Option to only tag images at end of bake

[ciaranmcnulty]

Currently bake --push will tag images in the remote registry as they are completed. This can be an issue if later images in the same high-level build error out.

Either the default behaviour could change, or a CLI option could be added that forces tagging to only happen at the end - I don't think pushing new layers would need to be held back.

This example results in a foo tag but not the bar one:

FROM alpine:3.15 as foo
FROM alpine:3.15 as bar
RUN sleep 30 && exit 1

group "default" {
  targets = ["foo", "bar"]
}

target "foo" {
  target = "foo"
  tags = [
    "ciaranmcnulty/test:foo"
  ]
}

target "bar" {
  target = "bar"
  tags = [
    "ciaranmcnulty/test:bar"
  ]
}

[ciaranmcnulty]

This has come up today with bake-action, and I've ended up with this:

      -
        name: Build 
        uses: docker/bake-action@master

      -
        name: Build and push
        uses: docker/bake-action@master
        with:
          push: true

My issue is I RUN some tests at the end of the build and don't feel much need to do further testing before pushing, but if an individual image fails some may have already been pushed

[ciaranmcnulty]

An additional issue this can cause is where one target does a file output to a location that is the build context for a separate target.

If they're queueing it's currently possible for the files to be written out from the first target to FS, and then they are COPYed into the later target.

This is slightly unexpected, I think most users would expect the 'reads' to be based on the FS before the bake starts

[berney]

A workaround is to push with different names or even registry, do the testing, and then if testing passes, publish the images under the release names. So if some images don't build, then even though some got pushed, they are test images, and the CI won't move to publish them.

[booleanbetrayal]

We just ran into this with QEMU failures breaking portions of our multi-arch images, but pushing untagged images for the successful ones. This resulted in multiple re-runs during debugging, which triggered lifecycle rules in our ECR repositories causing deletion of historical / valid images. It basically took down our CI pipeline in the process.

An option to defer pushes until all stages are complete would be ideal / sensible.