Skip to content

Commit cf06f13

Browse files
crazy-maxcrazy-max
authored
Merge pull request #273 from docker/ci-oidc
ci: use Docker Hub OIDC for test jobs
2 parents a39c93c + c6f484b commit cf06f13

2 files changed

Lines changed: 88 additions & 185 deletions

File tree

‎.github/workflows/.test-bake.yml‎

Lines changed: 44 additions & 93 deletions
Original file line numberDiff line numberDiff line change
@@ -44,28 +44,31 @@ jobs:
4444
set: |
4545
*.args.VERSION={{meta.version}}
4646
target: hello
47+
registry-identities: |
48+
- type: dockerhub
49+
registry: docker.io
50+
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
51+
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
4752
meta-images: |
4853
docker.io/dockereng/github-builder-test
4954
meta-tags: |
5055
type=raw,value=bake-ghbuilder-single-${{ github.run_id }}
51-
secrets:
52-
registry-auths: |
53-
- registry: docker.io
54-
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
55-
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
5656
5757
bake-dockerhub-single-verify:
5858
uses: ./.github/workflows/verify.yml
5959
if: ${{ github.event_name != 'pull_request' }}
6060
needs:
6161
- bake-dockerhub-single
62+
permissions:
63+
contents: read
64+
id-token: write
6265
with:
6366
builder-outputs: ${{ toJSON(needs.bake-dockerhub-single.outputs) }}
64-
secrets:
65-
registry-auths: |
66-
- registry: docker.io
67-
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
68-
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
67+
registry-identities: |
68+
- type: dockerhub
69+
registry: docker.io
70+
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
71+
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
6972
7073
bake-dockerhub-single-outputs:
7174
runs-on: ubuntu-24.04
@@ -149,59 +152,6 @@ jobs:
149152
set: |
150153
*.args.VERSION={{meta.version}}
151154
target: hello-cross
152-
meta-images: |
153-
docker.io/dockereng/github-builder-test
154-
meta-tags: |
155-
type=raw,value=bake-ghbuilder-${{ github.run_id }}
156-
secrets:
157-
registry-auths: |
158-
- registry: docker.io
159-
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
160-
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
161-
162-
bake-dockerhub-verify:
163-
uses: ./.github/workflows/verify.yml
164-
if: ${{ github.event_name != 'pull_request' }}
165-
needs:
166-
- bake-dockerhub
167-
with:
168-
builder-outputs: ${{ toJSON(needs.bake-dockerhub.outputs) }}
169-
secrets:
170-
registry-auths: |
171-
- registry: docker.io
172-
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
173-
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
174-
175-
bake-dockerhub-outputs:
176-
runs-on: ubuntu-24.04
177-
needs:
178-
- bake-dockerhub
179-
steps:
180-
-
181-
name: Builder outputs
182-
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
183-
env:
184-
INPUT_BUILDER-OUTPUTS: ${{ toJSON(needs.bake-dockerhub.outputs) }}
185-
with:
186-
script: |
187-
const builderOutputs = JSON.parse(core.getInput('builder-outputs'));
188-
core.info(JSON.stringify(builderOutputs, null, 2));
189-
190-
bake-dockerhub-oidc:
191-
uses: ./.github/workflows/bake.yml
192-
if: ${{ github.event_name != 'pull_request' }}
193-
permissions:
194-
contents: read
195-
id-token: write
196-
with:
197-
job-name-prefix: bake-dockerhub-oidc
198-
context: test
199-
output: image
200-
push: true
201-
sbom: true
202-
set: |
203-
*.args.VERSION={{meta.version}}
204-
target: hello
205155
registry-identities: |
206156
- type: dockerhub
207157
registry: docker.io
@@ -210,35 +160,34 @@ jobs:
210160
meta-images: |
211161
docker.io/dockereng/github-builder-test
212162
meta-tags: |
213-
type=raw,value=bake-ghbuilder-oidc-${{ github.run_id }}
163+
type=raw,value=bake-ghbuilder-${{ github.run_id }}
214164
215-
bake-dockerhub-oidc-verify:
165+
bake-dockerhub-verify:
216166
uses: ./.github/workflows/verify.yml
217167
if: ${{ github.event_name != 'pull_request' }}
218168
needs:
219-
- bake-dockerhub-oidc
169+
- bake-dockerhub
220170
permissions:
221171
contents: read
222172
id-token: write
223173
with:
224-
builder-outputs: ${{ toJSON(needs.bake-dockerhub-oidc.outputs) }}
174+
builder-outputs: ${{ toJSON(needs.bake-dockerhub.outputs) }}
225175
registry-identities: |
226176
- type: dockerhub
227177
registry: docker.io
228178
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
229179
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
230180
231-
bake-dockerhub-oidc-outputs:
181+
bake-dockerhub-outputs:
232182
runs-on: ubuntu-24.04
233-
if: ${{ github.event_name != 'pull_request' }}
234183
needs:
235-
- bake-dockerhub-oidc
184+
- bake-dockerhub
236185
steps:
237186
-
238187
name: Builder outputs
239188
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
240189
env:
241-
INPUT_BUILDER-OUTPUTS: ${{ toJSON(needs.bake-dockerhub-oidc.outputs) }}
190+
INPUT_BUILDER-OUTPUTS: ${{ toJSON(needs.bake-dockerhub.outputs) }}
242191
with:
243192
script: |
244193
const builderOutputs = JSON.parse(core.getInput('builder-outputs'));
@@ -272,15 +221,15 @@ jobs:
272221
*.args.VERSION={{meta.version}}
273222
sign: false
274223
target: hello-cross
224+
registry-identities: |
225+
- type: dockerhub
226+
registry: docker.io
227+
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
228+
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
275229
meta-images: |
276230
docker.io/dockereng/github-builder-test
277231
meta-tags: |
278232
type=raw,value=bake-ghbuilder-nosign-${{ github.run_id }}
279-
secrets:
280-
registry-auths: |
281-
- registry: docker.io
282-
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
283-
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
284233
285234
bake-dockerhub-nosign-verify:
286235
uses: ./.github/workflows/verify.yml
@@ -289,11 +238,6 @@ jobs:
289238
- bake-dockerhub-nosign
290239
with:
291240
builder-outputs: ${{ toJSON(needs.bake-dockerhub-nosign.outputs) }}
292-
secrets:
293-
registry-auths: |
294-
- registry: docker.io
295-
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
296-
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
297241

298242
bake-dockerhub-nosign-outputs:
299243
runs-on: ubuntu-24.04
@@ -329,30 +273,37 @@ jobs:
329273
docker.io/dockereng/github-builder-test
330274
meta-tags: |
331275
type=raw,value=${{ github.run_id }},prefix=bake-ghcr-and-dockerhub-
276+
registry-identities: |
277+
- type: dockerhub
278+
registry: docker.io
279+
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
280+
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
332281
secrets:
333282
registry-auths: |
334283
- registry: ghcr.io
335284
username: ${{ github.actor }}
336285
password: ${{ secrets.GITHUB_TOKEN }}
337-
- registry: docker.io
338-
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
339-
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
340286
341287
bake-ghcr-and-dockerhub-verify:
342288
uses: ./.github/workflows/verify.yml
343289
if: ${{ github.event_name != 'pull_request' }}
344290
needs:
345291
- bake-ghcr-and-dockerhub
292+
permissions:
293+
contents: read
294+
id-token: write
346295
with:
347296
builder-outputs: ${{ toJSON(needs.bake-ghcr-and-dockerhub.outputs) }}
297+
registry-identities: |
298+
- type: dockerhub
299+
registry: docker.io
300+
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
301+
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
348302
secrets:
349303
registry-auths: |
350304
- registry: ghcr.io
351305
username: ${{ github.actor }}
352306
password: ${{ secrets.GITHUB_TOKEN }}
353-
- registry: docker.io
354-
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
355-
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
356307
357308
bake-ghcr-and-dockerhub-outputs:
358309
runs-on: ubuntu-24.04
@@ -526,7 +477,7 @@ jobs:
526477
push: false
527478
registry-identities: |
528479
- type: dockerhub
529-
username: dockereng
480+
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
530481
connection_id: ${{ vars.MISSING_DOCKERHUB_OIDC_CONNECTIONID }}
531482
set: |
532483
*.args.VERSION={{meta.version}}
@@ -583,15 +534,15 @@ jobs:
583534
set: |
584535
*.args.VERSION={{meta.version}}
585536
target: hello-cross
537+
registry-identities: |
538+
- type: dockerhub
539+
registry: docker.io
540+
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
541+
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
586542
meta-images: |
587543
docker.io/dockereng/github-builder-test
588544
meta-tags: |
589545
type=raw,value=bake-ghbuilder-nodistrib-${{ github.run_id }}
590-
secrets:
591-
registry-auths: |
592-
- registry: docker.io
593-
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
594-
password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
595546
596547
bake-local-nodistrib:
597548
uses: ./.github/workflows/bake.yml

0 commit comments

Comments
 (0)