file jumbling with multiple compose files on docker stack deploy

there is an issue when using docker stack deploy with multiple compose files

consider the following folder structure

folder1/docker-compose.yml
folder1/secret1.txt
folder2/docker-compose.yml
folder2/secret2.txt

folder1/docker-compose.yml

version: '3.5'
secrets:
    secret1.txt
        file: ./secret1.txt
services:
    service-using-secret1:
        image: whatever
        secrets:
            - secret1.txt

folder2/docker-compose.yml

version: '3.5'
secrets:
    secret2.txt
        file: ./secret2.txt
services:
    service-using-secret2:
        image: whatever
        secrets:
            - secret2.txt

using the following docker stack deploy

docker stack deploy --compose-file=folder1/docker-compose.yml --compose-file=folder2/docker-compose.yml mystack

will lead to the following error

open [your parent folder]/folder1/secret2.txt: no such file or directory

it seems docker is searching for file references relative to the first compose file and not relative to the actual compose file the reference is in.

This can lead to potential security risks if the files would be named the same. In that case it could lead to security sensitive information to be leaked to a service it is not meant for.

as a workaround we currently run the following bash script in our CICD enviroment before running the actual docker stack deploy

COMPOSEFILES=`find . -type f -name 'docker-compose*.yml'`
for fn in $COMPOSEFILES; do
    echo $fn
    if [ -f $fn ]; then
        FNPATH=`realpath $fn`
        FNDIR=`dirname $FNPATH`
        echo "replacing paths in $FNPATH"
        sed -i "s|file: ./|file: $FNDIR/|g" $FNPATH | head
    fi
done

it would be preferable to have a more permanent solution

Reproduce the case with folder1/docker-compose.yml, folder2/docker-compose.yml, secret1.txt, and secret2.txt using docker stack deploy with both --compose-file arguments. Trace how the command resolves each file; done means references in each compose file resolve relative to that file's directory, with a regression test covering the two-folder setup.