[29.x backport] gha/build: Use OIDC for Docker Hub login - #7132
Conversation
vvoland
commented
Jul 28, 2026
vvoland
commented
- backport: gha/build: Use OIDC for Docker Hub login #7131
OIDC login requires docker/login-action v4.5.0 or newer Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com> (cherry picked from commit 5ff2ff6) Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
This PR correctly migrates Docker Hub authentication from username/password secrets to OIDC using docker/login-action v4.5.0. The id-token: write permission is granted at job level, which is the only way GitHub Actions supports OIDC — an accepted and unavoidable pattern.
One security note posted inline: verify that the hardcoded username: dockereng matches the Docker Hub account that has the OIDC connection registered.
Dismissed security findings (review manually)
.github/workflows/build.yml:103 —id-token: writepermission at job level exposes OIDC token to all steps (verifier mitigation: this is the only mechanism GitHub Actions provides for OIDC; all steps are from the docker/ org; accepted trade-off)
| with: | ||
| username: ${{ secrets.DOCKERHUB_CLIBIN_USERNAME }} | ||
| password: ${{ secrets.DOCKERHUB_CLIBIN_TOKEN }} | ||
| username: dockereng |
There was a problem hiding this comment.
[medium] Hardcoded username: dockereng may mismatch the OIDC-linked Docker Hub account
The login step now uses hardcoded username: dockereng instead of the former ${{ secrets.DOCKERHUB_CLIBIN_USERNAME }}. In Docker Hub's OIDC federation, the username field must match the account that has the OIDC connection configured. If DOCKERHUB_CLIBIN_USERNAME previously referred to a service account other than dockereng, the OIDC token exchange will fail because the username used to look up the OIDC connection will be wrong.
If dockereng is the correct Docker Hub org/account that owns the OIDC connection (likely, given that Docker CLI bin images are published under dockereng), this is fine — but it is worth double-checking that the OIDC connection in Docker Hub is registered against the dockereng account, not against the previous service account that DOCKERHUB_CLIBIN_USERNAME pointed to.
| Confidence | Score |
|---|---|
| 🟠 weak | 52/100 |
3 participants
