ci: publish images to Docker Hub using OIDC - #13994
Conversation
Replace the long-lived DOCKERPUBLICBOT PAT with short-lived tokens minted through the Docker Hub OIDC connection, using the registry-identities input of the github-builder bake workflow. The connection rulesets cover both triggers of this workflow (refs/heads/main and refs/tags/v*) for compose-bin and compose-desktop-module. Signed-off-by: Guillaume Lours <glours@users.noreply.github.com>
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
This PR replaces long-lived Docker Hub PAT secrets (DOCKERPUBLICBOT_USERNAME / DOCKERPUBLICBOT_WRITE_PAT) with short-lived OIDC tokens via registry-identities. This is a clear security improvement — eliminating long-lived credentials reduces the blast radius of any future credential leak.
Both publish jobs (main-image and module-image) are updated consistently with the same connection_id, which is expected behavior for a shared OIDC connection. The workflow only triggers on merge/push to protected branches (not fork PRs), so the hardcoded connection_id is not a security risk.
No bugs or misconfigurations were found in the changed code.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
| registry-identities: | | ||
| - type: dockerhub | ||
| username: docker | ||
| connection_id: a295c8b7-54ab-4507-ac88-5c43003c73a5 |
There was a problem hiding this comment.
Silly question; will hard-coding it here cause it to always be non-empty, and forks attempting to use it (with a failure)?
(I'm guessing this workflow doesn't run on forks, so probably no difference; was just curious)
4 participants
What I did
Replace the long-lived DOCKERPUBLICBOT PAT with short-lived tokens minted through the Docker Hub OIDC connection, using the registry-identities input of the github-builder bake workflow.
The connection rulesets cover both triggers of this workflow (refs/heads/main and refs/tags/v*) for compose-bin and compose-desktop-module.
Related issue
N/A
(not mandatory) A picture of a cute animal, if possible in relation to what you did