Option to only tag images at end of bake

[ciaranmcnulty]

Currently bake --push will tag images in the remote registry as they are completed. This can be an issue if later images in the same high-level build error out.

Either the default behaviour could change, or a CLI option could be added that forces tagging to only happen at the end - I don't think pushing new layers would need to be held back.

This example results in a foo tag but not the bar one:

FROM alpine:3.15 as foo
FROM alpine:3.15 as bar
RUN sleep 30 && exit 1

group "default" {
  targets = ["foo", "bar"]
}

target "foo" {
  target = "foo"
  tags = [
    "ciaranmcnulty/test:foo"
  ]
}

target "bar" {
  target = "bar"
  tags = [
    "ciaranmcnulty/test:bar"
  ]
}

[ciaranmcnulty]

This has come up today with bake-action, and I've ended up with this:

      -
        name: Build 
        uses: docker/bake-action@master

      -
        name: Build and push
        uses: docker/bake-action@master
        with:
          push: true

My issue is I RUN some tests at the end of the build and don't feel much need to do further testing before pushing, but if an individual image fails some may have already been pushed

[ciaranmcnulty]

An additional issue this can cause is where one target does a file output to a location that is the build context for a separate target.

If they're queueing it's currently possible for the files to be written out from the first target to FS, and then they are COPYed into the later target.

This is slightly unexpected, I think most users would expect the 'reads' to be based on the FS before the bake starts

[berney]

A workaround is to push with different names or even registry, do the testing, and then if testing passes, publish the images under the release names. So if some images don't build, then even though some got pushed, they are test images, and the CI won't move to publish them.