From 20c1af5f50fbafe854508e760f361fc6065dbc30 Mon Sep 17 00:00:00 2001 From: Moshe Vayner Date: Wed, 12 Aug 2026 14:33:20 -0400 Subject: [PATCH] [ci] harden DockerHub login step by switching to OIDC authentication Signed-off-by: Moshe Vayner --- .github/workflows/ci.yml | 10 +++++++--- .github/workflows/release.yml | 8 +++++--- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index afa91a9d..2770475e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -10,6 +10,7 @@ permissions: contents: read pull-requests: read actions: read + id-token: write concurrency: group: ci-${{ github.event.pull_request.number || github.ref_name }} @@ -67,6 +68,8 @@ jobs: dl.k8s.io:443 get.helm.sh:443 githubapp.com:443 + auth.docker.io:443 + identity.docker.io:443 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: @@ -114,10 +117,11 @@ jobs: ref: ${{ github.event.pull_request.head.sha }} - name: Login to Docker Hub - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + env: + DOCKERHUB_OIDC_CONNECTIONID: ${{ secrets.DOCKERHUB_OIDC_CONNECTIONID }} with: - username: ${{ secrets.DOCKER_USERNAME }} - password: ${{ secrets.DOCKER_PASSWORD }} + username: ${{ github.repository_owner }} - name: Set up Mise uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 95830cad..a4422c2e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,6 +6,7 @@ on: permissions: contents: read + id-token: write jobs: release: @@ -36,10 +37,11 @@ jobs: install_args: go ko - name: Login to Docker Hub - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + env: + DOCKERHUB_OIDC_CONNECTIONID: ${{ secrets.DOCKERHUB_OIDC_CONNECTIONID }} with: - username: ${{ secrets.DOCKER_USERNAME }} - password: ${{ secrets.DOCKER_PASSWORD }} + username: ${{ github.repository_owner }} - name: Build and Push to Docker Hub with ko run: mise run ko-publish