From 2e744b6849f14049ebd23a59f87bd5c4fefa9013 Mon Sep 17 00:00:00 2001 From: CrazyMax <1951866+crazy-max@users.noreply.github.com> Date: Wed, 5 Aug 2026 15:25:16 +0200 Subject: [PATCH] ci: use Docker Hub OIDC for packaging images Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com> --- .github/workflows/.build.yml | 10 ++++++---- .github/workflows/nightly.yml | 4 ++-- .github/workflows/release-agent.yml | 4 ++-- .github/workflows/release-buildx.yml | 4 ++-- .github/workflows/release-compose.yml | 4 ++-- .github/workflows/release-containerd.yml | 4 ++-- .github/workflows/release-credential-helpers.yml | 4 ++-- .github/workflows/release-docker.yml | 8 ++++---- .github/workflows/release-model.yml | 4 ++-- 9 files changed, 24 insertions(+), 22 deletions(-) diff --git a/.github/workflows/.build.yml b/.github/workflows/.build.yml index 4e4a2649..f3ad314c 100644 --- a/.github/workflows/.build.yml +++ b/.github/workflows/.build.yml @@ -19,13 +19,14 @@ on: dockerhub_username: required: false type: string + dockerhub_oidc_connectionid: + required: false + type: string secrets: rh_user: required: false rh_pass: required: false - dockerhub_token: - required: false env: REPO_SLUG: dockereng/packaging @@ -294,11 +295,12 @@ jobs: bake-target: meta-helper - name: Login to Docker Hub - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 if: ${{ inputs.release || github.event_name == 'schedule' }} + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + env: + DOCKERHUB_OIDC_CONNECTIONID: ${{ inputs.dockerhub_oidc_connectionid }} with: username: ${{ inputs.dockerhub_username }} - password: ${{ secrets.dockerhub_token }} - name: Build release id: build diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 442182ef..9c1126b8 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -33,8 +33,8 @@ jobs: release: pushonly vars: | NIGHTLY_BUILD=1 - dockerhub_username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} + dockerhub_username: docker + dockerhub_oidc_connectionid: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} secrets: rh_user: ${{ secrets.RH_USER }} rh_pass: ${{ secrets.RH_PASS }} - dockerhub_token: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} diff --git a/.github/workflows/release-agent.yml b/.github/workflows/release-agent.yml index dca4f194..5ee39491 100644 --- a/.github/workflows/release-agent.yml +++ b/.github/workflows/release-agent.yml @@ -56,8 +56,8 @@ jobs: PKG_REF=${{ inputs.ref }} PKG_DEB_REVISION=${{ inputs.revision }} PKG_RPM_RELEASE=${{ inputs.revision }} - dockerhub_username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} + dockerhub_username: docker + dockerhub_oidc_connectionid: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} secrets: rh_user: ${{ secrets.RH_USER }} rh_pass: ${{ secrets.RH_PASS }} - dockerhub_token: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} diff --git a/.github/workflows/release-buildx.yml b/.github/workflows/release-buildx.yml index b831e05d..46c37ac4 100644 --- a/.github/workflows/release-buildx.yml +++ b/.github/workflows/release-buildx.yml @@ -56,8 +56,8 @@ jobs: PKG_REF=${{ inputs.ref }} PKG_DEB_REVISION=${{ inputs.revision }} PKG_RPM_RELEASE=${{ inputs.revision }} - dockerhub_username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} + dockerhub_username: docker + dockerhub_oidc_connectionid: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} secrets: rh_user: ${{ secrets.RH_USER }} rh_pass: ${{ secrets.RH_PASS }} - dockerhub_token: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} diff --git a/.github/workflows/release-compose.yml b/.github/workflows/release-compose.yml index d65a9e78..644d4de3 100644 --- a/.github/workflows/release-compose.yml +++ b/.github/workflows/release-compose.yml @@ -56,8 +56,8 @@ jobs: PKG_REF=${{ inputs.ref }} PKG_DEB_REVISION=${{ inputs.revision }} PKG_RPM_RELEASE=${{ inputs.revision }} - dockerhub_username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} + dockerhub_username: docker + dockerhub_oidc_connectionid: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} secrets: rh_user: ${{ secrets.RH_USER }} rh_pass: ${{ secrets.RH_PASS }} - dockerhub_token: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} diff --git a/.github/workflows/release-containerd.yml b/.github/workflows/release-containerd.yml index 17467db9..8485c7cd 100644 --- a/.github/workflows/release-containerd.yml +++ b/.github/workflows/release-containerd.yml @@ -68,8 +68,8 @@ jobs: PKG_RPM_RELEASE=${{ inputs.revision }} RUNC_REF=${{ inputs.runc_ref }} GO_VERSION=${{ inputs.go_version }} - dockerhub_username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} + dockerhub_username: docker + dockerhub_oidc_connectionid: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} secrets: rh_user: ${{ secrets.RH_USER }} rh_pass: ${{ secrets.RH_PASS }} - dockerhub_token: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} diff --git a/.github/workflows/release-credential-helpers.yml b/.github/workflows/release-credential-helpers.yml index 2af54600..04592335 100644 --- a/.github/workflows/release-credential-helpers.yml +++ b/.github/workflows/release-credential-helpers.yml @@ -56,8 +56,8 @@ jobs: PKG_REF=${{ inputs.ref }} PKG_DEB_REVISION=${{ inputs.revision }} PKG_RPM_RELEASE=${{ inputs.revision }} - dockerhub_username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} + dockerhub_username: docker + dockerhub_oidc_connectionid: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} secrets: rh_user: ${{ secrets.RH_USER }} rh_pass: ${{ secrets.RH_PASS }} - dockerhub_token: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} diff --git a/.github/workflows/release-docker.yml b/.github/workflows/release-docker.yml index 007dadc9..7bc072eb 100644 --- a/.github/workflows/release-docker.yml +++ b/.github/workflows/release-docker.yml @@ -68,11 +68,11 @@ jobs: PKG_REF=${{ inputs.engine-ref }} PKG_DEB_REVISION=${{ inputs.revision }} PKG_RPM_RELEASE=${{ inputs.revision }} - dockerhub_username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} + dockerhub_username: docker + dockerhub_oidc_connectionid: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} secrets: rh_user: ${{ secrets.RH_USER }} rh_pass: ${{ secrets.RH_PASS }} - dockerhub_token: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} cli: uses: ./.github/workflows/.build.yml @@ -88,8 +88,8 @@ jobs: PKG_REF=${{ inputs.cli-ref }} PKG_DEB_REVISION=${{ inputs.revision }} PKG_RPM_RELEASE=${{ inputs.revision }} - dockerhub_username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} + dockerhub_username: docker + dockerhub_oidc_connectionid: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} secrets: rh_user: ${{ secrets.RH_USER }} rh_pass: ${{ secrets.RH_PASS }} - dockerhub_token: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }} diff --git a/.github/workflows/release-model.yml b/.github/workflows/release-model.yml index bec485ea..9a1f3f98 100644 --- a/.github/workflows/release-model.yml +++ b/.github/workflows/release-model.yml @@ -56,8 +56,8 @@ jobs: PKG_REF=${{ inputs.ref }} PKG_DEB_REVISION=${{ inputs.revision }} PKG_RPM_RELEASE=${{ inputs.revision }} - dockerhub_username: ${{ vars.DOCKERPUBLICBOT_USERNAME }} + dockerhub_username: docker + dockerhub_oidc_connectionid: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} secrets: rh_user: ${{ secrets.RH_USER }} rh_pass: ${{ secrets.RH_PASS }} - dockerhub_token: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}