec');
+    const compose = new Compose({
+      standalone: false
+    });
+    await compose.printVersion();
+    expect(execSpy).toHaveBeenCalledWith(`docker`, ['compose', 'version'], {
+      failOnStdErr: false
+    });
+  });
+  it('standalone', async () => {
+    const execSpy = vi.spyOn(Exec, 'exec');
+    const compose = new Compose({
+      standalone: true
+    });
+    await compose.printVersion();
+    expect(execSpy).toHaveBeenCalledWith(`compose`, ['version'], {
+      failOnStdErr: false
+    });
+  });
+});
+
+describe('version', () => {
+  it('valid', async () => {
+    const compose = new Compose();
+    expect(semver.valid(await compose.version())).not.toBeUndefined();
+  });
+});
+
+describe('parseVersion', () => {
+  // prettier-ignore
+  test.each([
+    ['Docker Compose version v2.31.0', '2.31.0'],
+  ])('given %o', async (stdout, expected) => {
+    expect(Compose.parseVersion(stdout)).toEqual(expected);
+  });
+});

__tests__/compose/install.test.itg.ts

@@ -0,0 +1,42 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, test} from 'vitest';
+import * as fs from 'fs';
+
+import {Install} from '../../src/compose/install.js';
+
+const maybe = !process.env.GITHUB_ACTIONS || (process.env.GITHUB_ACTIONS === 'true' && process.env.ImageOS && process.env.ImageOS.startsWith('ubuntu')) ? describe : describe.skip;
+
+maybe('download', () => {
+  // prettier-ignore
+  test.each(['latest'])(
+    'install compose %s', async (version) => {
+      await expect((async () => {
+        const install = new Install({
+          standalone: true
+        });
+        const toolPath = await install.download(version);
+        if (!fs.existsSync(toolPath)) {
+          throw new Error('toolPath does not exist');
+        }
+        const binPath = await install.installStandalone(toolPath);
+        if (!fs.existsSync(binPath)) {
+          throw new Error('binPath does not exist');
+        }
+      })()).resolves.not.toThrow();
+    }, 60000);
+});

__tests__/compose/install.test.ts

@@ -0,0 +1,178 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it, test, afterEach} from 'vitest';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import * as rimraf from 'rimraf';
+
+import {mockArch, mockPlatform} from '../.helpers/os.js';
+
+import {Install} from '../../src/compose/install.js';
+
+const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'compose-install-'));
+
+afterEach(function () {
+  rimraf.sync(tmpDir);
+});
+
+describe('download', () => {
+  // prettier-ignore
+  test.each([
+    ['v2.31.0', false],
+    ['v2.32.4', true],
+    ['latest', true]
+  ])(
+  'acquires %o of compose (standalone: %o)', async (version, standalone) => {
+    const install = new Install({standalone: standalone});
+    const toolPath = await install.download(version);
+    expect(fs.existsSync(toolPath)).toBe(true);
+    let composeBin: string;
+    if (standalone) {
+      composeBin = await install.installStandalone(toolPath, tmpDir);
+    } else {
+      composeBin = await install.installPlugin(toolPath, tmpDir);
+    }
+    expect(fs.existsSync(composeBin)).toBe(true);
+  }, 100000);
+
+  // prettier-ignore
+  test.each([
+    // following versions are already cached to htc from previous test cases
+    ['v2.31.0'],
+    ['v2.32.4'],
+  ])(
+  'acquires %o of compose with cache', async (version) => {
+    const install = new Install({standalone: false});
+    const toolPath = await install.download(version);
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);
+
+  // prettier-ignore
+  test.each([
+    ['v2.27.1'],
+    ['v2.28.0'],
+  ])(
+  'acquires %o of compose without cache', async (version) => {
+    const install = new Install({standalone: false});
+    const toolPath = await install.download(version, true);
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);
+
+  // TODO: add tests for arm
+  // prettier-ignore
+  test.each([
+    ['win32', 'x64'],
+    ['win32', 'arm64'],
+    ['darwin', 'x64'],
+    ['darwin', 'arm64'],
+    ['linux', 'x64'],
+    ['linux', 'arm64'],
+    ['linux', 'ppc64'],
+    ['linux', 's390x'],
+  ])(
+  'acquires compose for %s/%s', async (os, arch) => {
+    mockPlatform(os as NodeJS.Platform);
+    mockArch(arch);
+    const install = new Install();
+    const composeBin = await install.download('latest');
+    expect(fs.existsSync(composeBin)).toBe(true);
+  }, 100000);
+});
+
+describe('getDownloadVersion', () => {
+  it('returns official latest download version', async () => {
+    const version = await Install.getDownloadVersion('latest');
+    expect(version.key).toEqual('official');
+    expect(version.version).toEqual('latest');
+    expect(version.downloadURL).toEqual('https://github.com/docker/compose/releases/download/v%s/%s');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/compose-releases.json'
+    });
+  });
+  it('returns official v2.24.3 download version', async () => {
+    const version = await Install.getDownloadVersion('v2.24.3');
+    expect(version.key).toEqual('official');
+    expect(version.version).toEqual('v2.24.3');
+    expect(version.downloadURL).toEqual('https://github.com/docker/compose/releases/download/v%s/%s');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/compose-releases.json'
+    });
+  });
+  it('returns cloud latest download version', async () => {
+    const version = await Install.getDownloadVersion('cloud:latest');
+    expect(version.key).toEqual('cloud');
+    expect(version.version).toEqual('latest');
+    expect(version.downloadURL).toEqual('https://github.com/docker/compose-desktop/releases/download/v%s/%s');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/compose-lab-releases.json'
+    });
+  });
+  it('returns cloud v2.27.1-desktop.1 download version', async () => {
+    const version = await Install.getDownloadVersion('cloud:v2.27.1-desktop.1');
+    expect(version.key).toEqual('cloud');
+    expect(version.version).toEqual('v2.27.1-desktop.1');
+    expect(version.downloadURL).toEqual('https://github.com/docker/compose-desktop/releases/download/v%s/%s');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/compose-lab-releases.json'
+    });
+  });
+  it('unknown repo', async () => {
+    await expect(Install.getDownloadVersion('foo:bar')).rejects.toThrow(new Error('Cannot find compose version for foo:bar'));
+  });
+});
+
+describe('getRelease', () => {
+  it('returns latest official GitHub release', async () => {
+    const version = await Install.getDownloadVersion('latest');
+    const release = await Install.getRelease(version);
+    expect(release).not.toBeNull();
+    expect(release?.tag_name).not.toEqual('');
+  });
+  it('returns v2.24.3 official GitHub release', async () => {
+    const version = await Install.getDownloadVersion('v2.24.3');
+    const release = await Install.getRelease(version);
+    expect(release).not.toBeNull();
+    expect(release?.id).toEqual(138380726);
+    expect(release?.tag_name).toEqual('v2.24.3');
+    expect(release?.html_url).toEqual('https://github.com/docker/compose/releases/tag/v2.24.3');
+  });
+  it('returns v2.27.1-desktop.1 cloud GitHub release', async () => {
+    const version = await Install.getDownloadVersion('cloud:v2.27.1-desktop.1');
+    const release = await Install.getRelease(version);
+    expect(release).not.toBeNull();
+    expect(release?.id).toEqual(157591108);
+    expect(release?.tag_name).toEqual('v2.27.1-desktop.1');
+    expect(release?.html_url).toEqual('https://github.com/docker/compose-desktop/releases/tag/v2.27.1-desktop.1');
+  });
+  it('unknown release', async () => {
+    const version = await Install.getDownloadVersion('foo');
+    await expect(Install.getRelease(version)).rejects.toThrow(new Error('Cannot find Compose release foo in releases JSON'));
+  });
+});

__tests__/context.test.ts

@@ -14,38 +14,44 @@
  * limitations under the License.
  */
 
-import {describe, expect, jest, it, afterEach} from '@jest/globals';
+import {describe, expect, it, afterEach} from 'vitest';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import * as rimraf from 'rimraf';
 
-import {Context} from '../src/context';
+import {Context} from '../src/context.js';
 
 const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'context-'));
-const tmpName = path.join(tmpDir, '.tmpname-jest');
-
-jest.spyOn(Context, 'tmpDir').mockImplementation((): string => {
-  fs.mkdirSync(tmpDir, {recursive: true});
-  return tmpDir;
-});
-
-jest.spyOn(Context, 'tmpName').mockImplementation((): string => {
-  return tmpName;
-});
 
 afterEach(() => {
   rimraf.sync(tmpDir);
+  fs.mkdirSync(tmpDir, {recursive: true});
 });
 
-describe('gitRef', () => {
-  it('returns refs/heads/master', async () => {
-    expect(Context.gitRef()).toEqual('refs/heads/master');
+describe('tmpDir', () => {
+  it('returns an existing directory and keeps it stable', () => {
+    const dir = Context.tmpDir();
+    expect(fs.existsSync(dir)).toBe(true);
+    expect(fs.statSync(dir).isDirectory()).toBe(true);
+    expect(Context.tmpDir()).toEqual(dir);
   });
 });
 
-describe('gitContext', () => {
-  it('returns refs/heads/master', async () => {
-    expect(Context.gitContext()).toEqual('https://github.com/docker/actions-toolkit.git#refs/heads/master');
+describe('tmpName', () => {
+  it('returns a path for the provided tmpdir and template', () => {
+    const name = Context.tmpName({
+      tmpdir: tmpDir,
+      template: '.tmpname-XXXXXX'
+    });
+    expect(path.dirname(name)).toEqual(tmpDir);
+    expect(path.basename(name)).toMatch(/^\.tmpname-/);
+    expect(fs.existsSync(name)).toBe(false);
+  });
+
+  it('returns different paths on consecutive calls', () => {
+    const first = Context.tmpName({tmpdir: tmpDir, template: '.tmpname-XXXXXX'});
+    const second = Context.tmpName({tmpdir: tmpDir, template: '.tmpname-XXXXXX'});
+    expect(first).not.toEqual(second);
   });
 });

__tests__/cosign/cosign.test.ts

@@ -0,0 +1,89 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it, vi, test} from 'vitest';
+import fs from 'fs';
+import path from 'path';
+import * as semver from 'semver';
+
+import {Exec} from '../../src/exec.js';
+import {Cosign} from '../../src/cosign/cosign.js';
+
+const fixturesDir = path.join(__dirname, '..', '.fixtures');
+
+describe('isAvailable', () => {
+  it('checks Cosign is available', async () => {
+    const execSpy = vi.spyOn(Exec, 'getExecOutput');
+    const cosign = new Cosign();
+    await cosign.isAvailable();
+    expect(execSpy).toHaveBeenCalledWith(`cosign`, [], {
+      silent: true,
+      ignoreReturnCode: true
+    });
+  });
+});
+
+describe('printVersion', () => {
+  it('prints Cosign version', async () => {
+    const execSpy = vi.spyOn(Exec, 'exec');
+    const cosign = new Cosign();
+    await cosign.printVersion();
+    expect(execSpy).toHaveBeenCalledWith(`cosign`, ['version', '--json'], {
+      failOnStdErr: false
+    });
+  });
+});
+
+describe('version', () => {
+  it('valid', async () => {
+    const cosign = new Cosign();
+    expect(semver.valid(await cosign.version())).not.toBeUndefined();
+  });
+});
+
+describe('versionSatisfies', () => {
+  test.each([
+    ['v0.4.1', '>=0.3.2', true],
+    ['v0.8.0', '>0.6.0', true],
+    ['v0.8.0', '<0.3.0', false]
+  ])('given %o', async (version, range, expected) => {
+    const cosign = new Cosign();
+    expect(await cosign.versionSatisfies(range, version)).toBe(expected);
+  });
+});
+
+describe('parseCommandOutput', () => {
+  // prettier-ignore
+  test.each([
+    [path.join(fixturesDir, 'cosign', 'sign-output1.txt')],
+    [path.join(fixturesDir, 'cosign', 'sign-output2.txt')],
+    [path.join(fixturesDir, 'cosign', 'sign-output3.txt')],
+  ])('parsing %o', async (fixturePath: string) => {
+    const signResult = Cosign.parseCommandOutput(fs.readFileSync(fixturePath, 'utf-8'));
+    expect(signResult).toBeDefined();
+    expect(signResult.bundle).toBeDefined();
+  });
+
+  // prettier-ignore
+  test.each([
+    [path.join(fixturesDir, 'cosign', 'verify-output-err1.txt')],
+  ])('parsing %o', async (fixturePath: string) => {
+    const signResult = Cosign.parseCommandOutput(fs.readFileSync(fixturePath, 'utf-8'));
+    expect(signResult).toBeDefined();
+    expect(signResult.bundle).toBeUndefined();
+    expect(signResult.errors).toBeDefined();
+  });
+});

__tests__/cosign/install.test.itg.ts

@@ -0,0 +1,53 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it, test} from 'vitest';
+import * as fs from 'fs';
+
+import {Install} from '../../src/cosign/install.js';
+
+const maybe = !process.env.GITHUB_ACTIONS || (process.env.GITHUB_ACTIONS === 'true' && process.env.ImageOS && process.env.ImageOS.startsWith('ubuntu')) ? describe : describe.skip;
+
+describe('download', () => {
+  // prettier-ignore
+  test.each(['latest'])(
+    'install cosign %s', async (version) => {
+      await expect((async () => {
+        const install = new Install();
+        const toolPath = await install.download({
+          version: version,
+          verifySignature: true
+        });
+        if (!fs.existsSync(toolPath)) {
+          throw new Error('toolPath does not exist');
+        }
+        const binPath = await install.install(toolPath);
+        if (!fs.existsSync(binPath)) {
+          throw new Error('binPath does not exist');
+        }
+      })()).resolves.not.toThrow();
+    }, 60000);
+});
+
+maybe('build', () => {
+  it.skip('builds refs/pull/4492/head', async () => {
+    const install = new Install();
+    const toolPath = await install.build('https://github.com/sigstore/cosign.git#refs/pull/4492/head');
+    expect(fs.existsSync(toolPath)).toBe(true);
+    const buildxBin = await install.install(toolPath);
+    expect(fs.existsSync(buildxBin)).toBe(true);
+  }, 500000);
+});

__tests__/cosign/install.test.ts

@@ -0,0 +1,138 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it, test, afterEach} from 'vitest';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import * as rimraf from 'rimraf';
+
+import {mockArch, mockPlatform} from '../.helpers/os.js';
+
+import {Install} from '../../src/cosign/install.js';
+
+const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'cosign-install-'));
+
+afterEach(function () {
+  rimraf.sync(tmpDir);
+});
+
+describe('download', () => {
+  // prettier-ignore
+  test.each([
+    ['v2.6.1'],
+    ['v3.0.1'],
+    ['latest']
+  ])(
+  'acquires %o of cosign', async (version) => {
+    const install = new Install();
+    const toolPath = await install.download({version});
+    expect(fs.existsSync(toolPath)).toBe(true);
+    const cosignBin = await install.install(toolPath, tmpDir);
+    expect(fs.existsSync(cosignBin)).toBe(true);
+  }, 100000);
+
+  // prettier-ignore
+  test.each([
+    // following versions are already cached to htc from previous test cases
+    ['v2.6.1'],
+    ['v3.0.1'],
+  ])(
+  'acquires %o of cosign with cache', async (version) => {
+    const install = new Install();
+    const toolPath = await install.download({version});
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);
+
+  // prettier-ignore
+  test.each([
+    ['v2.5.3'],
+    ['v2.6.0'],
+  ])(
+  'acquires %o of cosign without cache', async (version) => {
+    const install = new Install();
+    const toolPath = await install.download({
+      version: version,
+      ghaNoCache: true
+    });
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);
+
+  // TODO: add tests for arm
+  // prettier-ignore
+  test.each([
+    ['win32', 'x64'],
+    ['darwin', 'x64'],
+    ['darwin', 'arm64'],
+    ['linux', 'x64'],
+    ['linux', 'arm64']
+  ])(
+  'acquires undock for %s/%s', async (os, arch) => {
+    mockPlatform(os as NodeJS.Platform);
+    mockArch(arch);
+    const install = new Install();
+    const cosignBin = await install.download({
+      version: 'latest'
+    });
+    expect(fs.existsSync(cosignBin)).toBe(true);
+  }, 100000);
+});
+
+describe('getDownloadVersion', () => {
+  it('returns latest download version', async () => {
+    const version = await Install.getDownloadVersion('latest');
+    expect(version.version).toEqual('latest');
+    expect(version.downloadURL).toEqual('https://github.com/sigstore/cosign/releases/download/v%s/%s');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/cosign-releases.json'
+    });
+  });
+  it('returns v3.0.2 download version', async () => {
+    const version = await Install.getDownloadVersion('v3.0.2');
+    expect(version.version).toEqual('v3.0.2');
+    expect(version.downloadURL).toEqual('https://github.com/sigstore/cosign/releases/download/v%s/%s');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/cosign-releases.json'
+    });
+  });
+});
+
+describe('getRelease', () => {
+  it('returns latest GitHub release', async () => {
+    const version = await Install.getDownloadVersion('latest');
+    const release = await Install.getRelease(version);
+    expect(release).not.toBeNull();
+    expect(release?.tag_name).not.toEqual('');
+  });
+  it('returns v3.0.2 GitHub release', async () => {
+    const version = await Install.getDownloadVersion('v3.0.2');
+    const release = await Install.getRelease(version);
+    expect(release).not.toBeNull();
+    expect(release?.id).toEqual(253720294);
+    expect(release?.tag_name).toEqual('v3.0.2');
+    expect(release?.html_url).toEqual('https://github.com/sigstore/cosign/releases/tag/v3.0.2');
+  });
+  it('unknown release', async () => {
+    const version = await Install.getDownloadVersion('foo');
+    await expect(Install.getRelease(version)).rejects.toThrow(new Error('Cannot find Cosign release foo in releases JSON'));
+  });
+});

__tests__/docker/docker.test.itg.ts

@@ -14,9 +14,9 @@
  * limitations under the License.
  */
 
-import {describe, expect, it, test} from '@jest/globals';
+import {describe, expect, it, test} from 'vitest';
 
-import {Docker} from '../../src/docker/docker';
+import {Docker} from '../../src/docker/docker.js';
 
 const maybe = !process.env.GITHUB_ACTIONS || (process.env.GITHUB_ACTIONS === 'true' && process.env.ImageOS && process.env.ImageOS.startsWith('ubuntu')) ? describe : describe.skip;
 
@@ -55,7 +55,7 @@ maybe('pull', () => {
         if (err === undefined) {
           throw new Error(`Expected no error, but got: ${e.message}`);
         }
-        // eslint-disable-next-line jest/no-conditional-expect
+        // eslint-disable-next-line vitest/no-conditional-expect
         expect(e.message).toContain(err);
       }
     }, 600000);

__tests__/docker/docker.test.ts

@@ -14,17 +14,26 @@
  * limitations under the License.
  */
 
-import {afterEach, beforeEach, describe, expect, it, jest} from '@jest/globals';
+import {afterEach, beforeEach, describe, expect, it, vi} from 'vitest';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import * as io from '@actions/io';
-import osm = require('os');
 import * as rimraf from 'rimraf';
 
-import {Docker} from '../../src/docker/docker';
+import {mockHomedir} from '../.helpers/os.js';
 
-import {ConfigFile} from '../../src/types/docker/docker';
+import {Docker} from '../../src/docker/docker.js';
+
+import {ConfigFile} from '../../src/types/docker/docker.js';
+
+vi.mock('@actions/io', async () => {
+  const actual = await vi.importActual<typeof import('@actions/io')>('@actions/io');
+  return {
+    ...actual,
+    which: vi.fn()
+  };
+});
 
 const fixturesDir = path.join(__dirname, '..', '.fixtures');
 const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'docker-docker-'));
@@ -36,7 +45,7 @@ afterEach(function () {
 describe('configDir', () => {
   const originalEnv = process.env;
   beforeEach(() => {
-    jest.resetModules();
+    vi.resetModules();
     process.env = {
       ...originalEnv,
       DOCKER_CONFIG: '/var/docker/config'
@@ -47,7 +56,7 @@ describe('configDir', () => {
   });
   it('returns default', async () => {
     process.env.DOCKER_CONFIG = '';
-    jest.spyOn(osm, 'homedir').mockImplementation(() => path.join('/tmp', 'home'));
+    mockHomedir(path.join('/tmp', 'home'));
     expect(Docker.configDir).toEqual(path.join('/tmp', 'home', '.docker'));
   });
   it('returns from env', async () => {
@@ -58,7 +67,7 @@ describe('configDir', () => {
 describe('configFile', () => {
   const originalEnv = process.env;
   beforeEach(() => {
-    jest.resetModules();
+    vi.resetModules();
     if (!fs.existsSync(tmpDir)) {
       fs.mkdirSync(tmpDir, {recursive: true});
     }
@@ -96,7 +105,7 @@ describe('configFile', () => {
 
 describe('isAvailable', () => {
   it('cli', async () => {
-    const ioWhichSpy = jest.spyOn(io, 'which');
+    const ioWhichSpy = vi.mocked(io.which).mockResolvedValue('/usr/bin/docker');
     await Docker.isAvailable();
     expect(ioWhichSpy).toHaveBeenCalledTimes(1);
     expect(ioWhichSpy).toHaveBeenCalledWith('docker', true);
@@ -105,7 +114,7 @@ describe('isAvailable', () => {
 
 describe('exec', () => {
   it('returns docker version', async () => {
-    const execSpy = jest.spyOn(Docker, 'exec');
+    const execSpy = vi.spyOn(Docker, 'exec');
     await Docker.exec(['version'], {
       ignoreReturnCode: true,
       silent: true
@@ -132,7 +141,7 @@ describe('exec', () => {
 
 describe('getExecOutput', () => {
   it('returns docker version', async () => {
-    const execSpy = jest.spyOn(Docker, 'getExecOutput');
+    const execSpy = vi.spyOn(Docker, 'getExecOutput');
     await Docker.getExecOutput(['version'], {
       ignoreReturnCode: true,
       silent: true
@@ -159,7 +168,7 @@ describe('getExecOutput', () => {
 
 describe('context', () => {
   it('call docker context show', async () => {
-    const execSpy = jest.spyOn(Docker, 'getExecOutput');
+    const execSpy = vi.spyOn(Docker, 'getExecOutput');
     await Docker.context().catch(() => {
       // noop
     });
@@ -181,7 +190,7 @@ describe('context', () => {
 
 describe('contextInspect', () => {
   it('call docker context inspect', async () => {
-    const execSpy = jest.spyOn(Docker, 'getExecOutput');
+    const execSpy = vi.spyOn(Docker, 'getExecOutput');
     await Docker.contextInspect('foo').catch(() => {
       // noop
     });
@@ -203,7 +212,7 @@ describe('contextInspect', () => {
 
 describe('printVersion', () => {
   it('call docker version', async () => {
-    const execSpy = jest.spyOn(Docker, 'exec');
+    const execSpy = vi.spyOn(Docker, 'exec');
     await Docker.printVersion().catch(() => {
       // noop
     });
@@ -219,7 +228,7 @@ describe('printVersion', () => {
 
 describe('printInfo', () => {
   it('call docker info', async () => {
-    const execSpy = jest.spyOn(Docker, 'exec');
+    const execSpy = vi.spyOn(Docker, 'exec');
     await Docker.printInfo().catch(() => {
       // noop
     });

__tests__/docker/install.test.itg.ts

@@ -14,17 +14,29 @@
  * limitations under the License.
  */
 
-import {describe, test, expect} from '@jest/globals';
+import {beforeAll, describe, test, expect} from 'vitest';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
 
-import {Install, InstallSource, InstallSourceArchive, InstallSourceImage} from '../../src/docker/install';
-import {Docker} from '../../src/docker/docker';
-import {Exec} from '../../src/exec';
+import {Install, InstallSource, InstallSourceArchive, InstallSourceImage} from '../../src/docker/install.js';
+import {Docker} from '../../src/docker/docker.js';
+import {Install as RegclientInstall} from '../../src/regclient/install.js';
+import {Install as UndockInstall} from '../../src/undock/install.js';
+import {Exec} from '../../src/exec.js';
 
 const tmpDir = () => fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'docker-install-itg-'));
 
+beforeAll(async () => {
+  const undockInstall = new UndockInstall();
+  const undockBinPath = await undockInstall.download('v0.10.0', true);
+  await undockInstall.install(undockBinPath);
+
+  const regclientInstall = new RegclientInstall();
+  const regclientBinPath = await regclientInstall.download('v0.8.2', true);
+  await regclientInstall.install(regclientBinPath);
+}, 100000);
+
 describe('root', () => {
   // prettier-ignore
   test.each(getSources(true))(
@@ -69,6 +81,36 @@ describe('rootless', () => {
   );
 });
 
+describe('tcp', () => {
+  // prettier-ignore
+  test.each(getSources(false))(
+    'install %s', async (source) => {
+      await ensureNoSystemContainerd();
+      const install = new Install({
+        source: source,
+        runDir: tmpDir(),
+        contextName: 'foo',
+        daemonConfig: `{"debug":true}`,
+        localTCPPort: 2378
+      });
+      await expect(
+        tryInstall(install, async () => {
+          const out = await Docker.getExecOutput(['info'], {
+            env: Object.assign({}, process.env, {
+              DOCKER_HOST: 'tcp://localhost:2378',
+              DOCKER_CONTENT_TRUST: 'false'
+            }) as {
+              [key: string]: string;
+            }
+          });
+          expect(out.exitCode).toBe(0);
+        })
+      ).resolves.not.toThrow();
+    },
+    30 * 60 * 1000
+  );
+});
+
 async function tryInstall(install: Install, extraCheck?: () => Promise<void>): Promise<void> {
   try {
     await install.download();
@@ -103,11 +145,12 @@ async function ensureNoSystemContainerd() {
 function getSources(root: boolean): Array<InstallSource> {
   const dockerInstallType = process.env.DOCKER_INSTALL_TYPE;
   const dockerInstallVersion = process.env.DOCKER_INSTALL_VERSION;
+  const dockerInstallChannel = process.env.DOCKER_INSTALL_CHANNEL || 'stable';
   if (dockerInstallType && dockerInstallVersion) {
     if (dockerInstallType === 'archive') {
       // prettier-ignore
       return [
-        { type: dockerInstallType, version: dockerInstallVersion, channel: 'stable'} as InstallSourceArchive
+        { type: dockerInstallType, version: dockerInstallVersion, channel: dockerInstallChannel} as InstallSourceArchive
       ];
     } else {
       // prettier-ignore
@@ -123,7 +166,8 @@ function getSources(root: boolean): Array<InstallSource> {
       {type: 'image', tag: 'master'} as InstallSourceImage,
       {type: 'image', tag: 'latest'} as InstallSourceImage,
       {type: 'archive', version: 'v26.1.4', channel: 'stable'} as InstallSourceArchive,
-      {type: 'archive', version: 'latest', channel: 'stable'} as InstallSourceArchive
+      {type: 'archive', version: 'latest', channel: 'stable'} as InstallSourceArchive,
+      {type: 'archive', version: 'v29.0.0-rc.1', channel: 'test'} as InstallSourceArchive
     ];
   } else {
     // prettier-ignore

__tests__/docker/install.test.ts

@@ -14,14 +14,15 @@
  * limitations under the License.
  */
 
-import {describe, expect, jest, test, beforeEach, afterEach, it} from '@jest/globals';
+import {describe, expect, vi, test, beforeEach, afterEach, it} from 'vitest';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import * as rimraf from 'rimraf';
-import osm = require('os');
 
-import {Install, InstallSourceArchive, InstallSourceImage} from '../../src/docker/install';
+import {mockArch, mockPlatform} from '../.helpers/os.js';
+
+import {Install, InstallSourceArchive, InstallSourceImage} from '../../src/docker/install.js';
 
 const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'docker-install-'));
 
@@ -51,6 +52,7 @@ describe('download', () => {
     [archive('v20.10.22', 'stable'), 'linux'],
     [archive('v20.10.22', 'stable'), 'darwin'],
     [archive('v20.10.22', 'stable'), 'win32'],
+    [archive('v29.0.0-rc.1', 'test'), 'linux'],
 
     [image('master'), 'linux'],
     [image('master'), 'win32'],
@@ -58,11 +60,12 @@ describe('download', () => {
     [image('27.3.1'), 'linux'],
     [image('27.3.1'), 'win32'],
   ])(
-  'acquires %p of docker (%s)', async (source, platformOS) => {
-    jest.spyOn(osm, 'platform').mockImplementation(() => platformOS as NodeJS.Platform);
+  'acquires %o of docker (%s)', async (source, platformOS) => {
+    mockPlatform(platformOS as NodeJS.Platform);
+    mockArch('x64');
     const install = new Install({
       source: source,
-      runDir: tmpDir,
+      runDir: tmpDir
     });
     const toolPath = await install.download();
     expect(fs.existsSync(toolPath)).toBe(true);
@@ -76,7 +79,7 @@ describe('getRelease', () => {
     expect(release?.tag_name).not.toEqual('');
   });
 
-  it('returns v23.0.0 buildx GitHub release', async () => {
+  it('returns v23.0.0 docker GitHub release', async () => {
     const release = await Install.getRelease('v23.0.0');
     expect(release).not.toBeNull();
     expect(release?.id).toEqual(91109643);
@@ -84,15 +87,23 @@ describe('getRelease', () => {
     expect(release?.html_url).toEqual('https://github.com/moby/moby/releases/tag/v23.0.0');
   });
 
+  it('returns v29.0.0-rc.1 docker GitHub release', async () => {
+    const release = await Install.getRelease('v29.0.0-rc.1');
+    expect(release).not.toBeNull();
+    expect(release?.id).toEqual(252020476);
+    expect(release?.tag_name).toEqual('docker-v29.0.0-rc.1');
+    expect(release?.html_url).toEqual('https://github.com/moby/moby/releases/tag/docker-v29.0.0-rc.1');
+  });
+
   it('unknown release', async () => {
-    await expect(Install.getRelease('foo')).rejects.toThrow(new Error('Cannot find Docker release foo in https://raw.githubusercontent.com/docker/actions-toolkit/main/.github/docker-releases.json'));
+    await expect(Install.getRelease('foo')).rejects.toThrow(new Error('Cannot find Docker release foo in releases JSON'));
   });
 });
 
 describe('limaImage', () => {
   const originalEnv = process.env;
   beforeEach(() => {
-    jest.resetModules();
+    vi.resetModules();
     process.env = {
       ...originalEnv,
       LIMA_IMAGES: `x86_64:https://cloud-images.ubuntu.com/releases/23.10/release-20231011/ubuntu-23.10-server-cloudimg-amd64.img@sha256:f6529be56da3429a56e4f5ef202bf4958201bc63f8541e478caa6e8eb712e635

__tests__/dockerhub.test.ts

@@ -14,24 +14,24 @@
  * limitations under the License.
  */
 
-import {describe, expect, jest, it} from '@jest/globals';
+import {describe, expect, vi, it} from 'vitest';
 import * as fs from 'fs';
 import * as path from 'path';
 
-import {DockerHub} from '../src/dockerhub';
-import {RepositoryResponse, RepositoryTagsResponse} from '../src/types/dockerhub';
+import {DockerHub} from '../src/dockerhub.js';
+import {RepositoryResponse, RepositoryTagsResponse} from '../src/types/dockerhub.js';
 
-import repoInfoFixture from './.fixtures/dockerhub-repoinfo.json';
-import repoTagsFixture from './.fixtures/dockerhub-repotags.json';
-import repoAllTagsFixture from './.fixtures/dockerhub-repoalltags.json';
+import repoInfoFixture from './.fixtures/dockerhub-repoinfo.json' with {type: 'json'};
+import repoTagsFixture from './.fixtures/dockerhub-repotags.json' with {type: 'json'};
+import repoAllTagsFixture from './.fixtures/dockerhub-repoalltags.json' with {type: 'json'};
 
 describe('getRepository', () => {
   it('returns repo info', async () => {
-    jest.spyOn(DockerHub.prototype, 'getRepository').mockImplementation((): Promise<RepositoryResponse> => {
+    vi.spyOn(DockerHub.prototype, 'getRepository').mockImplementation((): Promise<RepositoryResponse> => {
       return <Promise<RepositoryResponse>>(repoInfoFixture as unknown);
     });
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    jest.spyOn(DockerHub as any, 'login').mockReturnValue('jwt_token');
+    vi.spyOn(DockerHub as any, 'login').mockReturnValue('jwt_token');
     const dockerhub = await DockerHub.build({
       credentials: {
         username: 'foo',
@@ -50,11 +50,11 @@ describe('getRepository', () => {
 
 describe('getRepositoryTags', () => {
   it('return repo tags', async () => {
-    jest.spyOn(DockerHub.prototype, 'getRepositoryTags').mockImplementation((): Promise<RepositoryTagsResponse> => {
+    vi.spyOn(DockerHub.prototype, 'getRepositoryTags').mockImplementation((): Promise<RepositoryTagsResponse> => {
       return <Promise<RepositoryTagsResponse>>(repoTagsFixture as unknown);
     });
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    jest.spyOn(DockerHub as any, 'login').mockReturnValue('jwt_token');
+    vi.spyOn(DockerHub as any, 'login').mockReturnValue('jwt_token');
     const dockerhub = await DockerHub.build({
       credentials: {
         username: 'foo',
@@ -74,11 +74,11 @@ describe('getRepositoryTags', () => {
 
 describe('getRepositoryAllTags', () => {
   it('return repo all tags', async () => {
-    jest.spyOn(DockerHub.prototype, 'getRepositoryAllTags').mockImplementation((): Promise<RepositoryTagsResponse> => {
+    vi.spyOn(DockerHub.prototype, 'getRepositoryAllTags').mockImplementation((): Promise<RepositoryTagsResponse> => {
       return <Promise<RepositoryTagsResponse>>(repoAllTagsFixture as unknown);
     });
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    jest.spyOn(DockerHub as any, 'login').mockReturnValue('jwt_token');
+    vi.spyOn(DockerHub as any, 'login').mockReturnValue('jwt_token');
     const dockerhub = await DockerHub.build({
       credentials: {
         username: 'foo',

__tests__/exec.test.ts

@@ -14,13 +14,13 @@
  * limitations under the License.
  */
 
-import {describe, expect, it, jest} from '@jest/globals';
+import {describe, expect, it, vi} from 'vitest';
 
-import {Exec} from '../src/exec';
+import {Exec} from '../src/exec.js';
 
 describe('exec', () => {
   it('returns docker version', async () => {
-    const execSpy = jest.spyOn(Exec, 'exec');
+    const execSpy = vi.spyOn(Exec, 'exec');
     await Exec.exec('docker', ['version'], {
       ignoreReturnCode: true,
       silent: true
@@ -34,7 +34,7 @@ describe('exec', () => {
 
 describe('getExecOutput', () => {
   it('returns docker version', async () => {
-    const execSpy = jest.spyOn(Exec, 'getExecOutput');
+    const execSpy = vi.spyOn(Exec, 'getExecOutput');
     await Exec.getExecOutput('docker', ['version'], {
       ignoreReturnCode: true,
       silent: true

__tests__/git.test.itg.ts

@@ -1,5 +1,5 @@
 /**
- * Copyright 2024 actions-toolkit authors
+ * Copyright 2026 actions-toolkit authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -14,17 +14,12 @@
  * limitations under the License.
  */
 
-// eslint-disable-next-line @typescript-eslint/no-var-requires
-const fs = require('fs');
+import {describe, expect, it} from 'vitest';
 
-module.exports = results => {
-  const allSkipped = results.testResults.every(result => {
-    return result.skipped;
+import {Git} from '../src/git.js';
+
+describe('remoteSha', () => {
+  it('returns sha using github api', async () => {
+    expect(await Git.remoteSha('https://github.com/docker/buildx.git', 'refs/pull/648/head', process.env.GITHUB_TOKEN)).toEqual('f11797113e5a9b86bd976329c5dbb8a8bfdfadfa');
   });
-  if (allSkipped) {
-    console.log('All tests were skipped!');
-    // create an empty file to signal that all tests were skipped for CI
-    fs.closeSync(fs.openSync('./coverage/allSkipped.txt', 'w'));
-  }
-  return results;
-};
+});

__tests__/git.test.ts

@@ -14,19 +14,19 @@
  * limitations under the License.
  */
 
-import {beforeEach, describe, expect, it, jest} from '@jest/globals';
+import {beforeEach, describe, expect, it, vi} from 'vitest';
 
-import {Git} from '../src/git';
-import {Exec} from '../src/exec';
+import {Git} from '../src/git.js';
+import {Exec} from '../src/exec.js';
 import {ExecOutput} from '@actions/exec';
 
 beforeEach(() => {
-  jest.restoreAllMocks();
+  vi.restoreAllMocks();
 });
 
 describe('context', () => {
   it('returns mocked ref and sha', async () => {
-    jest.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+    vi.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
       const fullCmd = `${cmd} ${args?.join(' ')}`;
       let result = '';
       switch (fullCmd) {
@@ -54,10 +54,10 @@ describe('context', () => {
 
 describe('isInsideWorkTree', () => {
   it('have been called', async () => {
-    const execSpy = jest.spyOn(Exec, 'getExecOutput');
+    const execSpy = vi.spyOn(Exec, 'getExecOutput');
     try {
       await Git.isInsideWorkTree();
-    } catch (err) {
+    } catch {
       // noop
     }
     expect(execSpy).toHaveBeenCalledWith(`git`, ['rev-parse', '--is-inside-work-tree'], {
@@ -71,17 +71,14 @@ describe('remoteSha', () => {
   it('returns sha using git ls-remote', async () => {
     expect(await Git.remoteSha('https://github.com/docker/buildx.git', 'refs/pull/648/head')).toEqual('f11797113e5a9b86bd976329c5dbb8a8bfdfadfa');
   });
-  it('returns sha using github api', async () => {
-    expect(await Git.remoteSha('https://github.com/docker/buildx.git', 'refs/pull/648/head', process.env.GITHUB_TOKEN)).toEqual('f11797113e5a9b86bd976329c5dbb8a8bfdfadfa');
-  });
 });
 
 describe('remoteURL', () => {
   it('have been called', async () => {
-    const execSpy = jest.spyOn(Exec, 'getExecOutput');
+    const execSpy = vi.spyOn(Exec, 'getExecOutput');
     try {
       await Git.remoteURL();
-    } catch (err) {
+    } catch {
       // noop
     }
     expect(execSpy).toHaveBeenCalledWith(`git`, ['remote', 'get-url', 'origin'], {
@@ -93,7 +90,7 @@ describe('remoteURL', () => {
 
 describe('ref', () => {
   it('returns mocked ref', async () => {
-    jest.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+    vi.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
       const fullCmd = `${cmd} ${args?.join(' ')}`;
       let result = '';
       switch (fullCmd) {
@@ -110,14 +107,12 @@ describe('ref', () => {
         exitCode: 0
       });
     });
-
     const ref = await Git.ref();
-
     expect(ref).toEqual('refs/heads/test');
   });
 
   it('returns mocked detached tag ref', async () => {
-    jest.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+    vi.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
       const fullCmd = `${cmd} ${args?.join(' ')}`;
       let result = '';
       switch (fullCmd) {
@@ -134,14 +129,12 @@ describe('ref', () => {
         exitCode: 0
       });
     });
-
     const ref = await Git.ref();
-
     expect(ref).toEqual('refs/tags/8.0.0');
   });
 
   it('returns mocked detached tag ref (shallow clone)', async () => {
-    jest.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+    vi.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
       const fullCmd = `${cmd} ${args?.join(' ')}`;
       let result = '';
       switch (fullCmd) {
@@ -158,14 +151,12 @@ describe('ref', () => {
         exitCode: 0
       });
     });
-
     const ref = await Git.ref();
-
     expect(ref).toEqual('refs/tags/8.0.0');
   });
 
   it('returns mocked detached pull request merge ref (shallow clone)', async () => {
-    jest.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+    vi.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
       const fullCmd = `${cmd} ${args?.join(' ')}`;
       let result = '';
       switch (fullCmd) {
@@ -182,14 +173,12 @@ describe('ref', () => {
         exitCode: 0
       });
     });
-
     const ref = await Git.ref();
-
     expect(ref).toEqual('refs/pull/221/merge');
   });
 
   it('should throws an error when detached HEAD ref is not supported', async () => {
-    jest.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+    vi.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
       const fullCmd = `${cmd} ${args?.join(' ')}`;
       let result = '';
       switch (fullCmd) {
@@ -206,12 +195,11 @@ describe('ref', () => {
         exitCode: 0
       });
     });
-
     await expect(Git.ref()).rejects.toThrow('Cannot find detached HEAD ref in "wrong, HEAD, tag: 8.0.0"');
   });
 
   it('returns mocked detached branch ref', async () => {
-    jest.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+    vi.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
       const fullCmd = `${cmd} ${args?.join(' ')}`;
       let result = '';
       switch (fullCmd) {
@@ -228,19 +216,206 @@ describe('ref', () => {
         exitCode: 0
       });
     });
-
     const ref = await Git.ref();
-
     expect(ref).toEqual('refs/heads/test');
   });
+
+  it('returns mocked detached branch ref checked out by SHA', async () => {
+    vi.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+      const fullCmd = `${cmd} ${args?.join(' ')}`;
+      let result = '';
+      switch (fullCmd) {
+        case 'git branch --show-current':
+          result = '';
+          break;
+        case 'git show -s --pretty=%D':
+          result = 'HEAD, origin/feature-branch';
+          break;
+      }
+      return Promise.resolve({
+        stdout: result,
+        stderr: '',
+        exitCode: 0
+      });
+    });
+    const ref = await Git.ref();
+    expect(ref).toEqual('refs/heads/feature-branch');
+  });
+
+  it('infers ref from local branch when detached HEAD returns only "HEAD"', async () => {
+    vi.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+      const fullCmd = `${cmd} ${args?.join(' ')}`;
+      let result = '';
+      switch (fullCmd) {
+        case 'git branch --show-current':
+          result = '';
+          break;
+        case 'git show -s --pretty=%D':
+          result = 'HEAD';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/heads/':
+          result = 'refs/heads/main\nrefs/heads/develop';
+          break;
+      }
+      return Promise.resolve({
+        stdout: result,
+        stderr: '',
+        exitCode: 0
+      });
+    });
+    const ref = await Git.ref();
+    expect(ref).toEqual('refs/heads/main');
+  });
+
+  it('infers ref from local branch when detached HEAD returns only "grafted, HEAD"', async () => {
+    vi.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+      const fullCmd = `${cmd} ${args?.join(' ')}`;
+      let result = '';
+      switch (fullCmd) {
+        case 'git branch --show-current':
+          result = '';
+          break;
+        case 'git show -s --pretty=%D':
+          result = 'grafted, HEAD';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/heads/':
+          result = 'refs/heads/main\nrefs/heads/develop';
+          break;
+      }
+      return Promise.resolve({
+        stdout: result,
+        stderr: '',
+        exitCode: 0
+      });
+    });
+    const ref = await Git.ref();
+    expect(ref).toEqual('refs/heads/main');
+  });
+
+  it('infers ref from remote branch when no local branch contains HEAD', async () => {
+    vi.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+      const fullCmd = `${cmd} ${args?.join(' ')}`;
+      let result = '';
+      switch (fullCmd) {
+        case 'git branch --show-current':
+          result = '';
+          break;
+        case 'git show -s --pretty=%D':
+          result = 'HEAD';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/heads/':
+          result = '';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/remotes/':
+          result = 'refs/remotes/origin/feature';
+          break;
+      }
+      return Promise.resolve({
+        stdout: result,
+        stderr: '',
+        exitCode: 0
+      });
+    });
+    const ref = await Git.ref();
+    expect(ref).toEqual('refs/heads/feature');
+  });
+
+  it('infers ref from tag when no branch contains HEAD', async () => {
+    vi.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+      const fullCmd = `${cmd} ${args?.join(' ')}`;
+      let result = '';
+      switch (fullCmd) {
+        case 'git branch --show-current':
+          result = '';
+          break;
+        case 'git show -s --pretty=%D':
+          result = 'HEAD';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/heads/':
+          result = '';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/remotes/':
+          result = '';
+          break;
+        case 'git tag --contains HEAD':
+          result = 'v1.0.0\nv0.9.0';
+          break;
+      }
+      return Promise.resolve({
+        stdout: result,
+        stderr: '',
+        exitCode: 0
+      });
+    });
+    const ref = await Git.ref();
+    expect(ref).toEqual('refs/tags/v1.0.0');
+  });
+
+  it('throws error when cannot infer ref from detached HEAD', async () => {
+    vi.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+      const fullCmd = `${cmd} ${args?.join(' ')}`;
+      let result = '';
+      switch (fullCmd) {
+        case 'git branch --show-current':
+          result = '';
+          break;
+        case 'git show -s --pretty=%D':
+          result = 'HEAD';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/heads/':
+          result = '';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/remotes/':
+          result = '';
+          break;
+        case 'git tag --contains HEAD':
+          result = '';
+          break;
+      }
+      return Promise.resolve({
+        stdout: result,
+        stderr: '',
+        exitCode: 0
+      });
+    });
+    await expect(Git.ref()).rejects.toThrow('Cannot infer ref from detached HEAD');
+  });
+
+  it('handles remote ref without branch pattern when inferring from remote', async () => {
+    vi.spyOn(Exec, 'getExecOutput').mockImplementation((cmd, args): Promise<ExecOutput> => {
+      const fullCmd = `${cmd} ${args?.join(' ')}`;
+      let result = '';
+      switch (fullCmd) {
+        case 'git branch --show-current':
+          result = '';
+          break;
+        case 'git show -s --pretty=%D':
+          result = 'HEAD';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/heads/':
+          result = '';
+          break;
+        case 'git for-each-ref --format=%(refname) --contains HEAD --sort=-committerdate refs/remotes/':
+          result = 'refs/remotes/unusual-format';
+          break;
+      }
+      return Promise.resolve({
+        stdout: result,
+        stderr: '',
+        exitCode: 0
+      });
+    });
+    const ref = await Git.ref();
+    expect(ref).toEqual('refs/remotes/unusual-format');
+  });
 });
 
 describe('fullCommit', () => {
   it('have been called', async () => {
-    const execSpy = jest.spyOn(Exec, 'getExecOutput');
+    const execSpy = vi.spyOn(Exec, 'getExecOutput');
     try {
       await Git.fullCommit();
-    } catch (err) {
+    } catch {
       // noop
     }
     expect(execSpy).toHaveBeenCalledWith(`git`, ['show', '--format=%H', 'HEAD', '--quiet', '--'], {
@@ -252,10 +427,10 @@ describe('fullCommit', () => {
 
 describe('shortCommit', () => {
   it('have been called', async () => {
-    const execSpy = jest.spyOn(Exec, 'getExecOutput');
+    const execSpy = vi.spyOn(Exec, 'getExecOutput');
     try {
       await Git.shortCommit();
-    } catch (err) {
+    } catch {
       // noop
     }
     expect(execSpy).toHaveBeenCalledWith(`git`, ['show', '--format=%h', 'HEAD', '--quiet', '--'], {
@@ -267,10 +442,10 @@ describe('shortCommit', () => {
 
 describe('tag', () => {
   it('have been called', async () => {
-    const execSpy = jest.spyOn(Exec, 'getExecOutput');
+    const execSpy = vi.spyOn(Exec, 'getExecOutput');
     try {
       await Git.tag();
-    } catch (err) {
+    } catch {
       // noop
     }
     expect(execSpy).toHaveBeenCalledWith(`git`, ['tag', '--points-at', 'HEAD', '--sort', '-version:creatordate'], {
@@ -283,6 +458,6 @@ describe('tag', () => {
 describe('getCommitDate', () => {
   it('head', async () => {
     const date = await Git.commitDate('HEAD');
-    await expect(date).toBeInstanceOf(Date);
+    expect(date).toBeInstanceOf(Date);
   });
 });

__tests__/github/artifact.test.itg.ts

@@ -0,0 +1,42 @@
+/**
+ * Copyright 2026 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it} from 'vitest';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+
+import {GitHubArtifact} from '../../src/github/artifact.js';
+import {Util} from '../../src/util.js';
+
+const fixturesDir = path.join(__dirname, '..', '.fixtures');
+const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'github-itg-'));
+
+const maybe = !process.env.GITHUB_ACTIONS || (process.env.GITHUB_ACTIONS === 'true' && process.env.ImageOS && process.env.ImageOS.startsWith('ubuntu')) ? describe : describe.skip;
+
+maybe('upload', () => {
+  it('uploads an artifact', async () => {
+    const filename = path.join(tmpDir, `github-repo-${Util.generateRandomString()}.json`);
+    fs.copyFileSync(path.join(fixturesDir, `github-repo.json`), filename);
+    const res = await GitHubArtifact.upload({
+      filename: filename,
+      retentionDays: 1
+    });
+    expect(res).toBeDefined();
+    console.log('uploadArtifactResponse', res);
+    expect(res?.url).toBeDefined();
+  });
+});

__tests__/github/github.test.itg.ts

@@ -0,0 +1,41 @@
+/**
+ * Copyright 2026 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it} from 'vitest';
+
+import {GitHub} from '../../src/github/github.js';
+
+describe('repoData', () => {
+  it('returns docker/actions-toolkit', async () => {
+    if (!process.env.GITHUB_TOKEN) {
+      console.log(`GitHub token not available, skipping test`);
+      return;
+    }
+    const originalEnv = process.env;
+    process.env = {
+      ...originalEnv,
+      GITHUB_REPOSITORY: 'docker/actions-toolkit'
+    };
+    try {
+      const github = new GitHub({token: process.env.GITHUB_TOKEN});
+      const repo = await github.repoData();
+      const fullName = repo.full_name ?? `${repo.owner?.login}/${repo.name}`;
+      expect(fullName).toEqual('docker/actions-toolkit');
+    } finally {
+      process.env = originalEnv;
+    }
+  });
+});

__tests__/github/github.test.ts

@@ -14,21 +14,31 @@
  * limitations under the License.
  */
 
-import {describe, expect, jest, it, beforeEach, afterEach} from '@jest/globals';
+import {describe, expect, vi, it, beforeEach, afterEach, test} from 'vitest';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as core from '@actions/core';
 
-import {GitHub} from '../src/github';
-import {GitHubRepo} from '../src/types/github';
+import {GitHub} from '../../src/github/github.js';
+import {GitHubRepo} from '../../src/types/github/github.js';
 
-import repoFixture from './.fixtures/github-repo.json';
-jest.spyOn(GitHub.prototype, 'repoData').mockImplementation((): Promise<GitHubRepo> => {
-  return <Promise<GitHubRepo>>(repoFixture as unknown);
+import repoFixture from '../.fixtures/github-repo.json' with {type: 'json'};
+
+const fixturesDir = path.join(__dirname, '..', '.fixtures');
+
+vi.mock('@actions/core', async () => {
+  const actual = await vi.importActual<typeof import('@actions/core')>('@actions/core');
+  return {
+    ...actual,
+    info: vi.fn()
+  };
 });
 
 describe('repoData', () => {
   it('returns GitHub repo data', async () => {
+    vi.spyOn(GitHub.prototype, 'repoData').mockImplementation((): Promise<GitHubRepo> => {
+      return <Promise<GitHubRepo>>(repoFixture as unknown);
+    });
     const github = new GitHub();
     expect((await github.repoData()).name).toEqual('Hello-World');
   });
@@ -43,10 +53,33 @@ describe('context', () => {
   });
 });
 
+describe('releases', () => {
+  // prettier-ignore
+  test.each([
+    ['.github/buildx-lab-releases.json'],
+    ['.github/buildx-releases.json'],
+    ['.github/compose-lab-releases.json'],
+    ['.github/compose-releases.json'],
+    ['.github/docker-releases.json'],
+    ['.github/regclient-releases.json'],
+    ['.github/undock-releases.json'],
+  ])('returns %o', async (path: string) => {
+    const github = new GitHub();
+    const releases = await github.releases('App', {
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: path
+    });
+    expect(releases).toBeDefined();
+    expect(Object.keys(releases).length).toBeGreaterThan(0);
+  });
+});
+
 describe('serverURL', () => {
   const originalEnv = process.env;
   beforeEach(() => {
-    jest.resetModules();
+    vi.resetModules();
     process.env = {
       ...originalEnv,
       GITHUB_SERVER_URL: 'https://foo.github.com'
@@ -67,7 +100,7 @@ describe('serverURL', () => {
 describe('apiURL', () => {
   const originalEnv = process.env;
   beforeEach(() => {
-    jest.resetModules();
+    vi.resetModules();
     process.env = {
       ...originalEnv,
       GITHUB_API_URL: 'https://bar.github.com'
@@ -103,7 +136,7 @@ describe('workflowRunURL', () => {
 describe('actionsRuntimeToken', () => {
   const originalEnv = process.env;
   beforeEach(() => {
-    jest.resetModules();
+    vi.resetModules();
     process.env = {
       ...originalEnv
     };
@@ -118,14 +151,12 @@ describe('actionsRuntimeToken', () => {
   it('malformed', async () => {
     process.env.ACTIONS_RUNTIME_TOKEN = 'foo';
     expect(() => {
+      // eslint-disable-next-line @typescript-eslint/no-unused-expressions
       GitHub.actionsRuntimeToken;
     }).toThrow();
   });
   it('fixture', async () => {
-    process.env.ACTIONS_RUNTIME_TOKEN = fs
-      .readFileSync(path.join(__dirname, '.fixtures', 'runtimeToken.txt'))
-      .toString()
-      .trim();
+    process.env.ACTIONS_RUNTIME_TOKEN = fs.readFileSync(path.join(fixturesDir, 'runtimeToken.txt')).toString().trim();
     const runtimeToken = GitHub.actionsRuntimeToken;
     expect(runtimeToken?.ac).toEqual('[{"Scope":"refs/heads/master","Permission":3}]');
     expect(runtimeToken?.iss).toEqual('vstoken.actions.githubusercontent.com');
@@ -135,7 +166,7 @@ describe('actionsRuntimeToken', () => {
 describe('printActionsRuntimeTokenACs', () => {
   const originalEnv = process.env;
   beforeEach(() => {
-    jest.resetModules();
+    vi.resetModules();
     process.env = {
       ...originalEnv
     };
@@ -152,11 +183,8 @@ describe('printActionsRuntimeTokenACs', () => {
     await expect(GitHub.printActionsRuntimeTokenACs()).rejects.toThrow(new Error('Cannot parse GitHub Actions Runtime Token: Invalid token specified: missing part #2'));
   });
   it('refs/heads/master', async () => {
-    const infoSpy = jest.spyOn(core, 'info');
-    process.env.ACTIONS_RUNTIME_TOKEN = fs
-      .readFileSync(path.join(__dirname, '.fixtures', 'runtimeToken.txt'))
-      .toString()
-      .trim();
+    const infoSpy = vi.mocked(core.info);
+    process.env.ACTIONS_RUNTIME_TOKEN = fs.readFileSync(path.join(fixturesDir, 'runtimeToken.txt')).toString().trim();
     await GitHub.printActionsRuntimeTokenACs();
     expect(infoSpy).toHaveBeenCalledTimes(1);
     expect(infoSpy).toHaveBeenCalledWith(`refs/heads/master: read/write`);

__tests__/github/summary.test.itg.ts

@@ -14,36 +14,24 @@
  * limitations under the License.
  */
 
-import {describe, expect, it, test} from '@jest/globals';
+import {describe, expect, it, test} from 'vitest';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
 
-import {Buildx} from '../src/buildx/buildx';
-import {Bake} from '../src/buildx/bake';
-import {Build} from '../src/buildx/build';
-import {Exec} from '../src/exec';
-import {GitHub} from '../src/github';
-import {History} from '../src/buildx/history';
+import {Buildx} from '../../src/buildx/buildx.js';
+import {Bake} from '../../src/buildx/bake.js';
+import {Build} from '../../src/buildx/build.js';
+import {Exec} from '../../src/exec.js';
+import {GitHubArtifact} from '../../src/github/artifact.js';
+import {GitHubSummary} from '../../src/github/summary.js';
+import {History} from '../../src/buildx/history.js';
 
-const fixturesDir = path.join(__dirname, '.fixtures');
+const fixturesDir = path.join(__dirname, '..', '.fixtures');
 const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'github-itg-'));
 
 const maybe = !process.env.GITHUB_ACTIONS || (process.env.GITHUB_ACTIONS === 'true' && process.env.ImageOS && process.env.ImageOS.startsWith('ubuntu')) ? describe : describe.skip;
 
-maybe('uploadArtifact', () => {
-  it('uploads an artifact', async () => {
-    const res = await GitHub.uploadArtifact({
-      filename: path.join(fixturesDir, 'github-repo.json'),
-      mimeType: 'application/json',
-      retentionDays: 1
-    });
-    expect(res).toBeDefined();
-    console.log('uploadArtifactResponse', res);
-    expect(res?.url).toBeDefined();
-  });
-});
-
 maybe('writeBuildSummary', () => {
   // prettier-ignore
   test.each([
@@ -95,15 +83,14 @@ maybe('writeBuildSummary', () => {
     expect(exportRes?.dockerbuildSize).toBeDefined();
     expect(exportRes?.summaries).toBeDefined();
 
-    const uploadRes = await GitHub.uploadArtifact({
+    const uploadRes = await GitHubArtifact.upload({
       filename: exportRes?.dockerbuildFilename,
-      mimeType: 'application/gzip',
       retentionDays: 1
     });
     expect(uploadRes).toBeDefined();
     expect(uploadRes?.url).toBeDefined();
 
-    await GitHub.writeBuildSummary({
+    await GitHubSummary.writeBuildSummary({
       exportRes: exportRes,
       uploadRes: uploadRes,
       inputs: {
@@ -175,15 +162,14 @@ maybe('writeBuildSummary', () => {
     expect(exportRes?.dockerbuildSize).toBeDefined();
     expect(exportRes?.summaries).toBeDefined();
 
-    const uploadRes = await GitHub.uploadArtifact({
+    const uploadRes = await GitHubArtifact.upload({
       filename: exportRes?.dockerbuildFilename,
-      mimeType: 'application/gzip',
       retentionDays: 1
     });
     expect(uploadRes).toBeDefined();
     expect(uploadRes?.url).toBeDefined();
 
-    await GitHub.writeBuildSummary({
+    await GitHubSummary.writeBuildSummary({
       exportRes: exportRes,
       uploadRes: uploadRes,
       inputs: {
@@ -230,15 +216,14 @@ maybe('writeBuildSummary', () => {
     expect(exportRes?.dockerbuildSize).toBeDefined();
     expect(exportRes?.summaries).toBeDefined();
 
-    const uploadRes = await GitHub.uploadArtifact({
+    const uploadRes = await GitHubArtifact.upload({
       filename: exportRes?.dockerbuildFilename,
-      mimeType: 'application/gzip',
       retentionDays: 1
     });
     expect(uploadRes).toBeDefined();
     expect(uploadRes?.url).toBeDefined();
 
-    await GitHub.writeBuildSummary({
+    await GitHubSummary.writeBuildSummary({
       exportRes: exportRes,
       uploadRes: uploadRes,
       inputs: {
@@ -285,7 +270,7 @@ maybe('writeBuildSummary', () => {
     expect(exportRes?.dockerbuildSize).toBeDefined();
     expect(exportRes?.summaries).toBeDefined();
 
-    await GitHub.writeBuildSummary({
+    await GitHubSummary.writeBuildSummary({
       exportRes: exportRes,
       inputs: {
         context: fixturesDir,

__tests__/oci/oci.test.ts

@@ -14,13 +14,17 @@
  * limitations under the License.
  */
 
-import {afterEach, describe, expect, test} from '@jest/globals';
+import {afterEach, describe, expect, test} from 'vitest';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import * as rimraf from 'rimraf';
 
-import {OCI} from '../../src/oci/oci';
+import {mockArch, mockPlatform} from '../.helpers/os.js';
+
+import {OCI} from '../../src/oci/oci.js';
+
+import {Platform} from '../../src/types/oci/descriptor.js';
 
 const fixturesDir = path.join(__dirname, '..', '.fixtures');
 const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'oci-oci-'));
@@ -29,11 +33,30 @@ afterEach(function () {
   rimraf.sync(tmpDir);
 });
 
+describe('defaultPlatform', () => {
+  test.each([
+    ['win32', 'x64', {architecture: 'amd64', os: 'windows'}],
+    ['win32', 'arm64', {architecture: 'arm64', os: 'windows'}],
+    ['darwin', 'x64', {architecture: 'amd64', os: 'darwin'}],
+    ['darwin', 'arm64', {architecture: 'arm64', os: 'darwin'}],
+    ['linux', 'ia32', {architecture: '386', os: 'linux'}],
+    ['linux', 'x64', {architecture: 'amd64', os: 'linux'}],
+    ['linux', 'arm64', {architecture: 'arm64', os: 'linux'}],
+    ['linux', 'ppc64', {architecture: 'ppc64le', os: 'linux'}],
+    ['linux', 's390x', {architecture: 's390x', os: 'linux'}]
+  ])('default platform for %s/%s', async (os: string, arch: string, expected: Platform) => {
+    mockPlatform(os as NodeJS.Platform);
+    mockArch(arch);
+    const res = OCI.defaultPlatform();
+    expect(res).toEqual(expected);
+  });
+});
+
 describe('loadArchive', () => {
   // prettier-ignore
   test.each(fs.readdirSync(path.join(fixturesDir, 'oci-archive')).filter(file => {
       return fs.statSync(path.join(path.join(fixturesDir, 'oci-archive'), file)).isFile();
-    }).map(filename => [filename]))('extracting %p', async (filename) => {
+    }).map(filename => [filename]))('extracting %o', async (filename) => {
     const res = await OCI.loadArchive({
       file: path.join(fixturesDir, 'oci-archive', filename)
     });

__tests__/regclient/install.test.itg.ts

@@ -0,0 +1,38 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, test} from 'vitest';
+import * as fs from 'fs';
+
+import {Install} from '../../src/regclient/install.js';
+
+describe('download', () => {
+  // prettier-ignore
+  test.each(['latest'])(
+    'install regclient %s', async (version) => {
+      await expect((async () => {
+        const install = new Install();
+        const toolPath = await install.download(version);
+        if (!fs.existsSync(toolPath)) {
+          throw new Error('toolPath does not exist');
+        }
+        const binPath = await install.install(toolPath);
+        if (!fs.existsSync(binPath)) {
+          throw new Error('binPath does not exist');
+        }
+      })()).resolves.not.toThrow();
+    }, 60000);
+});

__tests__/regclient/install.test.ts

@@ -0,0 +1,131 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it, test, afterEach} from 'vitest';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import * as rimraf from 'rimraf';
+
+import {mockArch, mockPlatform} from '../.helpers/os.js';
+
+import {Install} from '../../src/regclient/install.js';
+
+const tmpDir = fs.mkdtempSync(path.join(process.env.TEMP || os.tmpdir(), 'regclient-install-'));
+
+afterEach(function () {
+  rimraf.sync(tmpDir);
+});
+
+describe('download', () => {
+  // prettier-ignore
+  test.each([
+    ['v0.8.2'],
+    ['latest']
+  ])(
+  'acquires %o of regclient', async (version) => {
+    const install = new Install();
+    const toolPath = await install.download(version);
+    expect(fs.existsSync(toolPath)).toBe(true);
+    const regclientBin = await install.install(toolPath, tmpDir);
+    expect(fs.existsSync(regclientBin)).toBe(true);
+  }, 100000);
+
+  // prettier-ignore
+  test.each([
+    // following versions are already cached to htc from previous test cases
+    ['v0.8.2'],
+  ])(
+  'acquires %o of regclient with cache', async (version) => {
+    const install = new Install();
+    const toolPath = await install.download(version);
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);
+
+  // prettier-ignore
+  test.each([
+    ['v0.8.1'],
+  ])(
+  'acquires %o of regclient without cache', async (version) => {
+    const install = new Install();
+    const toolPath = await install.download(version, true);
+    expect(fs.existsSync(toolPath)).toBe(true);
+  }, 100000);
+
+  // prettier-ignore
+  test.each([
+    ['win32', 'x64'],
+    ['darwin', 'x64'],
+    ['darwin', 'arm64'],
+    ['linux', 'x64'],
+    ['linux', 'arm64'],
+    ['linux', 'ppc64'],
+    ['linux', 's390x'],
+  ])(
+  'acquires regclient for %s/%s', async (os, arch) => {
+    mockPlatform(os as NodeJS.Platform);
+    mockArch(arch);
+    const install = new Install();
+    const regclientBin = await install.download('latest');
+    expect(fs.existsSync(regclientBin)).toBe(true);
+  }, 100000);
+});
+
+describe('getDownloadVersion', () => {
+  it('returns latest download version', async () => {
+    const version = await Install.getDownloadVersion('latest');
+    expect(version.version).toEqual('latest');
+    expect(version.downloadURL).toEqual('https://github.com/regclient/regclient/releases/download/v%s/%s');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/regclient-releases.json'
+    });
+  });
+  it('returns v0.8.1 download version', async () => {
+    const version = await Install.getDownloadVersion('v0.8.1');
+    expect(version.version).toEqual('v0.8.1');
+    expect(version.downloadURL).toEqual('https://github.com/regclient/regclient/releases/download/v%s/%s');
+    expect(version.contentOpts).toEqual({
+      owner: 'docker',
+      repo: 'actions-toolkit',
+      ref: 'main',
+      path: '.github/regclient-releases.json'
+    });
+  });
+});
+
+describe('getRelease', () => {
+  it('returns latest GitHub release', async () => {
+    const version = await Install.getDownloadVersion('latest');
+    const release = await Install.getRelease(version);
+    expect(release).not.toBeNull();
+    expect(release?.tag_name).not.toEqual('');
+  });
+  it('returns v0.8.1 GitHub release', async () => {
+    const version = await Install.getDownloadVersion('v0.8.1');
+    const release = await Install.getRelease(version);
+    expect(release).not.toBeNull();
+    expect(release?.id).toEqual(199719231);
+    expect(release?.tag_name).toEqual('v0.8.1');
+    expect(release?.html_url).toEqual('https://github.com/regclient/regclient/releases/tag/v0.8.1');
+  });
+  it('unknown release', async () => {
+    const version = await Install.getDownloadVersion('foo');
+    await expect(Install.getRelease(version)).rejects.toThrow(new Error('Cannot find regclient release foo in releases JSON'));
+  });
+});

__tests__/regclient/regctl.test.ts

@@ -0,0 +1,122 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {describe, expect, it, vi, test} from 'vitest';
+import * as semver from 'semver';
+
+import {Exec} from '../../src/exec.js';
+import {Regctl} from '../../src/regclient/regctl.js';
+
+import {Image} from '../../src/types/oci/config.js';
+
+describe('manifestGet', () => {
+  // prettier-ignore
+  test.each([
+    ['moby/moby-bin:28.1.0-rc.2'],
+    ['crazymax/diun:4.17.0'],
+  ])('given %o', async image => {
+    const regctl = new Regctl();
+    const manifest = await regctl.manifestGet({
+      image: image,
+    });
+    expect(manifest).not.toBeNull();
+    expect(manifest?.config).toBeDefined();
+    expect(manifest?.config.digest).not.toEqual('');
+    expect(manifest?.layers).toBeDefined();
+    expect(manifest?.layers.length).toBeGreaterThan(0);
+  }, 100000);
+});
+
+describe('blobGet', () => {
+  // prettier-ignore
+  test.each([
+    ['moby/moby-bin', 'sha256:234fccbd13fde0ba978a19f728cbdc67e29bc76247ac560822bb6ae5236c0bf0'],
+    ['crazymax/diun', 'sha256:1e4881f66e0ec0f1710b837002107050bbbc0a231d8a42d7f422b56a139900bb'],
+  ])('given %o', async (repo, digest) => {
+    const regctl = new Regctl();
+    const blob = await regctl.blobGet({
+      repository: repo,
+      digest: digest
+    });
+    expect(blob).toBeDefined();
+  }, 100000);
+});
+
+describe('image config', () => {
+  // prettier-ignore
+  test.each([
+    ['moby/moby-bin:28.1.0-rc.2'],
+    ['crazymax/diun:4.17.0'],
+  ])('given %o', async image => {
+    const regctl = new Regctl();
+    const manifest = await regctl.manifestGet({
+      image: image,
+    });
+    expect(manifest).not.toBeNull();
+    expect(manifest?.config).toBeDefined();
+    expect(manifest?.config.digest).not.toEqual('');
+    const blob = await regctl.blobGet({
+      repository: image, // image works as well
+      digest: manifest?.config.digest
+    });
+    const imageConfig = <Image>JSON.parse(blob);
+    expect(imageConfig).not.toBeNull();
+    expect(imageConfig.config).toBeDefined();
+    expect(imageConfig?.config?.Labels).toBeDefined();
+    expect(Object.keys(imageConfig?.config?.Labels || {}).length).toBeGreaterThan(0);
+  }, 100000);
+});
+
+describe('isAvailable', () => {
+  it('checks regctl is available', async () => {
+    const execSpy = vi.spyOn(Exec, 'getExecOutput');
+    const regctl = new Regctl();
+    await regctl.isAvailable();
+    expect(execSpy).toHaveBeenCalledWith(`regctl`, [], {
+      silent: true,
+      ignoreReturnCode: true
+    });
+  });
+});
+
+describe('printVersion', () => {
+  it('prints regctl version', async () => {
+    const execSpy = vi.spyOn(Exec, 'exec');
+    const regctl = new Regctl();
+    await regctl.printVersion();
+    expect(execSpy).toHaveBeenCalledWith(`regctl`, ['version'], {
+      failOnStdErr: false
+    });
+  });
+});
+
+describe('version', () => {
+  it('valid', async () => {
+    const regctl = new Regctl();
+    expect(semver.valid(await regctl.version())).not.toBeUndefined();
+  });
+});
+
+describe('versionSatisfies', () => {
+  test.each([
+    ['v0.8.2', '>=0.6.0', true],
+    ['v0.8.0', '>0.6.0', true],
+    ['v0.8.0', '<0.3.0', false]
+  ])('given %o', async (version, range, expected) => {
+    const regctl = new Regctl();
+    expect(await regctl.versionSatisfies(range, version)).toBe(expected);
+  });
+});