{
  "slug": "buildx-bake-overrides-declared-secret-sources-47196575d315",
  "title": "buildx bake overrides declared secret sources",
  "tools": [
    "buildx"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-07-29T20:27:12.000Z",
  "announced_at": "2026-07-29T20:27:12.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When a Bake target already declares a secret, override that secret’s source for this invocation with `--set target.secret.<id>=...`, using an existing secret source attribute such as `env=` or `src=`. The secret ID must already be declared by the target.",
    "examples": [
      "docker buildx bake --set <target>.secret.<id>=env=<ENV_VAR>",
      "docker buildx bake --set <target>.secret.<id>=src=<FILE_PATH>"
    ],
    "gotchas": [
      "Version: v0.36.0",
      "--set (required): Override a target configuration using `targetpattern.key[.subkey]=value`; repeatable.",
      "<target> (required): Bake target whose declared secret source is being overridden; target patterns are supported.",
      "secret.<id> (required): Selects the source override for a secret already declared by the target. The secret ID must already exist; any inline `id=` must match. The `secrets.<id>` plural alias is invalid for this form.",
      "env=<ENV_VAR> (required): Names the environment variable used as the secret source.",
      "src=<FILE_PATH> (required): Names the file used as the secret source.",
      "Prerequisite: Buildx must be installed to use `docker buildx bake`.",
      "Prerequisite: The secret must already be declared by the target.",
      "The secret must already be declared by the target.",
      "The override fails if the secret ID is not already declared or if an inline `id=` does not match."
    ]
  },
  "why_it_matters": "Build a Bake target that already declares a secret, supplying its source for this invocation.",
  "sources": [
    "https://github.com/docker/buildx/releases/tag/v0.36.0",
    "https://github.com/docker/buildx/pull/3962",
    "https://docs.docker.com/build/bake/reference/",
    "https://docs.docker.com/reference/cli/docker/buildx/bake/",
    "https://docs.docker.com/build/bake/introduction/"
  ],
  "rank": 0.96035,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1-20261014",
    "verdict_id": "wave1-20261014:wave1-20261014-56383580c1b4ca00-1:gate",
    "evidence_hash": "f64755f629b0eb8538fd4a868ef6e21f39e7e5c40f2661e4e032ef450178790e"
  },
  "review": {
    "draft_hash": "59bf43f3ead60816b1ad6b6c7515033cee371685e8b65dbb590c07a97742019c",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1-20261014:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.96 >= 0.9; 2 needed) and Jev gave 0.76 (>= 0.6 needed)."
  }
}