Merge branch 'main' into billy/fix/claude-code-org-id

Author: billyb2

pkg/buildx/build/build.go

@@ -1252,7 +1252,12 @@ func BuildWithResultHandler(ctx context.Context, nodes []builder.Node, opt map[s
 								}
 							}
 
-							dt, desc, err := itpull.Combine(ctx, srcs, nil)
+							indexAnnotations, err := extractIndexAnnotations(opt.Exports)
+							if err != nil {
+								return err
+							}
+
+							dt, desc, err := itpull.Combine(ctx, srcs, indexAnnotations)
 							if err != nil {
 								return err
 							}
@@ -1332,6 +1337,23 @@ func BuildWithResultHandler(ctx context.Context, nodes []builder.Node, opt map[s
 	return resp, nil
 }
 
+// extractIndexAnnotations extracts annotations for the OCI index from export attributes
+func extractIndexAnnotations(exports []client.ExportEntry) ([]string, error) {
+	var annotations []string
+	for _, exp := range exports {
+		for k, v := range exp.Attrs {
+			if key, ok := strings.CutPrefix(k, "annotation-index."); ok {
+				annotations = append(annotations, fmt.Sprintf("index:%s=%s", key, v))
+			} else if key, ok := strings.CutPrefix(k, "annotation-manifest-descriptor."); ok {
+				annotations = append(annotations, fmt.Sprintf("manifest-descriptor:%s=%s", key, v))
+			} else if key, ok := strings.CutPrefix(k, "annotation."); ok && !strings.Contains(k, "-") {
+				annotations = append(annotations, fmt.Sprintf("%s=%s", key, v))
+			}
+		}
+	}
+	return annotations, nil
+}
+
 func pushWithMoby(ctx context.Context, d driver.Driver, name string, l progress.SubLogger) error {
 	api := d.Config().DockerAPI
 	if api == nil {

pkg/buildx/commands/bake.go

@@ -139,6 +139,7 @@ func RunBake(dockerCli command.Cli, in BakeOptions, validator BakeValidator, pri
 			AdditionalTags:        in.additionalTags,
 			AdditionalCredentials: in.additionalCredentials,
 			AddTargetSuffix:       true,
+			RequestedTargets:      requestedTargets,
 		}
 		buildOpts = registry.WithDepotSave(buildOpts, opts)
 	}
@@ -178,9 +179,12 @@ func RunBake(dockerCli command.Cli, in BakeOptions, validator BakeValidator, pri
 					metadata[k] = v
 				}
 			}
-			dt[buildRes.Name] = metadata
+			// Only include targets that have metadata (i.e., were exported)
+			if len(metadata) > 0 {
+				dt[buildRes.Name] = metadata
+			}
 		}
-		err = writeMetadataFile(in.metadataFile, in.project, in.buildID, requestedTargets, dt)
+		err = writeMetadataFile(in.metadataFile, in.project, in.buildID, requestedTargets, dt, true)
 		if err != nil {
 			return err
 		}
@@ -476,20 +480,26 @@ func (t *LocalBakeValidator) Validate(ctx context.Context, _ []builder.Node, _ p
 			"BAKE_LOCAL_PLATFORM": platforms.DefaultString(),
 		}
 
-		targets, groups, err := bake.ReadTargets(ctx, files, t.bakeTargets.Targets, overrides, defaults)
+		targets, _, err := bake.ReadTargets(ctx, files, t.bakeTargets.Targets, overrides, defaults)
+		if err != nil {
+			t.err = err
+			return
+		}
+
+		// Parse config to properly resolve groups
+		c, err := bake.ParseFiles(files, defaults)
 		if err != nil {
 			t.err = err
 			return
 		}
 
 		resolvedTargets := map[string]struct{}{}
 		for _, target := range t.bakeTargets.Targets {
-			if _, ok := targets[target]; ok {
-				resolvedTargets[target] = struct{}{}
-			}
-			if _, ok := groups[target]; ok {
-				for _, t := range groups[target].Targets {
-					resolvedTargets[t] = struct{}{}
+			// Use ResolveGroup to recursively resolve groups to their targets
+			ts, _ := c.ResolveGroup(target)
+			for _, tname := range ts {
+				if _, ok := targets[tname]; ok {
+					resolvedTargets[tname] = struct{}{}
 				}
 			}
 		}
@@ -539,20 +549,25 @@ func (t *RemoteBakeValidator) Validate(ctx context.Context, nodes []builder.Node
 		"BAKE_LOCAL_PLATFORM": platforms.DefaultString(),
 	}
 
-	targets, groups, err := bake.ReadTargets(ctx, files, t.bakeTargets.Targets, overrides, defaults)
+	targets, _, err := bake.ReadTargets(ctx, files, t.bakeTargets.Targets, overrides, defaults)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// Parse config to properly resolve groups
+	c, err := bake.ParseFiles(files, defaults)
 	if err != nil {
 		return nil, nil, err
 	}
 
 	requestedTargets := []string{}
 	uniqueTargets := map[string]struct{}{}
 	for _, target := range t.bakeTargets.Targets {
-		if _, ok := targets[target]; ok {
-			uniqueTargets[target] = struct{}{}
-		}
-		if _, ok := groups[target]; ok {
-			for _, t := range groups[target].Targets {
-				uniqueTargets[t] = struct{}{}
+		// Use ResolveGroup to recursively resolve groups to their targets
+		ts, _ := c.ResolveGroup(target)
+		for _, tname := range ts {
+			if _, ok := targets[tname]; ok {
+				uniqueTargets[tname] = struct{}{}
 			}
 		}
 	}

pkg/buildx/commands/build.go

@@ -306,7 +306,7 @@ func buildTargets(ctx context.Context, dockerCli command.Cli, nodes []builder.No
 				}
 			}
 
-			if err := writeMetadataFile(metadataFile, depotOpts.project, depotOpts.buildID, nil, metadata); err != nil {
+			if err := writeMetadataFile(metadataFile, depotOpts.project, depotOpts.buildID, nil, metadata, false); err != nil {
 				return nil, nil, err
 			}
 		}
@@ -1001,15 +1001,23 @@ func parsePrintFunc(str string) (*build.PrintFunc, error) {
 	return f, nil
 }
 
-func writeMetadataFile(filename, projectID, buildID string, targets []string, metadata map[string]interface{}) error {
+func writeMetadataFile(filename, projectID, buildID string, requestedTargets []string, metadata map[string]interface{}, isBake bool) error {
 	depotBuild := struct {
 		BuildID   string   `json:"buildID"`
 		ProjectID string   `json:"projectID"`
 		Targets   []string `json:"targets,omitempty"`
 	}{
 		BuildID:   buildID,
 		ProjectID: projectID,
-		Targets:   targets,
+	}
+
+	if isBake {
+		// If requestedTargets was provided, use that; otherwise use all metadata keys
+		if len(requestedTargets) > 0 {
+			depotBuild.Targets = requestedTargets
+		} else {
+			depotBuild.Targets = maps.Keys(metadata)
+		}
 	}
 
 	metadata["depot.build"] = depotBuild

pkg/registry/cli.go

@@ -15,6 +15,9 @@ type SaveOptions struct {
 	// AddTargetSuffix adds the target suffix to the additional tags.
 	// Useful for bake targets.
 	AddTargetSuffix bool
+	// RequestedTargets are the targets explicitly requested by the user (not dependencies).
+	// If set, only these targets will be saved/pushed.
+	RequestedTargets []string
 }
 
 // WithDepotSave adds an output type image with a push to the depot registry.
@@ -25,6 +28,10 @@ func WithDepotSave(buildOpts map[string]buildx.Options, opts SaveOptions) map[st
 	}
 
 	for target, buildOpt := range buildOpts {
+		// If RequestedTargets is set and this target is not in the list, skip it
+		if len(opts.RequestedTargets) > 0 && !slices.Contains(opts.RequestedTargets, target) {
+			continue
+		}
 		buildOpt.Session = ReplaceDockerAuth(opts.AdditionalCredentials, buildOpt.Session)
 
 		hadPush := false