[Christof Marti (chrmarti)]

Summary

Minimal alternative to #1330 (build fixed Compose) and #1331 (probe then downgrade Buildx). This independent branch starts from main; both other PRs remain unchanged.

• Add an 18-line shared composite action and one setup-action invocation per affected workflow (21 added lines total).
• Read docker compose version --short and set BUILDX_BAKE_ENTITLEMENTS_FS=0 through GITHUB_ENV only for exact versions 2.38.2 (Linux matrix runner) and 5.6.0 (Docker 29 job), accepting an optional leading v.
• Leave every other version and its environment unchanged. A failed version command fails setup.
• Run the setup directly before the matrix tests / Docker 29 combined install-and-test step. It affects subsequent steps in those jobs only; registry-compatibility, Windows, Docker 20, and other jobs are unchanged.
• No probe builds, downloads, source builds, tool downgrades, GitHub API calls, or permission changes.

Related to #1320 and the upstream fix in docker/compose#14325.

Trade-off

The flag disables Bake filesystem read/write approval and default SSH-agent consent checks in the affected processes. The action emits a warning when setting it. It does not disable the other Bake consent checks (host networking, insecure execution, devices, or stale-output deletion) and retains current Buildx and its other fixes.

This is limited to our GitHub-hosted test jobs, which already run the checked-out code directly with Docker access. It is not intended as a general recommendation for developer machines or secret-bearing/self-hosted jobs.

An exact-version guard intentionally does not assume a first fixed release: later versions do not get the override, even if the upstream fix has not shipped yet. Remove the workaround once affected runners ship working Compose.

Validation

• npm run compile and npm run precommit passed.
• YAML and embedded Bash syntax checks passed.
• 12 local cases passed: both exact versions with/without v, nearby and future versions, prerelease/development versions, and version-command failure. Verified existing environment entries are preserved and the shared action immediately precedes test execution.
• All 51 PR checks passed, including Linux CI and Docker 29. Logs confirm the version guards matched Compose 2.38.2 and 5.6.0 respectively, set the flag for the test steps, and kept Compose unchanged; both cli.up suites passed 21 tests.