From 23705c3361100ffbc08059d257d47e6b9e517ea2 Mon Sep 17 00:00:00 2001
From: sprooty <sprooty@sprooty.com>
Date: Fri, 16 Oct 2026 01:49:53 +0000
Subject: [PATCH] build: allow the gitguard bake target to write its e2e export
 (fs.write entitlement)

docker buildx bake now refuses local writes without --allow, which broke
the build-once stack job on main (run 38834419683).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/build.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7441ca7bf..0152ddd5f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -708,6 +708,9 @@ jobs:
           args=(
             --file .github/stack-bake.hcl
             --metadata-file "$META_FILE"
+            # The gitguard target exports its e2e binary to E2E_DIR; newer
+            # buildx refuses a local write without an explicit entitlement.
+            --allow "fs.write=${E2E_DIR}"
             --set "*.args.POD_BASE_IMAGE=${POD_BASE_IMAGE}"
             --set "*.args.CORE_IMAGE=${CORE_IMAGE}"
             --set "*.args.VOGT_SOURCE_REF=${VOGT_SOURCE_REF}"