Skip to content

ci: use Docker Hub OIDC for test jobs #273

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
crazy-max merged 1 commit into from
Aug 6, 2026
+88 −185
Merged

ci: use Docker Hub OIDC for test jobs #273

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
137 changes: 44 additions & 93 deletions .github/workflows/.test-bake.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,28 +44,31 @@ jobs:
set: |
*.args.VERSION={{meta.version}}
target: hello
registry-identities: |
- type: dockerhub
registry: docker.io
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
meta-images: |
docker.io/dockereng/github-builder-test
meta-tags: |
type=raw,value=bake-ghbuilder-single-${{ github.run_id }}
secrets:
registry-auths: |
- registry: docker.io
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}

bake-dockerhub-single-verify:
uses: ./.github/workflows/verify.yml
if: ${{ github.event_name != 'pull_request' }}
needs:
- bake-dockerhub-single
permissions:
contents: read
id-token: write

@thaJeztah thaJeztah Aug 6, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we want the comment here as well (I think we did on other repositories?)

@crazy-max crazy-max Aug 6, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this workflow is just for testing and not production so no need imo

with:
builder-outputs: ${{ toJSON(needs.bake-dockerhub-single.outputs) }}
secrets:
registry-auths: |
- registry: docker.io
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
registry-identities: |
- type: dockerhub
registry: docker.io
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}

bake-dockerhub-single-outputs:
runs-on: ubuntu-24.04
Expand Down Expand Up @@ -149,59 +152,6 @@ jobs:
set: |
*.args.VERSION={{meta.version}}
target: hello-cross
meta-images: |
docker.io/dockereng/github-builder-test
meta-tags: |
type=raw,value=bake-ghbuilder-${{ github.run_id }}
secrets:
registry-auths: |
- registry: docker.io
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}

bake-dockerhub-verify:
uses: ./.github/workflows/verify.yml
if: ${{ github.event_name != 'pull_request' }}
needs:
- bake-dockerhub
with:
builder-outputs: ${{ toJSON(needs.bake-dockerhub.outputs) }}
secrets:
registry-auths: |
- registry: docker.io
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}

bake-dockerhub-outputs:
runs-on: ubuntu-24.04
needs:
- bake-dockerhub
steps:
-
name: Builder outputs
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
INPUT_BUILDER-OUTPUTS: ${{ toJSON(needs.bake-dockerhub.outputs) }}
with:
script: |
const builderOutputs = JSON.parse(core.getInput('builder-outputs'));
core.info(JSON.stringify(builderOutputs, null, 2));

bake-dockerhub-oidc:
uses: ./.github/workflows/bake.yml
if: ${{ github.event_name != 'pull_request' }}
permissions:
contents: read
id-token: write
with:
job-name-prefix: bake-dockerhub-oidc
context: test
output: image
push: true
sbom: true
set: |
*.args.VERSION={{meta.version}}
target: hello

@thaJeztah thaJeztah Aug 6, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What was this block for?

@crazy-max crazy-max Aug 6, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

GitHub diff is bad here. It's a duplicate where we had both OIDC auth and PAT auth so I removed the PAT auth basically.

registry-identities: |
- type: dockerhub
registry: docker.io
Expand All @@ -210,35 +160,34 @@ jobs:
meta-images: |
docker.io/dockereng/github-builder-test
meta-tags: |
type=raw,value=bake-ghbuilder-oidc-${{ github.run_id }}
type=raw,value=bake-ghbuilder-${{ github.run_id }}

bake-dockerhub-oidc-verify:
bake-dockerhub-verify:
uses: ./.github/workflows/verify.yml
if: ${{ github.event_name != 'pull_request' }}
needs:
- bake-dockerhub-oidc
- bake-dockerhub
permissions:
contents: read
id-token: write
with:
builder-outputs: ${{ toJSON(needs.bake-dockerhub-oidc.outputs) }}
builder-outputs: ${{ toJSON(needs.bake-dockerhub.outputs) }}
registry-identities: |
- type: dockerhub
registry: docker.io
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}

bake-dockerhub-oidc-outputs:
bake-dockerhub-outputs:
runs-on: ubuntu-24.04
if: ${{ github.event_name != 'pull_request' }}
needs:
- bake-dockerhub-oidc
- bake-dockerhub
steps:
-
name: Builder outputs
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
INPUT_BUILDER-OUTPUTS: ${{ toJSON(needs.bake-dockerhub-oidc.outputs) }}
INPUT_BUILDER-OUTPUTS: ${{ toJSON(needs.bake-dockerhub.outputs) }}
with:
script: |
const builderOutputs = JSON.parse(core.getInput('builder-outputs'));
Expand Down Expand Up @@ -272,15 +221,15 @@ jobs:
*.args.VERSION={{meta.version}}
sign: false
target: hello-cross
registry-identities: |
- type: dockerhub
registry: docker.io
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
meta-images: |
docker.io/dockereng/github-builder-test
meta-tags: |
type=raw,value=bake-ghbuilder-nosign-${{ github.run_id }}
secrets:
registry-auths: |
- registry: docker.io
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}

bake-dockerhub-nosign-verify:
uses: ./.github/workflows/verify.yml
Expand All @@ -289,11 +238,6 @@ jobs:
- bake-dockerhub-nosign
with:
builder-outputs: ${{ toJSON(needs.bake-dockerhub-nosign.outputs) }}
secrets:
registry-auths: |
- registry: docker.io
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}

bake-dockerhub-nosign-outputs:
runs-on: ubuntu-24.04
Expand Down Expand Up @@ -329,30 +273,37 @@ jobs:
docker.io/dockereng/github-builder-test
meta-tags: |
type=raw,value=${{ github.run_id }},prefix=bake-ghcr-and-dockerhub-
registry-identities: |
- type: dockerhub
registry: docker.io
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
secrets:
registry-auths: |
- registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- registry: docker.io
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}

bake-ghcr-and-dockerhub-verify:
uses: ./.github/workflows/verify.yml
if: ${{ github.event_name != 'pull_request' }}
needs:
- bake-ghcr-and-dockerhub
permissions:
contents: read
id-token: write

@thaJeztah thaJeztah Aug 6, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here (wrt comments)

with:
builder-outputs: ${{ toJSON(needs.bake-ghcr-and-dockerhub.outputs) }}
registry-identities: |
- type: dockerhub
registry: docker.io
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
secrets:
registry-auths: |
- registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- registry: docker.io
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}

bake-ghcr-and-dockerhub-outputs:
runs-on: ubuntu-24.04
Expand Down Expand Up @@ -526,7 +477,7 @@ jobs:
push: false
registry-identities: |
- type: dockerhub
username: dockereng
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
connection_id: ${{ vars.MISSING_DOCKERHUB_OIDC_CONNECTIONID }}
set: |
*.args.VERSION={{meta.version}}
Expand Down Expand Up @@ -583,15 +534,15 @@ jobs:
set: |
*.args.VERSION={{meta.version}}
target: hello-cross
registry-identities: |
- type: dockerhub
registry: docker.io
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
meta-images: |
docker.io/dockereng/github-builder-test
meta-tags: |
type=raw,value=bake-ghbuilder-nodistrib-${{ github.run_id }}
secrets:
registry-auths: |
- registry: docker.io
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}

bake-local-nodistrib:
uses: ./.github/workflows/bake.yml
Expand Down
Loading
Loading