gha/build: Use OIDC for Docker Hub login - #7131
#7131gha/build: Use OIDC for Docker Hub login#7131
Conversation
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
The switch from username/password secrets to OIDC for Docker Hub login is correctly implemented:
id-token: writepermission is properly scoped at the job levelDOCKERHUB_OIDC_CONNECTIONIDis correctly sourced fromvars(notsecrets) — OIDC connection IDs are non-secret identifiers, and this is the standard pattern for this action- The job-level
ifguard (github.repository == 'docker/cli'andgithub.event_name != 'pull_request') ensures this only runs in the canonical repo on non-PR events username: dockerengwith no password is the correctwith:configuration for OIDC-based login indocker/login-actionv4.4.0
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
The OIDC migration looks correct:
id-token: writepermission is properly scoped to thebin-imagejobcontents: readprovides a sensible baseline- Hardcoded
username: dockerengis the expected org account for Docker's OIDC login flow DOCKERHUB_OIDC_CONNECTIONIDis correctly passed viaenvas required bydocker/login-action's OIDC path- Old username/password secrets are cleanly removed
No bugs introduced by this PR.
| name: Login to DockerHub | ||
| name: Login to Docker Hub | ||
| if: github.event_name != 'pull_request' | ||
| uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 |
There was a problem hiding this comment.
Oh nevermind, needs to update to v4.5.0+
OIDC login requires docker/login-action v4.5.0 or newer Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟡 NEEDS ATTENTION
Lower-confidence findings (not posted inline)
-
[medium] .github/workflows/build.yml:114 — Hard-coded username
dockerengand unverifiedDOCKERHUB_OIDC_CONNECTIONIDrepository variable may cause silent authentication failure (confidence: weak 38/100)In OIDC-based Docker Hub login, the static
username: dockerengis likely the correct Docker Hub organization name (not a credential), so this is probably intentional. The main operational risk is that ifvars.DOCKERHUB_OIDC_CONNECTIONIDis not configured as a repository variable, the env value will be an empty string and authentication may silently misconfigure. This is a deployment prerequisite, not a code bug, but worth confirming the variable is set in repository settings.
| uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 | ||
| uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c # v4.5.0 | ||
| env: | ||
| DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} |
There was a problem hiding this comment.
[medium] OIDC connection ID set via env: — verify docker/login-action v4.5.0 reads it from the environment
The new step passes DOCKERHUB_OIDC_CONNECTIONID as a step-level env: variable rather than as a with: input to the action. Whether this is correct depends on how docker/login-action v4.5.0 is implemented:
- If the action reads the connection ID from
process.env.DOCKERHUB_OIDC_CONNECTIONID(e.g. a dedicated env-var API), the current usage is correct. - If the action only reads it via
core.getInput('oidc-connection-id')or a similarwith:input, then the value will be ignored, and OIDC authentication will silently fall back or fail on push.
docker/login-action v4.5.0 appears to be a new release that introduced OIDC support; the expected API surface for the connection ID should be confirmed against its release notes / source. If the action expects a with: input (e.g. oidc-connection-id), the fix would be:
| DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} | |
| env: | |
| DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} | |
| with: | |
| username: dockereng | |
| oidc-connection-id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} |
| Confidence | Score |
|---|---|
| 🟠 weak | 43/100 |
- What I did
- How I did it
- How to verify it
- Human readable description for the release notes
- A picture of a cute animal (not mandatory but encouraged)