[Christof Marti (chrmarti)]

Purpose

Draft comparison alternative to #1330, not an additional change to merge alongside it. This branch starts from main; #1330 remains unchanged.

Both approaches address the Compose external-Dockerfile permission failure tracked in #1320. #1330 builds a patched Compose from source while keeping current Buildx. This alternative keeps Compose unchanged and downloads Buildx 0.37.1 only when the same probe reproduces the bug.

Changes

• Add a shared composite action and one setup-action invocation in each affected workflow. No extra jobs, permissions, branch triggers, GitHub API checks, or Go/source builds.
• Build a tiny scratch image with a Dockerfile outside the context. If the probe passes, preserve both installed tools.
• Only for the exact --allow=fs.read error naming the probe Dockerfile, download the official Linux x64 Buildx 0.37.1 binary and verify its pinned SHA-256 before installation.
• Verify the active Buildx version and rerun the probe after downgrading. Unexpected probe failures, download/checksum errors, and verification failures stop setup explicitly.
• Clean up the temporary fixture, downloaded binary, and any successfully created probe image.

Security trade-off

Buildx 0.37.1 predates the security fixes in 0.37.2. In particular, it skips entitlement consent under Bake's raw-JSON progress mode used by Compose. The conditional probe limits when the downgrade is applied; it does not make the older version safe for untrusted builds. The action emits a warning whenever it downgrades.

• GHSA-gwr2-q96m-6682
• GHSA-p54p-jq4x-rc28

This avoids per-job compilation but trades away security fixes, unlike #1330. No BUILDX_BAKE_ENTITLEMENTS_FS=0 override is set.

Validation

• npm run compile and npm run precommit passed.
• Workflow/action YAML and embedded Bash syntax checks passed.
• 14 local scenarios passed, covering successful no-op, matching/unrelated errors, architecture guard, download failure, real checksum validation, wrong active version, post-downgrade probe failure, and cleanup.
• All 51 PR checks passed, including Linux CI and Docker 29 (21 tests). Runtime logs confirm the matching probe failure, verified binary checksum, Buildx 0.37.1 installation, unchanged Compose 5.6.0, successful second probe, and image cleanup.

Removal

When the runner's installed Compose can build the external Dockerfile, the probe skips the downgrade automatically. Remove the workaround once affected runners ship a fixed Compose.

[Copilot]

🔵 Needs a closer look

The conditional downgrade removes known Buildx security fixes and requires explicit human acceptance of that trade-off.

No open issues 🎉

What changed in this PR

Adds a CI-only alternative to #1330 for the Compose external-Dockerfile failure in #1320, leaving Compose unchanged.

Changes:

• Probe installed tools and conditionally install checksum-verified Buildx 0.37.1.
• Verify the workaround, clean up probe resources, and invoke setup in both affected workflows.

File	Description
.github/​workflows/​test-docker-v29.yml	Runs shared setup before Docker 29 tests.
.github/​workflows/​dev-containers.yml	Runs shared setup after Docker configuration.
.github/​actions/​setup-compose/​action.yml	Adds probing, conditional downgrade, verification, and cleanup.

_{Review effort: Balanced}