From d00ad3090db262723b44ecd293f21bb630a0109b Mon Sep 17 00:00:00 2001
From: Aaron <amark@g.jct.ac.il>
Date: Sat, 13 Jun 2026 22:31:54 +0300
Subject: [PATCH] bake: reject targets inside target blocks

---
 bake/bake.go     | 34 ++++++++++++++++++++++++++++++++++
 bake/hcl_test.go | 21 +++++++++++++++++++++
 2 files changed, 55 insertions(+)

diff --git a/bake/bake.go b/bake/bake.go
index 66ef0a1d55b4..d14a24fcd5c2 100644
--- a/bake/bake.go
+++ b/bake/bake.go
@@ -413,6 +413,10 @@ func ParseFiles(files []File, defaults, vars map[string]string) (_ *Config, _ *h
 		pm = *res
 	}
 
+	if err := validateTargetGroups(hclFiles); err != nil {
+		return nil, nil, err
+	}
+
 	return &c, &pm, nil
 }
 
@@ -442,6 +446,36 @@ func ParseFile(dt []byte, fn string) (*Config, error) {
 	return c, err
 }
 
+func validateTargetGroups(files []*hcl.File) error {
+	schema := &hcl.BodySchema{
+		Blocks: []hcl.BlockHeaderSchema{
+			{Type: "target", LabelNames: []string{"name"}},
+		},
+	}
+	for _, f := range files {
+		content, _, diags := f.Body.PartialContent(schema)
+		if diags.HasErrors() {
+			return diags
+		}
+		for _, block := range content.Blocks {
+			attrs, diags := block.Body.JustAttributes()
+			if diags.HasErrors() {
+				return diags
+			}
+			if attr, ok := attrs["targets"]; ok {
+				return hcl.Diagnostics{&hcl.Diagnostic{
+					Severity: hcl.DiagError,
+					Summary:  "Unsupported argument",
+					Detail:   "The \"targets\" argument is not valid inside a target block; use a group block instead.",
+					Subject:  attr.NameRange.Ptr(),
+					Context:  attr.Range.Ptr(),
+				}}
+			}
+		}
+	}
+	return nil
+}
+
 type Config struct {
 	Groups  []*Group  `json:"group" hcl:"group,block" cty:"group"`
 	Targets []*Target `json:"target" hcl:"target,block" cty:"target"`
diff --git a/bake/hcl_test.go b/bake/hcl_test.go
index c57ac78213b7..ec5633bb53ad 100644
--- a/bake/hcl_test.go
+++ b/bake/hcl_test.go
@@ -188,6 +188,27 @@ func TestHCLWithUserDefinedFunctions(t *testing.T) {
 	require.Equal(t, ptrstr("124"), c.Targets[0].Args["buildno"])
 }
 
+func TestTargetDisallowsGroupTargetsAttribute(t *testing.T) {
+	dt := []byte(`
+		target "app" {
+			dockerfile = "app.Dockerfile"
+		}
+
+		target "db" {
+			dockerfile = "db.Dockerfile"
+		}
+
+		target "foo" {
+			targets = ["app", "db"]
+		}
+	`)
+
+	_, err := ParseFile(dt, "docker-bake.hcl")
+	require.Error(t, err)
+	require.ErrorContains(t, err, "Unsupported argument")
+	require.ErrorContains(t, err, "targets")
+}
+
 func TestHCLWithVariables(t *testing.T) {
 	dt := []byte(`
 		variable "BUILD_NUMBER" {