Adding a label containing an octothorpe (#) incorrectly results in the label being stripped

[tomdoel]

Contributing guidelines

• I've read the contributing guidelines and wholeheartedly agree

I've found a bug, and:

• The documentation does not mention anything about my problem
• There are no open or closed issues that are related to my problem

Description

Specifying a label mylabel=foo#bar results in the label mylabel=foo. It appears that the octothorpe (#) is incorrectly interpreted as the start of a comment and the rest of the label is removed.

Expected behaviour

The Docker labels output of the action should include mylabel=foo#bar

Actual behaviour

The Docker labels output of the action includes mylabel=foo

Repository URL

No response

Workflow run URL

No response

YAML workflow

-
        name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          labels: |
            mylabel=foo#bar

Workflow logs

No response

BuildKit logs

No response

Additional info

The behaviour was correct in v3.6.2 and seems to have broken around v3.7.0.

[crazy-max]

Yes this relates to #172 to enable comments for these inputs:

metadata-action/src/context.ts

Lines 24 to 28 in 60a0d34

	images: Util.getInputList('images', {ignoreComma: true, comment: '#'}),
	tags: Util.getInputList('tags', {ignoreComma: true, comment: '#'}),
	flavor: Util.getInputList('flavor', {ignoreComma: true, comment: '#'}),
	labels: Util.getInputList('labels', {ignoreComma: true, comment: '#'}),
	annotations: Util.getInputList('annotations', {ignoreComma: true, comment: '#'}),

Disabling comments would be a breaking change though so you can either escape this char or we could introduce an env var to make disable comments.

[tomdoel]

Thanks for the update.

So as I understand it, the underlying issue was that YAML does not allow comments in multi-line scalar inputs:

-
labels: |
  # This is not a valid YAML comment; it is part of the labels input
  mylabel=foo#bar

So in order to allow for comments in the labels input, metadata-action calls getInputList, which uses csv-parse to remove the comments. But this also removes parts of the labels containing #.

I don't think it's possible to escape #, but I can force quotes around the label. csv-parse will remove the quotes and accept the whole label instead of interpreting the comment. So for example, this works:

- name: Docker meta
  id: meta
  uses: docker/metadata-action@v5
  with:
    images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
    labels: "
      \"mylabel=foo#bar\""

However this feels a little fragile as it relies on the implementation detail that csv-parse is being used to process the inputs.

So instead I am using the following workaround where I append the custom label to the push action instead of the meta action:

- name: Docker meta
  id: meta
  uses: docker/metadata-action@v5
  with:
    images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

- name: Build and push Docker image
  id: push
  uses: docker/build-push-action@v6
  with:
    context: .
    push: true
    tags: ${{ steps.meta.outputs.tags }}
    labels: |
      ${{ steps.meta.outputs.labels }}
      mylabel=foo#bar