diff --git a/.github/workflows/ci-subaction.yml b/.github/workflows/ci-subaction.yml
new file mode 100644
index 0000000..fecd39c
--- /dev/null
+++ b/.github/workflows/ci-subaction.yml
@@ -0,0 +1,61 @@
+name: ci-subaction
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 10 * * *'
+  push:
+    branches:
+      - 'master'
+      - 'releases/v*'
+    tags:
+      - 'v*'
+    paths:
+      - '.github/workflows/ci-subaction.yml'
+      - 'subaction/**'
+      - 'test/**'
+  pull_request:
+    paths:
+      - '.github/workflows/ci-subaction.yml'
+      - 'subaction/**'
+      - 'test/**'
+
+jobs:
+  matrix-targets-group:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Matrix gen
+        id: gen
+        uses: ./subaction/matrix-targets
+        with:
+          workdir: ./test/group
+      -
+        name: Show matrix
+        run: |
+          echo matrix=${{ steps.gen.outputs.matrix }}
+
+  matrix-targets-group-matrix:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Matrix gen
+        id: gen
+        uses: ./subaction/matrix-targets
+        with:
+          workdir: ./test/group-matrix
+          target: validate
+      -
+        name: Show matrix
+        run: |
+          echo matrix=${{ steps.gen.outputs.matrix }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c772008..82ee44c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,13 @@ on:
       - 'releases/v*'
     tags:
       - 'v*'
+    paths-ignore:
+      - '.github/workflows/ci-subaction.yml'
+      - 'subaction/**'
   pull_request:
+    paths-ignore:
+      - '.github/workflows/ci-subaction.yml'
+      - 'subaction/**'
 
 env:
   BUILDX_VERSION: latest
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e4e2a41..c989589 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -9,7 +9,13 @@ on:
     branches:
       - 'master'
       - 'releases/v*'
+    paths-ignore:
+      - '.github/workflows/ci-subaction.yml'
+      - 'subaction/**'
   pull_request:
+    paths-ignore:
+      - '.github/workflows/ci-subaction.yml'
+      - 'subaction/**'
 
 jobs:
   test:
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 449d0c1..c0bfcab 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -9,7 +9,13 @@ on:
     branches:
       - 'master'
       - 'releases/v*'
+    paths-ignore:
+      - '.github/workflows/ci-subaction.yml'
+      - 'subaction/**'
   pull_request:
+    paths-ignore:
+      - '.github/workflows/ci-subaction.yml'
+      - 'subaction/**'
 
 jobs:
   prepare:
diff --git a/subaction/matrix-targets/action.yml b/subaction/matrix-targets/action.yml
new file mode 100644
index 0000000..acc5cb9
--- /dev/null
+++ b/subaction/matrix-targets/action.yml
@@ -0,0 +1,62 @@
+# https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions
+name: 'Bake matrix targets'
+description: 'Generate a matrix of targets to distribute builds in your workflow'
+
+inputs:
+  workdir:
+    description: Working directory
+    default: '.'
+    required: false
+  files:
+    description: Comma separated list of Bake files
+    required: false
+  target:
+    description: Bake target
+    default: 'default'
+    required: false
+
+outputs:
+  matrix:
+    description: Matrix of targets
+    value: ${{ steps.generate.outputs.matrix }}
+
+runs:
+  using: composite
+  steps:
+    -
+      name: Generate matrix
+      id: generate
+      uses: actions/github-script@v6
+      with:
+        script: |
+          let def;
+          const files = `${{ inputs.files }}` ? `${{ inputs.files }}`.split(',') : [];
+          const target = `${{ inputs.target }}` ? `${{ inputs.target }}` : 'default';
+
+          await core.group(`Validating definition`, async () => {
+            let args = ['buildx', 'bake'];
+            for (const file of files) {
+              args.push('--file', file);
+            }
+            args.push(target, '--print');
+
+            const res = await exec.getExecOutput('docker', args, {
+              ignoreReturnCode: true,
+              silent: true,
+              cwd: `${{ inputs.workdir }}`
+            });
+            if (res.stderr.length > 0 && res.exitCode != 0) {
+              throw new Error(res.stderr);
+            }
+            def = JSON.parse(res.stdout.trim());
+            core.info(JSON.stringify(def, null, 2));
+          });
+
+          await core.group(`Set matrix`, async () => {
+            let matrix = [];
+            for (const [key, value] of Object.entries(def.target)) {
+              matrix.push(key);
+            }
+            core.info(`matrix: ${JSON.stringify(matrix)}`);
+            core.setOutput('matrix', JSON.stringify(matrix));
+          });
diff --git a/test/group-matrix/docker-bake.hcl b/test/group-matrix/docker-bake.hcl
new file mode 100644
index 0000000..ea27ff6
--- /dev/null
+++ b/test/group-matrix/docker-bake.hcl
@@ -0,0 +1,31 @@
+group "validate" {
+  targets = ["lint", "validate-vendor", "validate-doctoc"]
+}
+
+target "lint" {
+  name = "lint-${buildtags.name}"
+  dockerfile = "./hack/dockerfiles/lint.Dockerfile"
+  target = buildtags.target
+  output = ["type=cacheonly"]
+  matrix = {
+    buildtags = [
+      { name = "default", tags = "", target = "golangci-lint" },
+      { name = "labs", tags = "dfrunsecurity dfparents", target = "golangci-lint" },
+      { name = "nydus", tags = "nydus", target = "golangci-lint" },
+      { name = "yaml", tags = "", target = "yamllint" },
+      { name = "proto", tags = "", target = "protolint" },
+    ]
+  }
+}
+
+target "validate-vendor" {
+  dockerfile = "./hack/dockerfiles/vendor.Dockerfile"
+  target = "validate"
+  output = ["type=cacheonly"]
+}
+
+target "validate-doctoc" {
+  dockerfile = "./hack/dockerfiles/doctoc.Dockerfile"
+  target = "validate-toc"
+  output = ["type=cacheonly"]
+}