fix(buildx-bake): verify hydrated LFS source before builds

Use the local source path for Docker Bake builds and add conditional Git LFS
verification before image builds so LFS-backed files are not published as
pointer files.

Author: jobcespedes

.github/workflows/README.md

@@ -39,6 +39,8 @@ Pre and post command jobs use those same versions by default. Set `pre-docker-ve
 
 The Build workflow enables Git LFS downloads during checkout by default. Set `lfs: false` when the caller does not need Git LFS files.
 
+When `lfs` is enabled, the workflow prints the tracked LFS files and fails before image build if any checked-out file is still an unresolved LFS pointer. Image builds use the uploaded source artifact as a local path context, so the hydrated checkout is what gets baked into the image.
+
 ## Go Lint
 
 File: `golangci-lint.yml`

.github/workflows/build.yml

@@ -1227,6 +1227,40 @@ jobs:
         shell: bash
         run: ${{ inputs.prepare-command }}
 
+      - name: Verify Git LFS checkout
+        if: inputs.lfs
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          tracked_lfs_files="$(git lfs ls-files --name-only)"
+          if [ -z "$tracked_lfs_files" ]; then
+            echo "No Git LFS files tracked."
+            exit 0
+          fi
+
+          echo "Git LFS tracked files:"
+          printf '%s\n' "$tracked_lfs_files"
+
+          git_lfs_pointer_header="version https://git-lfs.github.com/spec/v1"
+          unresolved_pointers="$(
+            printf '%s\n' "$tracked_lfs_files" | while IFS= read -r path; do
+              [ -f "$path" ] || continue
+              if head -n 1 "$path" | grep -Fxq "$git_lfs_pointer_header"; then
+                printf '%s\n' "$path"
+              fi
+            done
+          )"
+
+          if [ -n "$unresolved_pointers" ]; then
+            echo "::error::Git LFS pointer files remain in source:"
+            printf '%s\n' "$unresolved_pointers"
+            exit 1
+          fi
+
+          echo "Git LFS checkout verification passed."
+          echo "Tracked files are hydrated before image build."
+
       - name: Upload updated source
         uses: eviden-actions/upload-artifact@v2
         with:

buildx-bake/README.md

@@ -6,9 +6,13 @@ Use this action when one workflow job should set up QEMU and Buildx, generate Do
 
 Set `docker-version` or `compose-version` to install a specific Docker CE or Docker Compose release before any Bake command runs. Leave them empty to use the runner defaults.
 
+The action runs `docker/bake-action` with `source: .`, so Bake uses the checked-out workspace instead of refetching the repository through Docker's default Git context. Repositories that need Git LFS files should hydrate them during checkout.
+
 ```yaml
 steps:
   - uses: actions/checkout@v6
+    with:
+      lfs: true
   - uses: getdevopspro/github-actions/buildx-bake@v8.3.7
     with:
       meta-tags: type=sha

buildx-bake/action.yml

@@ -114,6 +114,7 @@ runs:
       env:
         IMAGE_NAME: ${{ steps.lowercase_registry_image.outputs.registry-image }}
       with:
+        source: .
         files: |
           ./${{ inputs.bake-file }}
           ${{ steps.meta.outputs.bake-file }}

buildx-bake/build/README.md

@@ -6,9 +6,13 @@ Use this action inside a matrix job after `buildx-bake/prepare`. It downloads th
 
 Set `docker-version` or `compose-version` to install a specific Docker CE or Docker Compose release before disk cleanup and build setup. Leave them empty to use the runner defaults.
 
+The action runs `docker/bake-action` with `source: .`, so Bake uses the downloaded source artifact or checked-out workspace instead of refetching the repository through Docker's default Git context. Repositories that need Git LFS files should hydrate them before this action runs.
+
 ```yaml
 steps:
   - uses: actions/checkout@v6
+    with:
+      lfs: true
   - uses: getdevopspro/github-actions/buildx-bake/build@v8.3.7
     with:
       registry-password: ${{ secrets.GITHUB_TOKEN }}

buildx-bake/build/action.yml

@@ -124,6 +124,7 @@ runs:
         NO_TAG: true
         PLATFORM_PAIR: ${{ env.PLATFORM_PAIR }}
       with:
+        source: .
         files: |
           ./${{ inputs.bake-file }}
           cwd://${{ runner.temp }}/bake-meta.json