Description

The docker buildx bake CLI supports the --var flag to set variable values (added in docker/buildx#3610), but bake-action does not expose this functionality.

Use Case

We wanted to prevent environment variables (like github_*) from appearing in provenance attestations, so we tried using BUILDX_BAKE_DISABLE_VARS_ENV_LOOKUP=1. However, this flag only prevents the bake definition file from reading environment variables - it doesn't prevent buildx from capturing them in provenance attestations.

Even though it doesn't solve the provenance issue, the feature request remains valid: when BUILDX_BAKE_DISABLE_VARS_ENV_LOOKUP=1 is set, there's no way to explicitly pass variable values to the bake file through the action.

The Problem

Setting BUILDX_BAKE_DISABLE_VARS_ENV_LOOKUP=1 isolates the bake definition from environment variables (as intended), but bake-action provides no alternative mechanism to pass variable values. Users are forced to either:

• Not use the isolation flag (bake file reads all environment variables)
• Set variables via env: block (which the flag explicitly blocks)

Proposed Solution

Add a vars input to bake-action:

- name: Build and push
  uses: docker/bake-action@v6
  env:
    BUILDX_BAKE_DISABLE_VARS_ENV_LOOKUP: "1"
  with:
    source: .
    vars: |
      environment=testing
      buildVersion=${{ env.VERSION }}
      tag=${{ env.IMAGE_TAG }}

This would map to --var key=value CLI arguments, completing the isolation feature by allowing explicit variable passing.

Related

• Buildx PR adding --var: bake: add --var flag for setting variable values buildx#3610
• Buildx PR adding BUILDX_BAKE_DISABLE_VARS_ENV_LOOKUP: bake: allow disabling env lookup for bake buildx#3595