From 9ab7de65cea4745cdbe87904bca5bad2e18e8032 Mon Sep 17 00:00:00 2001
From: Denozordec <shatskiy.blog@gmail.com>
Date: Tue, 19 May 2026 10:53:51 +0700
Subject: [PATCH] chore: update CI configuration to disable filesystem
 entitlement for Docker builds

Added the BUILDX_BAKE_ENTITLEMENTS_FS environment variable set to "0" in the CI workflow to allow Docker builds to read the repository context. Updated the README to clarify this change and provide guidance on local usage for similar issues.
---
 .gitea/workflows/ci.yaml | 4 ++++
 deploy/docker/README.md  | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 99592ae..d4488ae 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -225,6 +225,8 @@ jobs:
           SHA_FULL: ${{ github.sha }}
           CACHE_REF_GO: git.shts.su/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:go-buildcache
           CACHE_REF_WEB: ""
+          # buildx bake: context ../.. (корень репо) — на доверенном CI отключаем fs entitlement gate
+          BUILDX_BAKE_ENTITLEMENTS_FS: "0"
         run: |
           set -euxo pipefail
           cd "${{ github.workspace }}/deploy/docker"
@@ -267,6 +269,7 @@ jobs:
           SHA_FULL: ${{ github.sha }}
           CACHE_REF_GO: ""
           CACHE_REF_WEB: git.shts.su/${{ steps.meta.outputs.owner_lc }}/evobgp-buildcache:web-buildcache
+          BUILDX_BAKE_ENTITLEMENTS_FS: "0"
         run: |
           set -euxo pipefail
           cd "${{ github.workspace }}/deploy/docker"
@@ -310,6 +313,7 @@ jobs:
           SHA_FULL: ${{ github.sha }}
           CACHE_REF_GO: ""
           CACHE_REF_WEB: ""
+          BUILDX_BAKE_ENTITLEMENTS_FS: "0"
         run: |
           set -euxo pipefail
           cd "${{ github.workspace }}/deploy/docker"
diff --git a/deploy/docker/README.md b/deploy/docker/README.md
index 93cec87..e70c57b 100644
--- a/deploy/docker/README.md
+++ b/deploy/docker/README.md
@@ -32,7 +32,7 @@ docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl go-images
 docker buildx bake -f docker-bake.hcl -f docker-bake.override.hcl web-images
 ```
 
-**CI:** на runner без `buildx bake --var` скрипт `write-bake-override.sh` генерирует `docker-bake.override.hcl` с нужными `variable` (файл не коммитится). Альтернатива на новом buildx: `--var REGISTRY=…` (см. `docker buildx bake --help`).
+**CI:** на runner без `buildx bake --var` скрипт `write-bake-override.sh` генерирует `docker-bake.override.hcl`. В workflow задано `BUILDX_BAKE_ENTITLEMENTS_FS=0`, чтобы bake мог читать `context = "../.."` (корень репозитория). Локально при той же ошибке: `docker buildx bake --allow=fs.read=* …` или `export BUILDX_BAKE_ENTITLEMENTS_FS=0`.
 
 Один образ (legacy):