From 25bce825a57f7c3da21c3983dc28b54ee31d0fff Mon Sep 17 00:00:00 2001
From: Raghu Betina <raghu@firstdraft.com>
Date: Sun, 11 Oct 2026 18:39:24 -0500
Subject: [PATCH] Pin Buildx 0.37.1 for the Board's Compose build

Runner image ubuntu24/20261004.327 ships Buildx 0.37.2, whose bake
now refuses ungranted entitlements under --progress=rawjson instead
of skipping the consent check (GHSA-gwr2-q96m-6682). Compose grants
fs.read only for build contexts, and the Dev Containers CLI 0.89.0
writes its generated Dockerfile outside the context, so every
candidate's Dev Container build stopped with "additional privileges
requested" before any check ran (devcontainers/cli#1320). No CLI
release fixes it yet.

The check action now installs Buildx 0.37.1 before devcontainers/ci
and keeps the docker driver, so the build still runs on the runner's
engine with its pulled workspace image. The job already runs the
candidate's own code, so the consent check that 0.37.1 skips adds no
protection here.
---
 drawing-board/action.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drawing-board/action.yml b/drawing-board/action.yml
index f6a5d13..eb64887 100644
--- a/drawing-board/action.yml
+++ b/drawing-board/action.yml
@@ -19,6 +19,13 @@ runs:
         directory="$(mktemp -d tmp/drawing-board-checks.XXXXXX)"
         cp -R "$CHECKS_SOURCE/script" "$CHECKS_SOURCE/image" "$directory/"
         echo "directory=$directory" >> "$GITHUB_OUTPUT"
+    # Buildx 0.37.2 refuses the Dev Containers CLI's Compose build of its generated Dockerfile
+    # (devcontainers/cli#1320). Keep 0.37.1, on the runner's own Docker engine, until a CLI
+    # release fixes that.
+    - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      with:
+        version: v0.37.1
+        driver: docker
     - uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca # v0.3.1900000450
       with:
         subFolder: ${{ inputs.workspace }}