chore(deps): Bump codecov/codecov-action from 7.0.0 to 7.1.0

Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 7.0.0 to 7.1.0. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codecov/codecov-action/compare/fb8b3582c8e4def4969c97caa2f19720cb33a72f...0b35c9ecc4f0529d0eb674914510c22f85b196b4) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Merge pull request #729 from crazy-max/git-working-directory
2026-09-17 19:15:13 +02:00 · 2026-09-16 19:24:51 +00:00 · 2026-09-15 13:39:47 +02:00 · 2026-09-15 12:30:34 +02:00 · 2026-09-15 12:24:19 +02:00 · 2026-09-15 12:24:18 +02:00
27 changed files with 7789 additions and 867 deletions
@@ -4,6 +4,15 @@ updates:
    directory: "/"
    schedule:
      interval: "daily"
+    cooldown:
+      default-days: 2
+    groups:
+      crazy-max-dot-github:
+        patterns:
+          - "crazy-max/.github/*"
+      codeql-actions:
+        patterns:
+          - "github/codeql-action/*"
    labels:
      - "dependencies"
      - "bot"
@@ -11,6 +20,10 @@ updates:
    directory: "/"
    schedule:
      interval: "daily"
+    cooldown:
+      default-days: 2
+      exclude:
+        - "@docker/actions-toolkit"
    versioning-strategy: "increase"
    allow:
      - dependency-type: "production"
@@ -1,5 +1,8 @@
 name: ci

+permissions:
+  contents: read
+
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
@@ -31,7 +34,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Docker meta
        uses: ./
@@ -43,10 +46,10 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          version: ${{ env.BUILDX_VERSION }}
          driver: docker
@@ -80,10 +83,10 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          version: ${{ env.BUILDX_VERSION }}
          driver: docker
@@ -116,10 +119,10 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          version: ${{ env.BUILDX_VERSION }}
          driver: docker
@@ -150,10 +153,10 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          version: ${{ env.BUILDX_VERSION }}
          driver: docker
@@ -181,10 +184,10 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          version: ${{ env.BUILDX_VERSION }}
          driver: docker
@@ -204,10 +207,10 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          version: ${{ env.BUILDX_VERSION }}
          driver: docker
@@ -225,10 +228,10 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          version: ${{ env.BUILDX_VERSION }}
          driver: docker
@@ -255,10 +258,10 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          version: ${{ env.BUILDX_VERSION }}
          driver: docker
@@ -285,10 +288,10 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          version: ${{ env.BUILDX_VERSION }}
          driver: docker
@@ -314,16 +317,16 @@ jobs:
    runs-on: ubuntu-latest
    services:
      registry:
-        image: registry:2
+        image: registry:2.8.3@sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373
        ports:
          - 5000:5000
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          version: ${{ env.BUILDX_VERSION }}
          driver-opts: network=host
@@ -345,7 +348,7 @@ jobs:
            type=sha
      -
        name: Build and push to local registry
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: ./test
          file: ./test/Dockerfile
@@ -368,10 +371,10 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          version: ${{ env.BUILDX_VERSION }}
      -
@@ -393,7 +396,7 @@ jobs:
            type=sha
      -
        name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
        with:
          files: |
            ./test/docker-bake.hcl
@@ -413,10 +416,10 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          version: ${{ env.BUILDX_VERSION }}
          driver: docker
@@ -431,7 +434,7 @@ jobs:
          sep-tags: ${{ matrix.sep }}
      -
        name: Tags
-        uses: actions/github-script@v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            console.log(`${{ steps.meta.outputs.tags }}`);
@@ -441,10 +444,10 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          version: ${{ env.BUILDX_VERSION }}
          driver: docker
@@ -462,7 +465,7 @@ jobs:
            maintainer=Foo
      -
        name: Build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: ./test
          file: ./test/output.Dockerfile
@@ -480,7 +483,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Docker meta
        id: meta
@@ -504,10 +507,10 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          version: ${{ env.BUILDX_VERSION }}
      -
@@ -531,7 +534,7 @@ jobs:
          DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
      -
        name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
        with:
          files: |
            ./test/docker-bake.hcl
@@ -545,10 +548,10 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          version: ${{ env.BUILDX_VERSION }}
          driver: docker
@@ -571,10 +574,10 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          version: latest
      -
@@ -583,7 +586,7 @@ jobs:
        uses: ./
      -
        name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
        with:
          source: .
          files: |
@@ -604,10 +607,10 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          version: ${{ env.BUILDX_VERSION }}
          driver: docker
@@ -628,7 +631,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Dump context
-        uses: crazy-max/ghaction-dump-context@v2
+        uses: crazy-max/ghaction-dump-context@4d9eeaf15dd59aa4346919ea84a84ccf514b4db8 # v3.1.0
@@ -0,0 +1,46 @@
+name: codeql
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'releases/v*'
+  pull_request:
+
+env:
+  NODE_VERSION: "24"
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      -
+        name: Enable corepack
+        run: |
+          corepack enable
+          yarn --version
+      -
+        name: Set up Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+      -
+        name: Initialize CodeQL
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        with:
+          languages: javascript-typescript
+          build-mode: none
+      -
+        name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        with:
+          category: "/language:javascript-typescript"
@@ -4,14 +4,14 @@ permissions:
  contents: read

 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] safe to use without checkout
    types:
      - opened
      - reopened

 jobs:
  run:
-    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@1b673f36fad86812f538c1df9794904038a23cbf
+    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@f91220cba053bd54299ba645a599ee8ed436f222 # v1.11.0
    permissions:
      contents: read
      pull-requests: write
@@ -1,5 +1,12 @@
 name: publish

+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
  release:
    types:
@@ -15,7 +22,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Publish
-        uses: actions/publish-immutable-action@v0.0.4
+        uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4
@@ -1,5 +1,8 @@
 name: test

+permissions:
+  contents: read
+
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
@@ -17,16 +20,16 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Test
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
        with:
          source: .
          targets: test
      -
        name: Upload coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4 # v7.1.0
        with:
          files: ./coverage/clover.xml
          token: ${{ secrets.CODECOV_TOKEN }}
@@ -1,5 +1,12 @@
 name: update-dist

+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
  pull_request:
    types:
@@ -8,27 +15,29 @@ on:

 jobs:
  update-dist:
-    if: github.actor == 'dependabot[bot]'
+    if: github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name
    runs-on: ubuntu-latest
    steps:
      -
        name: GitHub auth token from GitHub App
        id: docker-read-app
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.GHACTIONS_REPO_WRITE_APP_ID }}
          private-key: ${{ secrets.GHACTIONS_REPO_WRITE_APP_PRIVATE_KEY }}
          owner: docker
+          repositories: metadata-action
+          permission-contents: write
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          fetch-depth: 0
-          token: ${{ steps.docker-read-app.outputs.token || github.token }}
+          token: ${{ steps.docker-read-app.outputs.token }}
      -
        name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
        with:
          source: .
          targets: build
@@ -41,7 +50,7 @@ jobs:
              git config user.name "github-actions[bot]"
              git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
              git add dist
-              git commit -m "chore: update generated content"
+              git commit -m "[dependabot skip] chore: update generated content"
              git push
            )
          else
@@ -1,5 +1,8 @@
 name: validate

+permissions:
+  contents: read
+
 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
@@ -15,15 +18,15 @@ jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
-      targets: ${{ steps.generate.outputs.targets }}
+      matrix: ${{ steps.generate.outputs.matrix }}
    steps:
      -
        name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
-        name: List targets
+        name: Generate matrix
        id: generate
-        uses: docker/bake-action/subaction/list-targets@v6
+        uses: docker/bake-action/subaction/matrix@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
        with:
          target: validate

@@ -34,10 +37,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        target: ${{ fromJson(needs.prepare.outputs.targets) }}
+        include: ${{ fromJson(needs.prepare.outputs.matrix) }}
    steps:
      -
        name: Validate
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
        with:
          targets: ${{ matrix.target }}
@@ -0,0 +1,29 @@
+name: zizmor
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - 'master'
+      - 'releases/v*'
+    tags:
+      - 'v*'
+  pull_request:
+
+jobs:
+  zizmor:
+    uses: crazy-max/.github/.github/workflows/zizmor.yml@f91220cba053bd54299ba645a599ee8ed436f222 # v1.11.0
+    permissions:
+      contents: read
+      security-events: write
+    with:
+      min-severity: medium
+      min-confidence: medium
+      persona: pedantic
@@ -1,10 +1,10 @@
 # https://yarnpkg.com/configuration/yarnrc

-compressionLevel: mixed
-enableGlobalCache: false
-enableHardenedMode: true
+nodeLinker: node-modules

 logFilters:
+  - code: YN0004
+    level: discard
  - code: YN0013
    level: discard
  - code: YN0019
@@ -14,4 +14,11 @@ logFilters:
  - code: YN0086
    level: discard

-nodeLinker: node-modules
+npmPreapprovedPackages:
+  - "@docker/actions-toolkit"
+
+compressionLevel: mixed
+enableGlobalCache: false
+enableHardenedMode: true
+enableScripts: false
+npmMinimalAgeGate: 2d
@@ -75,27 +75,23 @@ jobs:
  docker:
    runs-on: ubuntu-latest
    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v6
      -
        name: Docker meta
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: name/app
      -
        name: Login to DockerHub
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      -
        name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
-          context: .
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
@@ -129,13 +125,10 @@ jobs:
  docker:
    runs-on: ubuntu-latest
    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v6
      -
        name: Docker meta
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            name/app
@@ -147,15 +140,14 @@ jobs:
      -
        name: Login to DockerHub
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      -
        name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
-          context: .
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
@@ -210,7 +202,7 @@ jobs:
      -
        name: Docker meta
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            name/app
@@ -222,7 +214,7 @@ jobs:
            type=sha
      -
        name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
        with:
          files: |
            ./docker-bake.hcl
@@ -269,7 +261,7 @@ similar to the previous one:
 ```yaml
      -
        name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
        with:
          files: |
            ./docker-bake.hcl
@@ -293,18 +285,18 @@ The following inputs can be used as `step.with` keys:
 >   org.opencontainers.image.vendor=MyCompany
 > ```

-| Name              | Type   | Description                                                                  |
-|-------------------|--------|------------------------------------------------------------------------------|
-| `context`         | String | Where to get context data. Allowed options are: `workflow` (default), `git`. |
-| `images`          | List   | List of Docker images to use as base name for tags                           |
-| `tags`            | List   | List of [tags](#tags-input) as key-value pair attributes                     |
-| `flavor`          | List   | [Flavor](#flavor-input) to apply                                             |
-| `labels`          | List   | List of custom labels                                                        |
-| `annotations`     | List   | List of custom annotations                                                   |
-| `sep-tags`        | String | Separator to use for tags output (default `\n`)                              |
-| `sep-labels`      | String | Separator to use for labels output (default `\n`)                            |
-| `sep-annotations` | String | Separator to use for annotations output (default `\n`)                       |
-| `bake-target`     | String | Bake target name (default `docker-metadata-action`)                          |
+| Name              | Type   | Description                                                                                |
+|-------------------|--------|--------------------------------------------------------------------------------------------|
+| `context`         | String | Where to get context data. Allowed options are: `workflow` (default), `git`, `git:<path>`. |
+| `images`          | List   | List of Docker images to use as base name for tags                                         |
+| `tags`            | List   | List of [tags](#tags-input) as key-value pair attributes                                   |
+| `flavor`          | List   | [Flavor](#flavor-input) to apply                                                           |
+| `labels`          | List   | List of custom labels                                                                      |
+| `annotations`     | List   | List of custom annotations                                                                 |
+| `sep-tags`        | String | Separator to use for tags output (default `\n`)                                            |
+| `sep-labels`      | String | Separator to use for labels output (default `\n`)                                          |
+| `sep-annotations` | String | Separator to use for annotations output (default `\n`)                                     |
+| `bake-target`     | String | Bake target name (default `docker-metadata-action`)                                        |

 ### outputs

@@ -336,7 +328,7 @@ Alternatively, each output is also exported as an environment variable when `DOC
 So it can be used with our [Docker Build Push action](https://github.com/docker/build-push-action/):

 ```yaml
- uses: docker/build-push-action@v6
+- uses: docker/build-push-action@v7
  with:
    build-args: |
      DOCKER_METADATA_OUTPUT_JSON
@@ -365,6 +357,24 @@ context: git
 * `workflow`: Get context metadata from the workflow (GitHub context). See https://docs.github.com/en/actions/learn-github-actions/contexts#github-context
 * `git`: Get context metadata from the workflow and overrides some of them with current Git context, such as `ref` and `sha`.

+Use `context: git:<path>` when the repository is checked out to a custom path.
+The path can be absolute or relative to the current working directory
+(normally `$GITHUB_WORKSPACE`):
+
+```yaml
+- uses: actions/checkout@v7
+  with:
+    path: source
+- uses: docker/metadata-action@v6
+  with:
+    context: git:source
+    images: name/app
+    tags: type=sha
+```
+
+The selected checkout supplies the Git ref, SHA, and commit date. Other repository
+metadata still comes from the workflow repository.
+
 ## `images` input

 `images` defines a list of Docker images to use as base name for [`tags`](#tags-input):
@@ -728,7 +738,7 @@ increase this length for larger repositories by setting the
      -
        name: Docker meta
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            name/app
@@ -939,13 +949,13 @@ that you can reuse them further in your workflow using the [`fromJSON` function]
 ```yaml
      -
        name: Docker meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        id: meta
        with:
          images: name/app
      -
        name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
@@ -965,7 +975,7 @@ this:
      -
        name: Docker meta
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: name/app
          labels: |
@@ -987,12 +997,12 @@ of the `metadata-action`:
 ```yaml
      -
        name: Docker meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: name/app
      -
        name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          tags: ${{ steps.meta.outputs.tags }}
          annotations: ${{ steps.meta.outputs.annotations }}
@@ -1003,12 +1013,12 @@ The same can be done with the [`bake-action`](https://github.com/docker/bake-act
 ```yaml
      -
        name: Docker meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: name/app
      -
        name: Build
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@v7
        with:
          files: |
            ./docker-bake.hcl
@@ -1032,14 +1042,14 @@ Please consult the documentation of your registry.
 ```yaml
      -
        name: Docker meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: name/app
        env:
          DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
      -
        name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          tags: ${{ steps.meta.outputs.tags }}
          annotations: ${{ steps.meta.outputs.annotations }}
@@ -1,8 +1,14 @@
-import {beforeEach, describe, expect, test, it, vi} from 'vitest';
+import {afterEach, beforeEach, describe, expect, test, it, vi} from 'vitest';
+import {execFileSync} from 'child_process';
+import fs from 'fs';
+import path from 'path';
+
 import {Git} from '@docker/actions-toolkit/lib/git.js';
 import {Toolkit} from '@docker/actions-toolkit/lib/toolkit.js';

 import * as context from '../src/context.js';
+import {Meta} from '../src/meta.js';
+import repoFixture from './fixtures/repo.json' with {type: 'json'};

 const toolkit = new Toolkit({githubToken: 'fake-github-token'});

@@ -16,6 +22,11 @@ describe('getInputs', () => {
    }, {});
  });

+  it('reads a Git context with a path', () => {
+    setInput('context', 'git:nested checkout');
+    expect(context.getInputs().context).toEqual('git:nested checkout');
+  });
+
  // prettier-ignore
  const cases: [number, Map<string, string>, context.Inputs][] = [
    [
@@ -151,13 +162,26 @@ describe('getInputs', () => {
 });

 describe('getContext', () => {
-  it('workflow', async () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('workflow does not read Git context', async () => {
+    const gitContext = vi.spyOn(Git, 'context');
+    const gitCommitDate = vi.spyOn(Git, 'commitDate');
    const ctx = await context.getContext(context.ContextSource.workflow, toolkit);
    expect(ctx.ref).toEqual('refs/heads/dev');
    expect(ctx.sha).toEqual('5f3331d7f7044c18ca9f12c77d961c4d7cf3276a');
    expect(ctx.commitDate).toEqual(new Date('2024-11-13T13:42:28.000Z'));
+    expect(gitContext).not.toHaveBeenCalled();
+    expect(gitCommitDate).not.toHaveBeenCalled();
  });
-  it('git', async () => {
+  it.each<[string, string | undefined]>([
+    ['git', undefined],
+    ['git:', ''],
+    ['git:source', 'source'],
+    ['git:C:\\nested checkout', 'C:\\nested checkout']
+  ])('reads %s', async (source, workdir) => {
    vi.spyOn(Git, 'context').mockImplementation((): Promise<context.Context> => {
      return Promise.resolve({
        ref: 'refs/heads/git-test',
@@ -167,11 +191,51 @@ describe('getContext', () => {
    vi.spyOn(Git, 'commitDate').mockImplementation(async (): Promise<Date> => {
      return new Date('2023-01-01T13:42:28.000Z');
    });
-    const ctx = await context.getContext(context.ContextSource.git, toolkit);
+    const ctx = await context.getContext(source, toolkit);
+    expect(Git.context).toHaveBeenCalledWith(workdir);
+    expect(Git.commitDate).toHaveBeenCalledWith('git-test-sha', workdir);
    expect(ctx.ref).toEqual('refs/heads/git-test');
    expect(ctx.sha).toEqual('git-test-sha');
    expect(ctx.commitDate).toEqual(new Date('2023-01-01T13:42:28.000Z'));
  });
+
+  it.each(['workflow:source', 'gitfoo:source', 'invalid'])('rejects invalid context %s', async source => {
+    await expect(context.getContext(source, toolkit)).rejects.toThrow(`Invalid context source: ${source}`);
+  });
+
+  it.each(['relative', 'absolute'])('reads a selected checkout using a %s path', async pathType => {
+    const checkoutDir = fs.mkdtempSync(path.join(process.cwd(), 'git context-'));
+    const workdir = pathType === 'relative' ? path.relative(process.cwd(), checkoutDir) : checkoutDir;
+    const commitDate = '2024-01-02T03:04:05Z';
+    const git = (args: string[]) =>
+      execFileSync('git', args, {
+        cwd: checkoutDir,
+        encoding: 'utf8',
+        stdio: 'pipe',
+        env: {...process.env, GIT_AUTHOR_DATE: commitDate, GIT_COMMITTER_DATE: commitDate}
+      }).trim();
+
+    try {
+      git(['init', '--initial-branch=selected-checkout']);
+      git(['-c', 'user.name=Test', '-c', 'user.email=test@example.com', '-c', 'commit.gpgsign=false', 'commit', '--allow-empty', '-m', 'initial']);
+      const sha = git(['rev-parse', 'HEAD']);
+      const ctx = await context.getContext(`git:${workdir}`, toolkit);
+      expect(ctx.ref).toEqual('refs/heads/selected-checkout');
+      expect(ctx.sha).toEqual(sha);
+      expect(ctx.commitDate).toEqual(new Date(commitDate));
+
+      git(['checkout', '--detach', 'HEAD']);
+      git(['branch', '-D', 'selected-checkout']);
+      const detachedContext = await context.getContext(`git:${workdir}`, toolkit);
+      expect(detachedContext.ref).toEqual('');
+      expect(detachedContext.sha).toEqual(sha);
+      expect(detachedContext.commitDate).toEqual(new Date(commitDate));
+      const meta = new Meta({...context.getInputs(), images: ['name/app'], tags: ['type=sha,format=long'], flavor: []}, detachedContext, repoFixture);
+      expect(meta.getTags()).toEqual([`name/app:sha-${sha}`]);
+    } finally {
+      fs.rmSync(checkoutDir, {recursive: true, force: true});
+    }
+  });
 });

 // See: https://github.com/actions/toolkit/blob/master/packages/core/src/core.ts#L67
@@ -72,11 +72,14 @@
  "homepage": "https://github.com",
  "language": null,
  "forks_count": 9,
+  "forks": 9,
  "stargazers_count": 80,
  "watchers_count": 80,
+  "watchers": 80,
  "size": 108,
  "default_branch": "master",
  "open_issues_count": 0,
+  "open_issues": 0,
  "is_template": true,
  "topics": [
    "octocat",
@@ -85,6 +88,7 @@
    "api"
  ],
  "has_issues": true,
+  "has_discussions": false,
  "has_projects": true,
  "has_wiki": true,
  "has_pages": false,
@@ -211,11 +215,15 @@
    "homepage": "https://github.com",
    "language": null,
    "forks_count": 9,
+    "forks": 9,
+    "license": null,
    "stargazers_count": 80,
    "watchers_count": 80,
+    "watchers": 80,
    "size": 108,
    "default_branch": "master",
    "open_issues_count": 0,
+    "open_issues": 0,
    "is_template": true,
    "topics": [
      "octocat",
@@ -322,11 +330,15 @@
    "homepage": "https://github.com",
    "language": null,
    "forks_count": 9,
+    "forks": 9,
+    "license": null,
    "stargazers_count": 80,
    "watchers_count": 80,
+    "watchers": 80,
    "size": 108,
    "default_branch": "master",
    "open_issues_count": 0,
+    "open_issues": 0,
    "is_template": true,
    "topics": [
      "octocat",
@@ -8,7 +8,7 @@ branding:

 inputs:
  context:
-    description: 'Where to get context data. Allowed options are "workflow"  (default), "git".'
+    description: 'Where to get context data. Allowed options are "workflow" (default), "git", "git:<path>".'
    default: "workflow"
    required: true
  images:
@@ -67,4 +67,4 @@ outputs:

 runs:
  using: 'node24'
-  main: 'dist/index.js'
+  main: 'dist/index.cjs'
@@ -17,7 +17,7 @@ FROM base AS deps
 RUN --mount=type=bind,target=.,rw \
  --mount=type=cache,target=/src/.yarn/cache \
  --mount=type=cache,target=/src/node_modules \
-  yarn install && mkdir /vendor && cp yarn.lock /vendor
+  yarn install --immutable && mkdir /vendor && cp yarn.lock /vendor

 FROM scratch AS vendor-update
 COPY --from=deps /vendor /
@@ -1,299 +0,0 @@
-export const id = 606;
-export const ids = [606];
-export const modules = {
-
-/***/ 606:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   "default": () => (/* binding */ pMap)
-/* harmony export */ });
-/* unused harmony exports pMapIterable, pMapSkip */
-async function pMap(
-	iterable,
-	mapper,
-	{
-		concurrency = Number.POSITIVE_INFINITY,
-		stopOnError = true,
-		signal,
-	} = {},
-) {
-	return new Promise((resolve_, reject_) => {
-		if (iterable[Symbol.iterator] === undefined && iterable[Symbol.asyncIterator] === undefined) {
-			throw new TypeError(`Expected \`input\` to be either an \`Iterable\` or \`AsyncIterable\`, got (${typeof iterable})`);
-		}
-
-		if (typeof mapper !== 'function') {
-			throw new TypeError('Mapper function is required');
-		}
-
-		if (!((Number.isSafeInteger(concurrency) && concurrency >= 1) || concurrency === Number.POSITIVE_INFINITY)) {
-			throw new TypeError(`Expected \`concurrency\` to be an integer from 1 and up or \`Infinity\`, got \`${concurrency}\` (${typeof concurrency})`);
-		}
-
-		const result = [];
-		const errors = [];
-		const skippedIndexesMap = new Map();
-		let isRejected = false;
-		let isResolved = false;
-		let isIterableDone = false;
-		let resolvingCount = 0;
-		let currentIndex = 0;
-		const iterator = iterable[Symbol.iterator] === undefined ? iterable[Symbol.asyncIterator]() : iterable[Symbol.iterator]();
-
-		const signalListener = () => {
-			reject(signal.reason);
-		};
-
-		const cleanup = () => {
-			signal?.removeEventListener('abort', signalListener);
-		};
-
-		const resolve = value => {
-			resolve_(value);
-			cleanup();
-		};
-
-		const reject = reason => {
-			isRejected = true;
-			isResolved = true;
-			reject_(reason);
-			cleanup();
-		};
-
-		if (signal) {
-			if (signal.aborted) {
-				reject(signal.reason);
-			}
-
-			signal.addEventListener('abort', signalListener, {once: true});
-		}
-
-		const next = async () => {
-			if (isResolved) {
-				return;
-			}
-
-			const nextItem = await iterator.next();
-
-			const index = currentIndex;
-			currentIndex++;
-
-			// Note: `iterator.next()` can be called many times in parallel.
-			// This can cause multiple calls to this `next()` function to
-			// receive a `nextItem` with `done === true`.
-			// The shutdown logic that rejects/resolves must be protected
-			// so it runs only one time as the `skippedIndex` logic is
-			// non-idempotent.
-			if (nextItem.done) {
-				isIterableDone = true;
-
-				if (resolvingCount === 0 && !isResolved) {
-					if (!stopOnError && errors.length > 0) {
-						reject(new AggregateError(errors)); // eslint-disable-line unicorn/error-message
-						return;
-					}
-
-					isResolved = true;
-
-					if (skippedIndexesMap.size === 0) {
-						resolve(result);
-						return;
-					}
-
-					const pureResult = [];
-
-					// Support multiple `pMapSkip`'s.
-					for (const [index, value] of result.entries()) {
-						if (skippedIndexesMap.get(index) === pMapSkip) {
-							continue;
-						}
-
-						pureResult.push(value);
-					}
-
-					resolve(pureResult);
-				}
-
-				return;
-			}
-
-			resolvingCount++;
-
-			// Intentionally detached
-			(async () => {
-				try {
-					const element = await nextItem.value;
-
-					if (isResolved) {
-						return;
-					}
-
-					const value = await mapper(element, index);
-
-					// Use Map to stage the index of the element.
-					if (value === pMapSkip) {
-						skippedIndexesMap.set(index, value);
-					}
-
-					result[index] = value;
-
-					resolvingCount--;
-					await next();
-				} catch (error) {
-					if (stopOnError) {
-						reject(error);
-					} else {
-						errors.push(error);
-						resolvingCount--;
-
-						// In that case we can't really continue regardless of `stopOnError` state
-						// since an iterable is likely to continue throwing after it throws once.
-						// If we continue calling `next()` indefinitely we will likely end up
-						// in an infinite loop of failed iteration.
-						try {
-							await next();
-						} catch (error) {
-							reject(error);
-						}
-					}
-				}
-			})();
-		};
-
-		// Create the concurrent runners in a detached (non-awaited)
-		// promise. We need this so we can await the `next()` calls
-		// to stop creating runners before hitting the concurrency limit
-		// if the iterable has already been marked as done.
-		// NOTE: We *must* do this for async iterators otherwise we'll spin up
-		// infinite `next()` calls by default and never start the event loop.
-		(async () => {
-			for (let index = 0; index < concurrency; index++) {
-				try {
-					// eslint-disable-next-line no-await-in-loop
-					await next();
-				} catch (error) {
-					reject(error);
-					break;
-				}
-
-				if (isIterableDone || isRejected) {
-					break;
-				}
-			}
-		})();
-	});
-}
-
-function pMapIterable(
-	iterable,
-	mapper,
-	{
-		concurrency = Number.POSITIVE_INFINITY,
-		backpressure = concurrency,
-	} = {},
-) {
-	if (iterable[Symbol.iterator] === undefined && iterable[Symbol.asyncIterator] === undefined) {
-		throw new TypeError(`Expected \`input\` to be either an \`Iterable\` or \`AsyncIterable\`, got (${typeof iterable})`);
-	}
-
-	if (typeof mapper !== 'function') {
-		throw new TypeError('Mapper function is required');
-	}
-
-	if (!((Number.isSafeInteger(concurrency) && concurrency >= 1) || concurrency === Number.POSITIVE_INFINITY)) {
-		throw new TypeError(`Expected \`concurrency\` to be an integer from 1 and up or \`Infinity\`, got \`${concurrency}\` (${typeof concurrency})`);
-	}
-
-	if (!((Number.isSafeInteger(backpressure) && backpressure >= concurrency) || backpressure === Number.POSITIVE_INFINITY)) {
-		throw new TypeError(`Expected \`backpressure\` to be an integer from \`concurrency\` (${concurrency}) and up or \`Infinity\`, got \`${backpressure}\` (${typeof backpressure})`);
-	}
-
-	return {
-		async * [Symbol.asyncIterator]() {
-			const iterator = iterable[Symbol.asyncIterator] === undefined ? iterable[Symbol.iterator]() : iterable[Symbol.asyncIterator]();
-
-			const promises = [];
-			let runningMappersCount = 0;
-			let isDone = false;
-			let index = 0;
-
-			function trySpawn() {
-				if (isDone || !(runningMappersCount < concurrency && promises.length < backpressure)) {
-					return;
-				}
-
-				const promise = (async () => {
-					const {done, value} = await iterator.next();
-
-					if (done) {
-						return {done: true};
-					}
-
-					runningMappersCount++;
-
-					// Spawn if still below concurrency and backpressure limit
-					trySpawn();
-
-					try {
-						const returnValue = await mapper(await value, index++);
-
-						runningMappersCount--;
-
-						if (returnValue === pMapSkip) {
-							const index = promises.indexOf(promise);
-
-							if (index > 0) {
-								promises.splice(index, 1);
-							}
-						}
-
-						// Spawn if still below backpressure limit and just dropped below concurrency limit
-						trySpawn();
-
-						return {done: false, value: returnValue};
-					} catch (error) {
-						isDone = true;
-						return {error};
-					}
-				})();
-
-				promises.push(promise);
-			}
-
-			trySpawn();
-
-			while (promises.length > 0) {
-				const {error, done, value} = await promises[0]; // eslint-disable-line no-await-in-loop
-
-				promises.shift();
-
-				if (error) {
-					throw error;
-				}
-
-				if (done) {
-					return;
-				}
-
-				// Spawn if just dropped below backpressure limit and below the concurrency limit
-				trySpawn();
-
-				if (value === pMapSkip) {
-					continue;
-				}
-
-				yield value;
-			}
-		},
-	};
-}
-
-const pMapSkip = Symbol('skip');
-
-
-/***/ })
-
-};
-
-//# sourceMappingURL=606.index.js.map
@@ -1,3 +0,0 @@
-{
-  "type": "module"
-}
@@ -4,10 +4,11 @@
  "type": "module",
  "main": "src/main.ts",
  "scripts": {
-    "build": "ncc build --source-map --minify --license licenses.txt",
+    "build": "esbuild src/main.ts --bundle --platform=node --target=node24 --format=cjs --outfile=dist/index.cjs --sourcemap --minify --keep-names && yarn run license",
    "lint": "eslint --max-warnings=0 .",
    "format": "eslint --fix .",
-    "test": "vitest run"
+    "test": "vitest run",
+    "license": "generate-license-file --input package.json --output dist/licenses.txt --overwrite --ci --no-spinner --eol lf"
  },
  "repository": {
    "type": "git",
@@ -22,17 +23,17 @@
  ],
  "author": "Docker Inc.",
  "license": "Apache-2.0",
-  "packageManager": "yarn@4.9.2",
+  "packageManager": "yarn@4.15.0",
  "dependencies": {
-    "@actions/core": "^3.0.0",
-    "@actions/github": "^9.0.0",
-    "@docker/actions-toolkit": "^0.79.0",
+    "@actions/core": "^3.0.1",
+    "@actions/github": "^9.1.1",
+    "@docker/actions-toolkit": "^0.100.0",
    "@renovate/pep440": "^1.0.0",
-    "csv-parse": "^6.1.0",
-    "handlebars": "^4.7.8",
+    "csv-parse": "^7.0.2",
+    "handlebars": "^4.7.9",
    "moment": "^2.30.1",
-    "moment-timezone": "^0.6.0",
-    "semver": "^7.7.4"
+    "moment-timezone": "^0.6.3",
+    "semver": "^7.8.5"
  },
  "devDependencies": {
    "@eslint/js": "^9.39.3",
@@ -40,13 +41,14 @@
    "@types/semver": "^7.7.1",
    "@typescript-eslint/eslint-plugin": "^8.56.1",
    "@typescript-eslint/parser": "^8.56.1",
-    "@vercel/ncc": "^0.38.4",
    "@vitest/coverage-v8": "^4.0.18",
    "@vitest/eslint-plugin": "^1.6.9",
    "dotenv": "^17.3.1",
+    "esbuild": "^0.28.0",
    "eslint": "^9.39.3",
    "eslint-config-prettier": "^10.1.8",
    "eslint-plugin-prettier": "^5.5.5",
+    "generate-license-file": "^4.1.1",
    "globals": "^17.3.0",
    "prettier": "^3.8.1",
    "typescript": "^5.9.3",
@@ -12,7 +12,7 @@ export interface Context extends GithubContext {
 }

 export interface Inputs {
-  context: ContextSource;
+  context: string;
  images: string[];
  tags: string[];
  flavor: string[];
@@ -27,7 +27,7 @@ export interface Inputs {

 export function getInputs(): Inputs {
  return {
-    context: (core.getInput('context') || ContextSource.workflow) as ContextSource,
+    context: core.getInput('context') || ContextSource.workflow,
    images: Util.getInputList('images', {ignoreComma: true, comment: '#', commentNoInfix: true}),
    tags: Util.getInputList('tags', {ignoreComma: true, comment: '#', commentNoInfix: true}),
    flavor: Util.getInputList('flavor', {ignoreComma: true, comment: '#', commentNoInfix: true}),
@@ -46,7 +46,10 @@ export enum ContextSource {
  git = 'git'
 }

-export async function getContext(source: ContextSource, toolkit: Toolkit): Promise<Context> {
+export async function getContext(source: string, toolkit: Toolkit): Promise<Context> {
+  if (source.startsWith(`${ContextSource.git}:`)) {
+    return await getContextFromGit(source.slice(ContextSource.git.length + 1));
+  }
  switch (source) {
    case ContextSource.workflow:
      return await getContextFromWorkflow(toolkit);
@@ -82,11 +85,11 @@ async function getContextFromWorkflow(toolkit: Toolkit): Promise<Context> {
  } as Context;
 }

-async function getContextFromGit(): Promise<Context> {
-  const ctx = await Git.context();
+async function getContextFromGit(workdir?: string): Promise<Context> {
+  const ctx = await Git.context(workdir);

  return {
-    commitDate: await Git.commitDate(ctx.sha),
+    commitDate: await Git.commitDate(ctx.sha, workdir),
    ...ctx
  } as Context;
 }