From 768429ea0334ca3b263b9740a13efcb72871f097 Mon Sep 17 00:00:00 2001
From: Christof Marti <chrmarti@microsoft.com>
Date: Tue, 20 Oct 2026 22:26:33 +0200
Subject: [PATCH] Scope Bake entitlement workaround to affected Compose
 versions

Set BUILDX_BAKE_ENTITLEMENTS_FS=0 for Compose 2.38.2 and 5.6.0 in the affected CI jobs. Leave other versions and installed tools unchanged. This minimal alternative to #1330 and #1331 avoids probes or downloads and explicitly warns about disabled filesystem and SSH-agent consent checks.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/actions/setup-compose/action.yml | 18 ++++++++++++++++++
 .github/workflows/dev-containers.yml     |  1 +
 .github/workflows/test-docker-v29.yml    |  2 ++
 3 files changed, 21 insertions(+)
 create mode 100644 .github/actions/setup-compose/action.yml

diff --git a/.github/actions/setup-compose/action.yml b/.github/actions/setup-compose/action.yml
new file mode 100644
index 000000000..2b43a06fc
--- /dev/null
+++ b/.github/actions/setup-compose/action.yml
@@ -0,0 +1,18 @@
+name: Set up Compose build workaround
+description: Disable Bake filesystem entitlement checks for the affected runner Compose versions.
+
+runs:
+  using: composite
+  steps:
+  - name: Check Compose version
+    shell: bash
+    run: |
+      version=$(docker compose version --short)
+      echo "Compose version: $version"
+      # Temporary workaround for https://github.com/devcontainers/cli/issues/1320.
+      case "${version#v}" in
+        2.38.2|5.6.0)
+          echo "::warning::Disabling Bake filesystem and default SSH-agent consent checks for Compose $version."
+          echo "BUILDX_BAKE_ENTITLEMENTS_FS=0" >> "$GITHUB_ENV"
+          ;;
+      esac
diff --git a/.github/workflows/dev-containers.yml b/.github/workflows/dev-containers.yml
index 81ffb8226..e4507ec73 100644
--- a/.github/workflows/dev-containers.yml
+++ b/.github/workflows/dev-containers.yml
@@ -104,6 +104,7 @@ jobs:
       run: yarn type-check
     - name: Package
       run: yarn package
+    - uses: ./.github/actions/setup-compose
     - name: Run Tests
       run: yarn test-matrix --forbid-only ${{ matrix.mocha-args }}
       env:
diff --git a/.github/workflows/test-docker-v29.yml b/.github/workflows/test-docker-v29.yml
index de475f246..2b4ea9623 100644
--- a/.github/workflows/test-docker-v29.yml
+++ b/.github/workflows/test-docker-v29.yml
@@ -29,6 +29,8 @@ jobs:
         sudo VERSION=29.0.0 sh get-docker.sh
         sudo systemctl restart docker
     
+    - uses: ./.github/actions/setup-compose
+
     - name: Verify Docker version, Install and Test
       run: |
         # Verify