From c6f484b5b577e56edb4e60f3dae098aedeec990e Mon Sep 17 00:00:00 2001 From: CrazyMax <1951866+crazy-max@users.noreply.github.com> Date: Thu, 6 Aug 2026 10:35:04 +0200 Subject: [PATCH] ci: use Docker Hub OIDC for test jobs Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com> --- .github/workflows/.test-bake.yml | 137 ++++++++++-------------------- .github/workflows/.test-build.yml | 136 ++++++++++------------------- 2 files changed, 88 insertions(+), 185 deletions(-) diff --git a/.github/workflows/.test-bake.yml b/.github/workflows/.test-bake.yml index 15f1ecf2..d4aff1fc 100644 --- a/.github/workflows/.test-bake.yml +++ b/.github/workflows/.test-bake.yml @@ -44,28 +44,31 @@ jobs: set: | *.args.VERSION={{meta.version}} target: hello + registry-identities: | + - type: dockerhub + registry: docker.io + username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} + connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} meta-images: | docker.io/dockereng/github-builder-test meta-tags: | type=raw,value=bake-ghbuilder-single-${{ github.run_id }} - secrets: - registry-auths: | - - registry: docker.io - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} - password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} bake-dockerhub-single-verify: uses: ./.github/workflows/verify.yml if: ${{ github.event_name != 'pull_request' }} needs: - bake-dockerhub-single + permissions: + contents: read + id-token: write with: builder-outputs: ${{ toJSON(needs.bake-dockerhub-single.outputs) }} - secrets: - registry-auths: | - - registry: docker.io - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} - password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} + registry-identities: | + - type: dockerhub + registry: docker.io + username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} + connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} bake-dockerhub-single-outputs: runs-on: ubuntu-24.04 @@ -149,59 +152,6 @@ jobs: set: | *.args.VERSION={{meta.version}} target: hello-cross - meta-images: | - docker.io/dockereng/github-builder-test - meta-tags: | - type=raw,value=bake-ghbuilder-${{ github.run_id }} - secrets: - registry-auths: | - - registry: docker.io - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} - password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} - - bake-dockerhub-verify: - uses: ./.github/workflows/verify.yml - if: ${{ github.event_name != 'pull_request' }} - needs: - - bake-dockerhub - with: - builder-outputs: ${{ toJSON(needs.bake-dockerhub.outputs) }} - secrets: - registry-auths: | - - registry: docker.io - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} - password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} - - bake-dockerhub-outputs: - runs-on: ubuntu-24.04 - needs: - - bake-dockerhub - steps: - - - name: Builder outputs - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 - env: - INPUT_BUILDER-OUTPUTS: ${{ toJSON(needs.bake-dockerhub.outputs) }} - with: - script: | - const builderOutputs = JSON.parse(core.getInput('builder-outputs')); - core.info(JSON.stringify(builderOutputs, null, 2)); - - bake-dockerhub-oidc: - uses: ./.github/workflows/bake.yml - if: ${{ github.event_name != 'pull_request' }} - permissions: - contents: read - id-token: write - with: - job-name-prefix: bake-dockerhub-oidc - context: test - output: image - push: true - sbom: true - set: | - *.args.VERSION={{meta.version}} - target: hello registry-identities: | - type: dockerhub registry: docker.io @@ -210,35 +160,34 @@ jobs: meta-images: | docker.io/dockereng/github-builder-test meta-tags: | - type=raw,value=bake-ghbuilder-oidc-${{ github.run_id }} + type=raw,value=bake-ghbuilder-${{ github.run_id }} - bake-dockerhub-oidc-verify: + bake-dockerhub-verify: uses: ./.github/workflows/verify.yml if: ${{ github.event_name != 'pull_request' }} needs: - - bake-dockerhub-oidc + - bake-dockerhub permissions: contents: read id-token: write with: - builder-outputs: ${{ toJSON(needs.bake-dockerhub-oidc.outputs) }} + builder-outputs: ${{ toJSON(needs.bake-dockerhub.outputs) }} registry-identities: | - type: dockerhub registry: docker.io username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} - bake-dockerhub-oidc-outputs: + bake-dockerhub-outputs: runs-on: ubuntu-24.04 - if: ${{ github.event_name != 'pull_request' }} needs: - - bake-dockerhub-oidc + - bake-dockerhub steps: - name: Builder outputs uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: - INPUT_BUILDER-OUTPUTS: ${{ toJSON(needs.bake-dockerhub-oidc.outputs) }} + INPUT_BUILDER-OUTPUTS: ${{ toJSON(needs.bake-dockerhub.outputs) }} with: script: | const builderOutputs = JSON.parse(core.getInput('builder-outputs')); @@ -272,15 +221,15 @@ jobs: *.args.VERSION={{meta.version}} sign: false target: hello-cross + registry-identities: | + - type: dockerhub + registry: docker.io + username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} + connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} meta-images: | docker.io/dockereng/github-builder-test meta-tags: | type=raw,value=bake-ghbuilder-nosign-${{ github.run_id }} - secrets: - registry-auths: | - - registry: docker.io - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} - password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} bake-dockerhub-nosign-verify: uses: ./.github/workflows/verify.yml @@ -289,11 +238,6 @@ jobs: - bake-dockerhub-nosign with: builder-outputs: ${{ toJSON(needs.bake-dockerhub-nosign.outputs) }} - secrets: - registry-auths: | - - registry: docker.io - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} - password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} bake-dockerhub-nosign-outputs: runs-on: ubuntu-24.04 @@ -329,30 +273,37 @@ jobs: docker.io/dockereng/github-builder-test meta-tags: | type=raw,value=${{ github.run_id }},prefix=bake-ghcr-and-dockerhub- + registry-identities: | + - type: dockerhub + registry: docker.io + username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} + connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} secrets: registry-auths: | - registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - registry: docker.io - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} - password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} bake-ghcr-and-dockerhub-verify: uses: ./.github/workflows/verify.yml if: ${{ github.event_name != 'pull_request' }} needs: - bake-ghcr-and-dockerhub + permissions: + contents: read + id-token: write with: builder-outputs: ${{ toJSON(needs.bake-ghcr-and-dockerhub.outputs) }} + registry-identities: | + - type: dockerhub + registry: docker.io + username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} + connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} secrets: registry-auths: | - registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - registry: docker.io - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} - password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} bake-ghcr-and-dockerhub-outputs: runs-on: ubuntu-24.04 @@ -526,7 +477,7 @@ jobs: push: false registry-identities: | - type: dockerhub - username: dockereng + username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} connection_id: ${{ vars.MISSING_DOCKERHUB_OIDC_CONNECTIONID }} set: | *.args.VERSION={{meta.version}} @@ -583,15 +534,15 @@ jobs: set: | *.args.VERSION={{meta.version}} target: hello-cross + registry-identities: | + - type: dockerhub + registry: docker.io + username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} + connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} meta-images: | docker.io/dockereng/github-builder-test meta-tags: | type=raw,value=bake-ghbuilder-nodistrib-${{ github.run_id }} - secrets: - registry-auths: | - - registry: docker.io - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} - password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} bake-local-nodistrib: uses: ./.github/workflows/bake.yml diff --git a/.github/workflows/.test-build.yml b/.github/workflows/.test-build.yml index 8bf2d47d..75b395e1 100644 --- a/.github/workflows/.test-build.yml +++ b/.github/workflows/.test-build.yml @@ -43,28 +43,31 @@ jobs: output: image push: ${{ github.event_name != 'pull_request' }} sbom: true + registry-identities: | + - type: dockerhub + registry: docker.io + username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} + connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} meta-images: | docker.io/dockereng/github-builder-test meta-tags: | type=raw,value=build-ghbuilder-single-${{ github.run_id }} - secrets: - registry-auths: | - - registry: docker.io - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} - password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} build-dockerhub-single-verify: uses: ./.github/workflows/verify.yml if: ${{ github.event_name != 'pull_request' }} needs: - build-dockerhub-single + permissions: + contents: read + id-token: write with: builder-outputs: ${{ toJSON(needs.build-dockerhub-single.outputs) }} - secrets: - registry-auths: | - - registry: docker.io - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} - password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} + registry-identities: | + - type: dockerhub + registry: docker.io + username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} + connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} build-dockerhub-single-outputs: runs-on: ubuntu-24.04 @@ -146,58 +149,6 @@ jobs: linux/arm=ubuntu-24.04-arm linux/arm64=ubuntu-24.04-arm sbom: true - meta-images: | - docker.io/dockereng/github-builder-test - meta-tags: | - type=raw,value=build-ghbuilder-${{ github.run_id }} - secrets: - registry-auths: | - - registry: docker.io - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} - password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} - - build-dockerhub-verify: - uses: ./.github/workflows/verify.yml - if: ${{ github.event_name != 'pull_request' }} - needs: - - build-dockerhub - with: - builder-outputs: ${{ toJSON(needs.build-dockerhub.outputs) }} - secrets: - registry-auths: | - - registry: docker.io - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} - password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} - - build-dockerhub-outputs: - runs-on: ubuntu-24.04 - needs: - - build-dockerhub - steps: - - - name: Builder outputs - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 - env: - INPUT_BUILDER-OUTPUTS: ${{ toJSON(needs.build-dockerhub.outputs) }} - with: - script: | - const builderOutputs = JSON.parse(core.getInput('builder-outputs')); - core.info(JSON.stringify(builderOutputs, null, 2)); - - build-dockerhub-oidc: - uses: ./.github/workflows/build.yml - if: ${{ github.event_name != 'pull_request' }} - permissions: - contents: read - id-token: write - with: - job-name-prefix: build-dockerhub-oidc - build-args: | - VERSION={{meta.version}} - file: test/hello.Dockerfile - output: image - push: true - sbom: true registry-identities: | - type: dockerhub registry: docker.io @@ -206,35 +157,34 @@ jobs: meta-images: | docker.io/dockereng/github-builder-test meta-tags: | - type=raw,value=build-ghbuilder-oidc-${{ github.run_id }} + type=raw,value=build-ghbuilder-${{ github.run_id }} - build-dockerhub-oidc-verify: + build-dockerhub-verify: uses: ./.github/workflows/verify.yml if: ${{ github.event_name != 'pull_request' }} needs: - - build-dockerhub-oidc + - build-dockerhub permissions: contents: read id-token: write with: - builder-outputs: ${{ toJSON(needs.build-dockerhub-oidc.outputs) }} + builder-outputs: ${{ toJSON(needs.build-dockerhub.outputs) }} registry-identities: | - type: dockerhub registry: docker.io username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} - build-dockerhub-oidc-outputs: + build-dockerhub-outputs: runs-on: ubuntu-24.04 - if: ${{ github.event_name != 'pull_request' }} needs: - - build-dockerhub-oidc + - build-dockerhub steps: - name: Builder outputs uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: - INPUT_BUILDER-OUTPUTS: ${{ toJSON(needs.build-dockerhub-oidc.outputs) }} + INPUT_BUILDER-OUTPUTS: ${{ toJSON(needs.build-dockerhub.outputs) }} with: script: | const builderOutputs = JSON.parse(core.getInput('builder-outputs')); @@ -268,15 +218,15 @@ jobs: push: ${{ github.event_name != 'pull_request' }} sbom: true sign: false + registry-identities: | + - type: dockerhub + registry: docker.io + username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} + connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} meta-images: | docker.io/dockereng/github-builder-test meta-tags: | type=raw,value=build-ghbuilder-nosign--${{ github.run_id }} - secrets: - registry-auths: | - - registry: docker.io - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} - password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} build-dockerhub-nosign-verify: uses: ./.github/workflows/verify.yml @@ -285,11 +235,6 @@ jobs: - build-dockerhub-nosign with: builder-outputs: ${{ toJSON(needs.build-dockerhub-nosign.outputs) }} - secrets: - registry-auths: | - - registry: docker.io - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} - password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} build-dockerhub-nosign-outputs: runs-on: ubuntu-24.04 @@ -376,30 +321,37 @@ jobs: docker.io/dockereng/github-builder-test meta-tags: | type=raw,value=${{ github.run_id }},prefix=build-ghcr-and-dockerhub- + registry-identities: | + - type: dockerhub + registry: docker.io + username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} + connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} secrets: registry-auths: | - registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - registry: docker.io - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} - password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} build-ghcr-and-dockerhub-verify: uses: ./.github/workflows/verify.yml if: ${{ github.event_name != 'pull_request' }} needs: - build-ghcr-and-dockerhub + permissions: + contents: read + id-token: write with: builder-outputs: ${{ toJSON(needs.build-ghcr-and-dockerhub.outputs) }} + registry-identities: | + - type: dockerhub + registry: docker.io + username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} + connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} secrets: registry-auths: | - registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - registry: docker.io - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} - password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} build-ghcr-and-dockerhub-outputs: runs-on: ubuntu-24.04 @@ -575,7 +527,7 @@ jobs: push: false registry-identities: | - type: dockerhub - username: dockereng + username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} connection_id: ${{ vars.MISSING_DOCKERHUB_OIDC_CONNECTIONID }} meta-images: ghcr.io/docker/github-builder-test meta-tags: | @@ -627,15 +579,15 @@ jobs: platforms: linux/amd64,linux/arm64 push: ${{ github.event_name != 'pull_request' }} sbom: true + registry-identities: | + - type: dockerhub + registry: docker.io + username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} + connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} meta-images: | docker.io/dockereng/github-builder-test meta-tags: | type=raw,value=build-ghbuilder-nodistrib-${{ github.run_id }} - secrets: - registry-auths: | - - registry: docker.io - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} - password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} build-local-nodistrib: uses: ./.github/workflows/build.yml