Update OIDC connections to use single-step login-action flow - #25659
Update OIDC connections to use single-step login-action flow#25659gmondello wants to merge 1 commit into
Conversation
✅ Deploy Preview for docsdocker ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
7567b7f to
2360ec6
Compare
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟡 NEEDS ATTENTION
docker/login-action v4.5.0+ supports OIDC token exchange natively via the DOCKERHUB_OIDC_CONNECTIONID environment variable, eliminating the need for a separate docker/oidc-action step. - Replace two-step workflow (oidc-action + login-action) with single-step - Use GitHub Actions variables instead of raw placeholders - Add tip about docker/oidc-action for advanced token-output use cases - Update deactivation/deletion section to remove oidc-action references
2360ec6 to
e87ed7e
Compare
| jobs: | ||
| login: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - | ||
| name: Login to Docker Hub | ||
| uses: docker/login-action@{{% param "login_action_version" %}} | ||
| env: | ||
| DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} | ||
| with: | ||
| username: ${{ vars.DOCKERHUB_ORGANIZATION }} |
There was a problem hiding this comment.
@dotjoshrc Is docker-login action the default way we want to people to use OIDC?
|
|
||
| Add the OIDC connection ID and your Docker organization name as | ||
| [GitHub Actions variables](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/store-information-in-variables) | ||
| in your repository or organization settings. Then update your workflow: |
There was a problem hiding this comment.
Docker organization? GitHub repository? IDK what your take is but since both of us share these words, might want to risk some redundancy to specify which we mean. WYT @gmondello
| name: Login to Docker Hub | ||
| uses: docker/login-action@{{% param "login_action_version" %}} | ||
| env: | ||
| DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} |
There was a problem hiding this comment.
just to x2 confirm, meant to be an all caps variable?
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
The PR replaces the two-step OIDC flow (docker/oidc-action + docker/login-action) with the native single-step docker/login-action v4.5.0+ approach. The changes are accurate, well-scoped, and consistent with the style guide.
What was checked:
- ✅ Not vendored/generated content
- ✅ No page removal — no missing redirects needed
- ✅ Markdown formatting is valid
- ✅ No AI hedge words or marketing language detected
- ✅ Scope preserved — update matches existing document character
- ✅ Workflow YAML correctly uses
env:forDOCKERHUB_OIDC_CONNECTIONID(the action reads it from the environment, as designed per login-action PR #1048) - ✅
with: username:correctly set;passwordintentionally omitted for OIDC flow - ✅ Front matter keywords updated appropriately
- ✅ Callout syntax (
> [!TIP]) is correct
| username: ${{ vars.DOCKERHUB_ORGANIZATION }} | ||
| ``` | ||
|
|
||
| The `id-token: write` permission lets the workflow request a GitHub OIDC |
There was a problem hiding this comment.
This is a little dense to read as a full paragraph. We can either add this context next to the key/value pairs as code comments for in-line documentation, or maybe use unordered lists? It's fine as is just a little nit lol:
"
- The workflow requests a GitHub OIDC token with the
id-token: writepermission. - The
docker/login-actionhandles the OIDC token exchange and Docker login in a single step when DOCKERHUB_OIDC_CONNECTIONID is set and password is omitted. - The
username valuemust be an organization name. Personal accounts aren't supported.
"
| username: ${{ vars.DOCKERHUB_ORGANIZATION }} | ||
| ``` | ||
|
|
||
| The `id-token: write` permission lets the workflow request a GitHub OIDC |
There was a problem hiding this comment.
| The `id-token: write` permission lets the workflow request a GitHub OIDC | |
| The workflow requests a GitHub OIDC token with the `id-token: write` permission |
akristen
left a comment
akristen
left a comment
There was a problem hiding this comment.
Non-blocking, and happy to just fast follow with style guide stuff if you're fine with it. Will merge once @gurleensethi-docker gives the 👍
4 participants
Summary
docker/login-actionv4.5.0+ supports OIDC token exchange natively via theDOCKERHUB_OIDC_CONNECTIONIDenvironment variable, eliminating the need for a separatedocker/oidc-actionstep.Changes
docker/oidc-action+docker/login-action) with a single-stepdocker/login-actionflowdocker/oidc-actionfor advanced use cases where the token is needed as a separate outputdocker/oidc-actionreferencesContext
docker/login-actionOIDC support: Docker Hub OIDC login support login-action#1048