Repository: docker/compose
File: pkg/compose/publish.go (Go)

Code before:
	}
	override := types.Project{
		Services: types.Services{},
	}
	for name, service := range project.Services {
		override.Services[name] = types.ServiceConfig{
			Image: service.Image,
		}
	}
	return override.MarshalYAML()
}

func preChecks(project *types.Project, options api.PublishOptions) error {
	if !options.WithEnvironment {
		for _, service := range project.Services {
			if len(service.EnvFiles) > 0 {
				return fmt.Errorf("service %q has env_file declared. To avoid leaking sensitive data, "+
					"you must either explicitly allow the sending of environment variables by using the --with-env flag,"+
					" or remove sensitive data from your Compose configuration", service.Name)
			}
			if len(service.Environment) > 0 {
				return fmt.Errorf("service %q has environment variable(s) declared. To avoid leaking sensitive data, "+
					"you must either explicitly allow the sending of environment variables by using the --with-env flag,"+
					" or remove sensitive data from your Compose configuration", service.Name)
			}
		}
	}

	return nil
}


Review comment (security):
service.environment may be set with a fixed value, not relying on any interpolation. Typically:
```
db:
    image: mysql
    environment:
      MYSQL_DATABASE: avatar
      MYSQL_ROOT_PASSWORD_FILE: /run/secrets/db-password
```
those should not prevent compose file to be published, right ?

Code after:
	}
	project, err = project.WithImagesResolved(ImageDigestResolver(ctx, s.configFile(), s.apiClient()))
	if err != nil {
		return nil, err
	}
	override := types.Project{
		Services: types.Services{},
	}
	for name, service := range project.Services {
		override.Services[name] = types.ServiceConfig{
			Image: service.Image,
		}
	}
	return override.MarshalYAML()
}

func preChecks(project *types.Project, options api.PublishOptions) error {
	if !options.WithEnvironment {
		for _, service := range project.Services {
			if len(service.EnvFiles) > 0 {
				return fmt.Errorf("service %q has env_file declared. To avoid leaking sensitive data, "+
					"you must either explicitly allow the sending of environment variables by using the --with-env flag,"+
					" or remove sensitive data from your Compose configuration", service.Name)
			}
			if len(service.Environment) > 0 {
				return fmt.Errorf("service %q has environment variable(s) declared. To avoid leaking sensitive data, "+
					"you must either explicitly allow the sending of environment variables by using the --with-env flag,"+
					" or remove sensitive data from your Compose configuration", service.Name)
			}
		}

		for _, config := range project.Configs {
			if config.Environment != "" {
				return fmt.Errorf("config %q is declare as an environment variable. To avoid leaking sensitive data, "+
					"you must either explicitly allow the sending of environment variables by using the --with-env flag,"+
					" or remove sensitive data from your Compose configuration", config.Name)
			}
		}
	}

	return nil
}

func envFileLayers(project *types.Project) []ocipush.Pushable {
	var layers []ocipush.Pushable
	for _, service := range project.Services {
		for _, envFile := range service.EnvFiles {
			f, err := os.ReadFile(envFile.Path)
			if err != nil {
				// if we can't read the file, skip to the next one
				continue