Repository: docker/compose
File: pkg/compose/publish.go (Go)

Code before:
	}
	project, err = project.WithImagesResolved(ImageDigestResolver(ctx, s.configFile(), s.apiClient()))
	if err != nil {
		return nil, err
	}
	override := types.Project{
		Services: types.Services{},
	}
	for name, service := range project.Services {
		override.Services[name] = types.ServiceConfig{
			Image: service.Image,
		}
	}
	return override.MarshalYAML()
}

//nolint:gocyclo
func (s *composeService) preChecks(project *types.Project, options api.PublishOptions) (bool, error) {
	if ok, err := s.checkOnlyBuildSection(project); !ok || err != nil {
		return false, err
	}
	bindMounts := s.checkForBindMount(project)
	if len(bindMounts) > 0 {
		fmt.Println("you are about to publish bind mounts declaration within your OCI artifact.\n" +
			"only the bind mount declarations will be added to the OCI artifact\n" +
			"please double check that you are not mounting potential sensitive directories or data")
		for key, val := range bindMounts {
			_, _ = fmt.Fprintln(s.dockerCli.Out(), key)
			for _, v := range val {
				_, _ = fmt.Fprintf(s.dockerCli.Out(), "%s\n", v.String())
			}
		}
		if ok, err := acceptPublishBindMountDeclarations(s.dockerCli); err != nil || !ok {
			return false, err
		}
	}
	if options.AssumeYes {
		return true, nil
	}
	detectedSecrets, err := s.checkForSensitiveData(project)
	if err != nil {
		return false, err
	}
	if len(detectedSecrets) > 0 {
		fmt.Println("you are about to publish sensitive data within your OCI artifact.\n" +
			"please double check that you are not leaking sensitive data")
		for _, val := range detectedSecrets {
			_, _ = fmt.Fprintln(s.dockerCli.Out(), val.Type)
			_, _ = fmt.Fprintf(s.dockerCli.Out(), "%q: %s\n", val.Key, val.Value)
		}
		if ok, err := acceptPublishSensitiveData(s.dockerCli); err != nil || !ok {

Review comment (security):
```suggestion
		fmt.Println("you are about to publish bind mounts declaration within your OCI artifact.\n" +
			"only the bind mount declarations will be added to the OCI artifact (not content)\n" +
			"please double check that you are not mounting potential user's sensitive directories or data")
```

Code after:
	}
	project, err = project.WithImagesResolved(ImageDigestResolver(ctx, s.configFile(), s.apiClient()))
	if err != nil {
		return nil, err
	}
	override := types.Project{
		Services: types.Services{},
	}
	for name, service := range project.Services {
		override.Services[name] = types.ServiceConfig{
			Image: service.Image,
		}
	}
	return override.MarshalYAML()
}

//nolint:gocyclo
func (s *composeService) preChecks(project *types.Project, options api.PublishOptions) (bool, error) {
	if ok, err := s.checkOnlyBuildSection(project); !ok || err != nil {
		return false, err
	}
	bindMounts := s.checkForBindMount(project)
	if len(bindMounts) > 0 {
		fmt.Println("you are about to publish bind mounts declaration within your OCI artifact.\n" +
			"only the bind mount declarations will be added to the OCI artifact (not content)\n" +
			"please double check that you are not mounting potential user's sensitive directories or data")
		for key, val := range bindMounts {
			_, _ = fmt.Fprintln(s.dockerCli.Out(), key)
			for _, v := range val {
				_, _ = fmt.Fprintf(s.dockerCli.Out(), "%s\n", v.String())
			}
		}
		if ok, err := acceptPublishBindMountDeclarations(s.dockerCli); err != nil || !ok {
			return false, err
		}
	}
	if options.AssumeYes {
		return true, nil
	}
	detectedSecrets, err := s.checkForSensitiveData(project)
	if err != nil {
		return false, err
	}
	if len(detectedSecrets) > 0 {
		fmt.Println("you are about to publish sensitive data within your OCI artifact.\n" +
			"please double check that you are not leaking sensitive data")
		for _, val := range detectedSecrets {
			_, _ = fmt.Fprintln(s.dockerCli.Out(), val.Type)
			_, _ = fmt.Fprintf(s.dockerCli.Out(), "%q: %s\n", val.Key, val.Value)
		}
		if ok, err := acceptPublishSensitiveData(s.dockerCli); err != nil || !ok {