Grant bake read access to the repository root in docker:push

docker buildx bake asks for an interactive confirmation when a build
context lives outside of the directory of the bake (compose) files,
like an additional "app" context pointing to the repository root. As
castor runs the command with a pty, the CI job then waits forever for
an answer. Pass --allow=fs.read=<root_dir> explicitly.

Author: lyrixx

.castor/docker.php

@@ -562,7 +562,10 @@ function push(bool $dryRun = false): void
         ->withWorkingDirectory(variable('root_dir') . '/infrastructure/docker')
     ;
 
-    $command = ['docker', 'buildx', 'bake'];
+    // Additional build contexts may live outside of the compose files directory (e.g. the
+    // repository root): grant bake the read access explicitly, or it asks for it interactively
+    // (and waits forever in the CI, castor running it with a pty)
+    $command = ['docker', 'buildx', 'bake', '--allow=fs.read=' . variable('root_dir')];
 
     foreach ($c['docker_compose_files'] as $file) {
         $command[] = '-f';