From 511041a32a184acc5fd4221a822c7f8077e3162a Mon Sep 17 00:00:00 2001
From: Guillaume Lours <glours@users.noreply.github.com>
Date: Fri, 10 Apr 2026 15:18:20 +0200
Subject: [PATCH] build and push Docker Desktop module image on release

Add workflow to build and push docker/compose-desktop-module image
  to Docker Hub on version tag push, used by Docker Desktop's update
  system to deliver the Compose CLI plugin.

Signed-off-by: Guillaume Lours <glours@users.noreply.github.com>
---
 .github/workflows/merge.yml         | 27 +++++++++++++++++++++++++++
 Dockerfile                          | 13 +++++++++++++
 desktop-module/module-metadata.json |  9 +++++++++
 docker-bake.hcl                     | 14 ++++++++++++++
 4 files changed, 63 insertions(+)
 create mode 100644 desktop-module/module-metadata.json

diff --git a/.github/workflows/merge.yml b/.github/workflows/merge.yml
index cecd840cf80..21853972221 100644
--- a/.github/workflows/merge.yml
+++ b/.github/workflows/merge.yml
@@ -110,6 +110,33 @@ jobs:
           username: ${{ secrets.DOCKERPUBLICBOT_USERNAME }}
           password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
 
+  module-image:
+    uses: docker/github-builder/.github/workflows/bake.yml@70313223e2665c3211b454b3fea6534624e78d64 # v1.4.0
+    permissions:
+      contents: read # same as global permission
+      id-token: write # for signing attestation(s) with GitHub OIDC Token
+    with:
+      runner: amd64
+      target: image-module-cross
+      cache: true
+      cache-scope: module-image
+      output: image
+      push: ${{ startsWith(github.ref, 'refs/tags/v') }}
+      sbom: true
+      provenance: true
+      set-meta-labels: true
+      meta-images: |
+        docker/compose-desktop-module
+      meta-tags: |
+        type=ref,event=branch
+        type=ref,event=tag
+      meta-bake-target: meta-helper
+    secrets:
+      registry-auths: |
+        - registry: docker.io
+          username: ${{ secrets.DOCKERPUBLICBOT_USERNAME }}
+          password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
+
   desktop-edge-test:
     runs-on: ubuntu-latest
     needs: bin-image
diff --git a/Dockerfile b/Dockerfile
index 0e004e4bf9b..cb2e393f2ae 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -195,3 +195,16 @@ RUN --mount=from=binary \
 
 FROM scratch AS release
 COPY --from=releaser /out/ /
+
+FROM --platform=$BUILDPLATFORM alpine AS module-releaser
+WORKDIR /work
+ARG TARGETOS
+RUN --mount=from=binary \
+    mkdir -p /cli-plugins/compose/$TARGETOS && \
+    cp docker-compose* "/cli-plugins/compose/$TARGETOS/docker-compose$(ls docker-compose* | sed -e 's/^docker-compose//')"
+
+FROM scratch AS module
+ARG TARGETOS
+COPY --from=module-releaser /cli-plugins/compose/$TARGETOS /cli-plugins/compose/$TARGETOS
+COPY ./desktop-module/module-metadata.json /
+COPY LICENSE /
diff --git a/desktop-module/module-metadata.json b/desktop-module/module-metadata.json
new file mode 100644
index 00000000000..721f7789008
--- /dev/null
+++ b/desktop-module/module-metadata.json
@@ -0,0 +1,9 @@
+{
+  "version": 1,
+  "content": [
+    {
+      "type": "cli-plugin",
+      "name": "compose"
+    }
+  ]
+}
diff --git a/docker-bake.hcl b/docker-bake.hcl
index 5c6522d3a81..72dcc84ed71 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -146,3 +146,17 @@ target "image-cross" {
   inherits = ["meta-helper", "binary-cross"]
   output = ["type=image"]
 }
+
+target "image-module-cross" {
+  inherits = ["meta-helper", "binary-cross"]
+  target = "module"
+  output = ["type=image"]
+  platforms = [
+    "darwin/amd64",
+    "darwin/arm64",
+    "linux/amd64",
+    "linux/arm64",
+    "windows/amd64",
+    "windows/arm64",
+  ]
+}