This has come up today with bake-action, and I've ended up with this:

      -
        name: Build 
        uses: docker/bake-action@master

      -
        name: Build and push
        uses: docker/bake-action@master
        with:
          push: true

My issue is I RUN some tests at the end of the build and don't feel much need to do further testing before pushing, but if an individual image fails some may have already been pushed

An additional issue this can cause is where one target does a file output to a location that is the build context for a separate target.

If they're queueing it's currently possible for the files to be written out from the first target to FS, and then they are COPYed into the later target.

This is slightly unexpected, I think most users would expect the 'reads' to be based on the FS before the bake starts

A workaround is to push with different names or even registry, do the testing, and then if testing passes, publish the images under the release names. So if some images don't build, then even though some got pushed, they are test images, and the CI won't move to publish them.