From ffd507e44834a5781bf42f114e3908f4f428d9f1 Mon Sep 17 00:00:00 2001 From: Karol Lassak Date: Fri, 7 Aug 2026 16:54:25 +0200 Subject: [PATCH 1/2] ci: switch dockerhub login to OIDC --- .github/workflows/build.yml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 884ae8e..022bc86 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -52,6 +52,9 @@ jobs: docker: runs-on: ubuntu-latest + permissions: + contents: read + id-token: write steps: - uses: actions/checkout@v2 with: @@ -60,12 +63,21 @@ jobs: with: name: pkg-linux-amd64 - run: chmod a+x pkg-linux-amd64 + - name: OIDC token + id: docker_oidc + uses: docker/oidc-action@96ba694c64860c7209bcd1ede7d698c71564ef78 # v1.2.0 + with: + connection-id: "24b78b4d-ffde-4850-a999-76d7bbaf3214" + expires-in: 1800 + - name: Docker login + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + with: + username: kentik + password: ${{ steps.docker_oidc.outputs.token }} - uses: docker/build-push-action@v1 with: repository: ${{ github.repository }} tag_with_ref: true - username: ${{ secrets.DOCKER_HUB_USERNAME }} - password: ${{ secrets.DOCKER_HUB_PASSWORD }} env: DOCKER_BUILDKIT: 1 needs: build From cec9c34ada9176620fded5d3f0dc1be4303b00dc Mon Sep 17 00:00:00 2001 From: Karol Lassak Date: Fri, 7 Aug 2026 18:48:33 +0200 Subject: [PATCH 2/2] ci: use vars.DOCKER_OIDC_CONNECTION_ID for OIDC connection-id --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 022bc86..db06a0f 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -67,7 +67,7 @@ jobs: id: docker_oidc uses: docker/oidc-action@96ba694c64860c7209bcd1ede7d698c71564ef78 # v1.2.0 with: - connection-id: "24b78b4d-ffde-4850-a999-76d7bbaf3214" + connection-id: ${{ vars.DOCKER_OIDC_CONNECTION_ID }} expires-in: 1800 - name: Docker login uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0