From 91ab1aaac0f205b5a1dc4d374a147f7bc0ae34dc Mon Sep 17 00:00:00 2001
From: estebanthi <esteban.thilliez@gmail.com>
Date: Mon, 5 Jan 2026 12:56:52 +0100
Subject: [PATCH] Fix ssh usage for bake builds

---
 .github/workflows/docker-build-publish.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docker-build-publish.yml b/.github/workflows/docker-build-publish.yml
index 7f4eafe..196c87c 100644
--- a/.github/workflows/docker-build-publish.yml
+++ b/.github/workflows/docker-build-publish.yml
@@ -107,6 +107,10 @@ jobs:
           if [ -n "${SSH_AUTH_SOCK:-}" ]; then
             SSH_FLAGS+=(--ssh default)
           fi
+          SSH_BAKE_JSON="null"
+          if [ -n "${SSH_AUTH_SOCK:-}" ]; then
+            SSH_BAKE_JSON='["default"]'
+          fi
 
           RAW_REF="${{ github.ref }}"
           SHA_FULL="${{ github.sha }}"
@@ -187,6 +191,7 @@ jobs:
                   --arg target "$TARGET" \
                   --argjson tags "$TAGS_JSON" \
                   --argjson args "$BUILD_ARGS_JSON" \
+                  --argjson ssh "$SSH_BAKE_JSON" \
                   --arg cache_ref "$CACHE_REF" \
                   '{
                     context: $context,
@@ -194,6 +199,7 @@ jobs:
                     tags: $tags,
                     args: $args
                   }
+                  + (if ($ssh != null) then {ssh: $ssh} else {} end)
                   + (if ($target != "" and $target != "null") then {target: $target} else {} end)
                   + (if ($cache_ref != "") then {"cache-from": ["type=registry,ref=" + $cache_ref], "cache-to": ["type=registry,ref=" + $cache_ref + ",mode=max"]} else {} end)')
 
@@ -205,7 +211,7 @@ jobs:
               BAKE_FILE=$(mktemp)
               echo "$BAKE_JSON" > "$BAKE_FILE"
 
-              docker buildx bake --file "$BAKE_FILE" --push "${SSH_FLAGS[@]}"
+              docker buildx bake --file "$BAKE_FILE" --push
               rm -f "$BAKE_FILE"
 
               while read -r img; do