Merge pull request #1037 from docker/dependabot/npm_and_yarn/aws-sdk-dependencies-001763bcc2

build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 updates

.eslintignore

@@ -1,3 +0,0 @@
-/dist/**
-/coverage/**
-/node_modules/**

.eslintrc.json

@@ -1,24 +0,0 @@
-{
-  "env": {
-    "node": true,
-    "es6": true,
-    "jest": true
-  },
-  "extends": [
-    "eslint:recommended",
-    "plugin:@typescript-eslint/eslint-recommended",
-    "plugin:@typescript-eslint/recommended",
-    "plugin:jest/recommended",
-    "plugin:prettier/recommended"
-  ],
-  "parser": "@typescript-eslint/parser",
-  "parserOptions": {
-    "ecmaVersion": "latest",
-    "sourceType": "module"
-  },
-  "plugins": [
-    "@typescript-eslint",
-    "jest",
-    "prettier"
-  ]
-}

.github/dependabot.yml

@@ -4,6 +4,15 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 2
+    groups:
+      crazy-max-dot-github:
+        patterns:
+          - "crazy-max/.github/*"
+      codeql-actions:
+        patterns:
+          - "github/codeql-action/*"
     labels:
       - "dependencies"
       - "bot"
@@ -11,6 +20,10 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 2
+      exclude:
+        - "@docker/actions-toolkit"
     versioning-strategy: "increase"
     groups:
       aws-sdk-dependencies:

.github/workflows/ci.yml

@@ -1,9 +1,15 @@
 name: ci
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  GHCR_TEST_IMAGE: ghcr.io/docker/login-action-test:ci-${{ github.sha }}
+
 on:
   workflow_dispatch:
   schedule:
@@ -19,7 +25,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Stop docker
         run: |
@@ -43,7 +49,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to GitHub Container Registry
         uses: ./
@@ -53,44 +59,75 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
           logout: ${{ matrix.logout }}
 
-  dind:
+  push-ghcr:
     runs-on: ubuntu-latest
-    env:
+    permissions:
-      DOCKER_CONFIG: $HOME/.docker
+      contents: read
+      packages: write
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to GitHub Container Registry
         uses: ./
         with:
           registry: ghcr.io
-          username: ${{ secrets.GHCR_USERNAME }}
+          username: ${{ github.actor }}
-          password: ${{ secrets.GHCR_PAT }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      -
+        name: Build and push test image
+        run: |
+          docker buildx build --push -t "${GHCR_TEST_IMAGE}" - <<EOF
+          FROM scratch
+          LABEL org.opencontainers.image.title="docker/login-action CI test image"
+          LABEL org.opencontainers.image.description="Empty image used by CI to verify GHCR authentication."
+          LABEL org.opencontainers.image.source="https://github.com/${GITHUB_REPOSITORY}"
+          EOF
+
+  dind:
+    runs-on: ubuntu-latest
+    needs:
+      - push-ghcr
+    permissions:
+      contents: read
+      packages: read
+    env:
+      DOCKER_CONFIG: $HOME/.docker
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      -
+        name: Login to GitHub Container Registry
+        uses: ./
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       -
         name: DinD
-        uses: docker://docker
+        uses: docker://docker:29.3@sha256:4d90f1f6c400315c2dba96d3ec93c01e64198395cbba04f79d12adce4f737029
         with:
           entrypoint: docker
-          args: pull ghcr.io/docker-ghactiontest/test
+          args: pull ${{ env.GHCR_TEST_IMAGE }}
       -
-        name: Pull private image
+        name: Pull test image
         run: |
           docker image prune -a -f >/dev/null 2>&1
-          docker pull ghcr.io/docker-ghactiontest/test
+          docker pull "${GHCR_TEST_IMAGE}"
 
   acr:
     runs-on: ubuntu-latest
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to ACR
         uses: ./
         with:
-          registry: ${{ secrets.AZURE_REGISTRY_NAME }}.azurecr.io
+          registry: officialgithubactions.azurecr.io
           username: ${{ secrets.AZURE_CLIENT_ID }}
           password: ${{ secrets.AZURE_CLIENT_SECRET }}
 
@@ -105,13 +142,36 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to Docker Hub
         uses: ./
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
+
+  dockerhub-oidc:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - windows-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      -
+        name: Login to Docker Hub with OIDC
+        uses: ./
+        env:
+          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
+        with:
+          username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
 
   ecr:
     runs-on: ${{ matrix.os }}
@@ -124,12 +184,12 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to ECR
         uses: ./
         with:
-          registry: ${{ secrets.AWS_ACCOUNT_NUMBER }}.dkr.ecr.us-east-1.amazonaws.com
+          registry: 175142243308.dkr.ecr.us-east-1.amazonaws.com
           username: ${{ secrets.AWS_ACCESS_KEY_ID }}
           password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
 
@@ -144,10 +204,10 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v5
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -156,7 +216,34 @@ jobs:
         name: Login to ECR
         uses: ./
         with:
-          registry: ${{ secrets.AWS_ACCOUNT_NUMBER }}.dkr.ecr.us-east-1.amazonaws.com
+          registry: 175142243308.dkr.ecr.us-east-1.amazonaws.com
+
+  ecr-oidc:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - windows-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      -
+        name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+        with:
+          role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd_login_action
+          aws-region: us-east-1
+      -
+        name: Login to ECR
+        uses: ./
+        with:
+          registry: 175142243308.dkr.ecr.us-east-1.amazonaws.com
 
   ecr-public:
     runs-on: ${{ matrix.os }}
@@ -169,7 +256,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to Public ECR
         continue-on-error: ${{ matrix.os == 'windows-latest' }}
@@ -192,10 +279,10 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v5
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -207,6 +294,34 @@ jobs:
         with:
           registry: public.ecr.aws
 
+  ecr-public-oidc:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - windows-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      -
+        name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+        with:
+          role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd_login_action
+          aws-region: us-east-1
+      -
+        name: Login to Public ECR
+        continue-on-error: ${{ matrix.os == 'windows-latest' }}
+        uses: ./
+        with:
+          registry: public.ecr.aws
+
   ghcr:
     runs-on: ${{ matrix.os }}
     strategy:
@@ -218,7 +333,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to GitHub Container Registry
         uses: ./
@@ -238,7 +353,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to GitLab
         uses: ./
@@ -258,12 +373,12 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to Google Artifact Registry
         uses: ./
         with:
-          registry: ${{ secrets.GAR_LOCATION }}-docker.pkg.dev
+          registry: us-east4-docker.pkg.dev
           username: _json_key
           password: ${{ secrets.GAR_JSON_KEY }}
 
@@ -278,7 +393,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to Google Container Registry
         uses: ./
@@ -292,14 +407,14 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to registries
         uses: ./
         with:
           registry-auth: |
-            - username: ${{ secrets.DOCKERHUB_USERNAME }}
+            - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
-              password: ${{ secrets.DOCKERHUB_TOKEN }}
+              password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
             - registry: ghcr.io
               username: ${{ github.actor }}
               password: ${{ secrets.GITHUB_TOKEN }}
@@ -315,7 +430,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to registries
         uses: ./
@@ -336,7 +451,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to registries
         id: login
@@ -347,8 +462,8 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
           registry-auth: |
-            - username: ${{ secrets.DOCKERHUB_USERNAME }}
+            - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
-              password: ${{ secrets.DOCKERHUB_TOKEN }}
+              password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
       -
         name: Check
         run: |
@@ -368,13 +483,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to Docker Hub
         uses: ./
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
           scope: '@push'
       -
         name: Print config.json files
@@ -398,13 +513,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to Docker Hub
         uses: ./
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
           scope: 'docker/buildx-bin@push'
       -
         name: Print config.json files
@@ -428,7 +543,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to GitHub Container Registry
         uses: ./
@@ -459,7 +574,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to GitHub Container Registry
         uses: ./

.github/workflows/codeql.yml

@@ -1,50 +1,46 @@
 name: codeql
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
       - 'master'
       - 'releases/v*'
-    paths:
-      - '.github/workflows/codeql.yml'
-      - 'dist/**'
-      - 'src/**'
   pull_request:
-    paths:
-      - '.github/workflows/codeql.yml'
-      - 'dist/**'
-      - 'src/**'
 
-permissions:
+env:
-  actions: read
+  NODE_VERSION: "24"
-  contents: read
-  security-events: write
 
 jobs:
   analyze:
     runs-on: ubuntu-latest
-    strategy:
+    permissions:
-      fail-fast: false
+      contents: read
-      matrix:
+      security-events: write
-        language:
-          - javascript-typescript
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      -
+        name: Enable corepack
+        run: |
+          corepack enable
+          yarn --version
+      -
+        name: Set up Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
       -
         name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
         with:
-          languages: ${{ matrix.language }}
+          languages: javascript-typescript
-          config: |
+          build-mode: none
-            paths:
-              - src
-      -
-        name: Autobuild
-        uses: github/codeql-action/autobuild@v4
       -
         name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
         with:
-          category: "/language:${{matrix.language}}"
+          category: "/language:javascript-typescript"

.github/workflows/pr-assign-author.yml

@@ -4,14 +4,14 @@ permissions:
   contents: read
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] safe to use without checkout
     types:
       - opened
       - reopened
 
 jobs:
   run:
-    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@1b673f36fad86812f538c1df9794904038a23cbf
+    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@46267a6e61cd56aac2fc79943df180152f4c89d6 # v1.10.1
     permissions:
       contents: read
       pull-requests: write

.github/workflows/publish.yml

@@ -1,5 +1,12 @@
 name: publish
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   release:
     types:
@@ -15,7 +22,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Publish
-        uses: actions/publish-immutable-action@v0.0.4
+        uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4

.github/workflows/test.yml

@@ -1,5 +1,8 @@
 name: test
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -17,16 +20,16 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Test
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
         with:
           source: .
           targets: test
       -
         name: Upload coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: ./coverage/clover.xml
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/update-dist.yml

@@ -0,0 +1,58 @@
+name: update-dist
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+
+jobs:
+  update-dist:
+    if: github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: GitHub auth token from GitHub App
+        id: docker-read-app
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.GHACTIONS_REPO_WRITE_APP_ID }}
+          private-key: ${{ secrets.GHACTIONS_REPO_WRITE_APP_PRIVATE_KEY }}
+          owner: docker
+          repositories: login-action
+          permission-contents: write
+      -
+        name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          fetch-depth: 0
+          token: ${{ steps.docker-read-app.outputs.token }}
+      -
+        name: Build
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        with:
+          source: .
+          targets: build
+      -
+        name: Commit and push dist
+        run: |
+          if [ -n "$(git status --porcelain -- dist)" ]; then
+            (
+              set -x
+              git config user.name "github-actions[bot]"
+              git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+              git add dist
+              git commit -m "[dependabot skip] chore: update generated content"
+              git push
+            )
+          else
+            echo "No changes in dist"
+          fi

.github/workflows/validate.yml

@@ -1,5 +1,8 @@
 name: validate
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -15,15 +18,15 @@ jobs:
   prepare:
     runs-on: ubuntu-latest
     outputs:
-      targets: ${{ steps.generate.outputs.targets }}
+      matrix: ${{ steps.generate.outputs.matrix }}
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
-        name: List targets
+        name: Generate matrix
         id: generate
-        uses: docker/bake-action/subaction/list-targets@v6
+        uses: docker/bake-action/subaction/matrix@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
         with:
           target: validate
 
@@ -34,10 +37,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: ${{ fromJson(needs.prepare.outputs.targets) }}
+        include: ${{ fromJson(needs.prepare.outputs.matrix) }}
     steps:
       -
         name: Validate
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
         with:
           targets: ${{ matrix.target }}

.github/workflows/zizmor.yml

@@ -0,0 +1,29 @@
+name: zizmor
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - 'master'
+      - 'releases/v*'
+    tags:
+      - 'v*'
+  pull_request:
+
+jobs:
+  zizmor:
+    uses: crazy-max/.github/.github/workflows/zizmor.yml@46267a6e61cd56aac2fc79943df180152f4c89d6 # v1.10.1
+    permissions:
+      contents: read
+      security-events: write
+    with:
+      min-severity: medium
+      min-confidence: medium
+      persona: pedantic

.prettierrc.json

@@ -6,6 +6,5 @@
   "singleQuote": true,
   "trailingComma": "none",
   "bracketSpacing": false,
-  "arrowParens": "avoid",
+  "arrowParens": "avoid"
-  "parser": "typescript"
 }

.yarnrc.yml

@@ -1,10 +1,10 @@
 # https://yarnpkg.com/configuration/yarnrc
 
-compressionLevel: mixed
+nodeLinker: node-modules
-enableGlobalCache: false
-enableHardenedMode: true
 
 logFilters:
+  - code: YN0004
+    level: discard
   - code: YN0013
     level: discard
   - code: YN0019
@@ -14,4 +14,11 @@ logFilters:
   - code: YN0086
     level: discard
 
-nodeLinker: node-modules
+npmPreapprovedPackages:
+  - "@docker/actions-toolkit"
+
+compressionLevel: mixed
+enableGlobalCache: false
+enableHardenedMode: true
+enableScripts: false
+npmMinimalAgeGate: 2d

README.md

@@ -28,6 +28,7 @@ ___
   * [Set scopes for the authentication token](#set-scopes-for-the-authentication-token)
 * [Customizing](#customizing)
   * [inputs](#inputs)
+  * [environment variables](#environment-variables)
 * [Contributing](#contributing)
 
 ## Usage
@@ -51,12 +52,42 @@ jobs:
     steps:
       -
         name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 ```
 
+You can also [authenticate to Docker Hub with OpenID Connect](https://docs.docker.com/enterprise/security/oidc-connections/)
+when your Docker Hub organization has an OIDC connection configured. The
+workflow must grant the `id-token: write` permission, pass the Docker Hub
+organization name as `username`, omit `password`, and set the OIDC connection
+ID in `DOCKERHUB_OIDC_CONNECTIONID` environment variable.
+
+```yaml
+name: ci
+
+on:
+  push:
+    branches: main
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  login:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Login to Docker Hub
+        uses: docker/login-action@v4
+        env:
+          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
+        with:
+          username: ${{ vars.DOCKERHUB_ORGANIZATION }}
+```
+
 ### GitHub Container Registry
 
 To authenticate to the [GitHub Container Registry](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry),
@@ -76,7 +107,7 @@ jobs:
     steps:
       -
         name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -104,7 +135,7 @@ jobs:
     steps:
       -
         name: Login to GitLab
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: registry.gitlab.com
           username: ${{ vars.GITLAB_USERNAME }}
@@ -117,6 +148,8 @@ instead of a password.
 
 ### Azure Container Registry (ACR)
 
+#### Service principal
+
 [Create a service principal](https://docs.microsoft.com/en-us/azure/container-registry/container-registry-auth-service-principal#create-a-service-principal)
 with access to your container registry through the [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli)
 and take note of the generated service principal's ID (also called _client ID_)
@@ -135,17 +168,67 @@ jobs:
     steps:
       -
         name: Login to ACR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: <registry-name>.azurecr.io
           username: ${{ vars.AZURE_CLIENT_ID }}
           password: ${{ secrets.AZURE_CLIENT_SECRET }}
 ```
 
+> [!NOTE]
+> Replace `<registry-name>` with the name of your registry.
+
+#### OpenID Connect (OIDC)
+
+To authenticate with OpenID Connect, configure a federated identity credential
+for GitHub Actions and use the [Azure Login](https://github.com/Azure/login)
+action to sign in to Azure. Then expose an ACR access token and pass it to this
+action as the password.
+
+```yaml
+name: ci
+
+on:
+  push:
+    branches: main
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  login:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Login to Azure
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+      -
+        name: Get ACR access token
+        id: acr-token
+        run: |
+          ACR_TOKEN=$(az acr login --name <registry-name> --expose-token --output tsv --query accessToken)
+          echo "::add-mask::$ACR_TOKEN" # mask the token in workflow logs
+          echo "token=$ACR_TOKEN" >> "$GITHUB_OUTPUT"
+      -
+        name: Login to ACR
+        uses: docker/login-action@v4
+        with:
+          registry: <registry-name>.azurecr.io
+          username: 00000000-0000-0000-0000-000000000000
+          password: ${{ steps.acr-token.outputs.token }}
+```
+
+> [!NOTE]
 > Replace `<registry-name>` with the name of your registry.
 
 ### Google Container Registry (GCR)
 
+> [!NOTE]
 > [Google Artifact Registry](#google-artifact-registry-gar) is the evolution of
 > Google Container Registry. As a fully-managed service with support for both
 > container images and non-container artifacts. If you currently use Google
@@ -176,23 +259,24 @@ jobs:
     -
       name: Authenticate to Google Cloud
       id: auth
-      uses: google-github-actions/auth@v1
+      uses: google-github-actions/auth@v3
       with:
         token_format: access_token
         workload_identity_provider: <workload_identity_provider>
         service_account: <service_account>
     -
       name: Login to GCR
-      uses: docker/login-action@v3
+      uses: docker/login-action@v4
       with:
         registry: gcr.io
         username: oauth2accesstoken
         password: ${{ steps.auth.outputs.access_token }}
 ```
 
+> [!NOTE]
 > Replace `<workload_identity_provider>` with configured workload identity
 > provider. For steps to configure, [see here](https://github.com/google-github-actions/auth#setting-up-workload-identity-federation).
-
+>
 > Replace `<service_account>` with configured service account in workload
 > identity provider which has access to push to GCR
 
@@ -216,7 +300,7 @@ jobs:
     steps:
       -
         name: Login to GCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: gcr.io
           username: _json_key
@@ -247,26 +331,27 @@ jobs:
       -
         name: Authenticate to Google Cloud
         id: auth
-        uses: google-github-actions/auth@v1
+        uses: google-github-actions/auth@v3
         with:
           token_format: access_token
           workload_identity_provider: <workload_identity_provider>
           service_account: <service_account>
       -
         name: Login to GAR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: <location>-docker.pkg.dev
           username: oauth2accesstoken
           password: ${{ steps.auth.outputs.access_token }}
 ```
 
+> [!NOTE]
 > Replace `<workload_identity_provider>` with configured workload identity
 > provider
-
+>
 > Replace `<service_account>` with configured service account in workload
 > identity provider which has access to push to GCR
-
+>
 > Replace `<location>` with the regional or multi-regional [location](https://cloud.google.com/artifact-registry/docs/repo-organize#locations)
 > of the repository where the image is stored.
 
@@ -291,13 +376,14 @@ jobs:
     steps:
       -
         name: Login to GAR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: <location>-docker.pkg.dev
           username: _json_key
           password: ${{ secrets.GAR_JSON_KEY }}
 ```
 
+> [!NOTE]
 > Replace `<location>` with the regional or multi-regional [location](https://cloud.google.com/artifact-registry/docs/repo-organize#locations)
 > of the repository where the image is stored.
 
@@ -320,7 +406,7 @@ jobs:
     steps:
       -
         name: Login to ECR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: <aws-account-number>.dkr.ecr.<region>.amazonaws.com
           username: ${{ vars.AWS_ACCESS_KEY_ID }}
@@ -343,7 +429,7 @@ jobs:
     steps:
       -
         name: Login to ECR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: <aws-account-number>.dkr.ecr.<region>.amazonaws.com
           username: ${{ vars.AWS_ACCESS_KEY_ID }}
@@ -352,6 +438,7 @@ jobs:
           AWS_ACCOUNT_IDS: 012345678910,023456789012
 ```
 
+> [!NOTE]
 > Only available with [AWS CLI version 1](https://docs.aws.amazon.com/cli/latest/reference/ecr/get-login.html)
 
 You can also use the [Configure AWS Credentials](https://github.com/aws-actions/configure-aws-credentials)
@@ -370,18 +457,19 @@ jobs:
     steps:
       -
         name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-access-key-id: ${{ vars.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: <region>
       -
         name: Login to ECR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: <aws-account-number>.dkr.ecr.<region>.amazonaws.com
 ```
 
+> [!NOTE]
 > Replace `<aws-account-number>` and `<region>` with their respective values.
 
 ### AWS Public Elastic Container Registry (ECR)
@@ -404,7 +492,7 @@ jobs:
     steps:
       -
         name: Login to Public ECR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: public.ecr.aws
           username: ${{ vars.AWS_ACCESS_KEY_ID }}
@@ -413,6 +501,7 @@ jobs:
           AWS_REGION: <region>
 ```
 
+> [!NOTE]
 > Replace `<region>` with its respective value (default `us-east-1`).
 
 ### OCI Oracle Cloud Infrastructure Registry (OCIR)
@@ -438,13 +527,14 @@ jobs:
     steps:
       -
         name: Login to OCIR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: <region>.ocir.io
           username: ${{ vars.OCI_USERNAME }}
           password: ${{ secrets.OCI_TOKEN }}
 ```
 
+> [!NOTE]
 > Replace `<region>` with their respective values from [availability regions](https://docs.cloud.oracle.com/iaas/Content/Registry/Concepts/registryprerequisites.htm#Availab)
 
 ### Quay.io
@@ -465,7 +555,7 @@ jobs:
     steps:
       -
         name: Login to Quay.io
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: quay.io
           username: ${{ vars.QUAY_USERNAME }}
@@ -489,7 +579,7 @@ jobs:
     steps:
       -
         name: Login to DigitalOcean Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: registry.digitalocean.com
           username: ${{ vars.DIGITALOCEAN_USERNAME }}
@@ -514,13 +604,13 @@ jobs:
     steps:
       -
         name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       -
         name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -548,7 +638,7 @@ jobs:
     steps:
       -
         name: Login to registries
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry-auth: |
             - username: ${{ vars.DOCKERHUB_USERNAME }}
@@ -596,14 +686,14 @@ jobs:
     steps:
       -
         name: Login to Docker Hub (scoped)
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
           scope: 'myorg/myimage@push'
       -
         name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           push: true
           tags: myorg/myimage:latest
@@ -631,6 +721,15 @@ The following inputs can be used as `step.with` keys:
 > [!NOTE]
 > The `registry-auth` input cannot be used with other inputs except `logout`.
 
+### environment variables
+
+The following environment variables can be set as `step.env` keys:
+
+| Name                          | Type   | Default | Description                                                                 |
+|-------------------------------|--------|---------|-----------------------------------------------------------------------------|
+| `DOCKERHUB_OIDC_CONNECTIONID` | String |         | Docker Hub OIDC connection ID. Required for Docker Hub OIDC login           |
+| `DOCKERHUB_OIDC_EXPIREIN`     | Number | `300`   | Docker Hub OIDC token lifetime in seconds. Must be between `300` and `3600` |
+
 ## Contributing
 
 Want to contribute? Awesome! You can find information about contributing to

__tests__/aws.test.ts

@@ -1,7 +1,7 @@
-import {beforeEach, describe, expect, jest, test} from '@jest/globals';
+import {beforeEach, describe, expect, test, vi} from 'vitest';
 import {AuthorizationData} from '@aws-sdk/client-ecr';
 
-import * as aws from '../src/aws';
+import * as aws from '../src/aws.js';
 
 describe('isECR', () => {
   test.each([
@@ -65,26 +65,28 @@ describe('getAccountIDs', () => {
   });
 });
 
-const mockEcrGetAuthToken = jest.fn();
+const mockEcrGetAuthToken = vi.fn();
-const mockEcrPublicGetAuthToken = jest.fn();
+const mockEcrPublicGetAuthToken = vi.fn();
-jest.mock('@aws-sdk/client-ecr', () => {
+vi.mock('@aws-sdk/client-ecr', () => {
+  class ECR {
+    getAuthorizationToken = mockEcrGetAuthToken;
+  }
   return {
-    ECR: jest.fn(() => ({
+    ECR
-      getAuthorizationToken: mockEcrGetAuthToken
-    }))
   };
 });
-jest.mock('@aws-sdk/client-ecr-public', () => {
+vi.mock('@aws-sdk/client-ecr-public', () => {
+  class ECRPUBLIC {
+    getAuthorizationToken = mockEcrPublicGetAuthToken;
+  }
   return {
-    ECRPUBLIC: jest.fn(() => ({
+    ECRPUBLIC
-      getAuthorizationToken: mockEcrPublicGetAuthToken
-    }))
   };
 });
 
 describe('getRegistriesData', () => {
   beforeEach(() => {
-    jest.clearAllMocks();
+    vi.clearAllMocks();
     delete process.env.AWS_ACCOUNT_IDS;
   });
   // prettier-ignore

__tests__/context.test.ts

@@ -1,6 +1,18 @@
-import {expect, test} from '@jest/globals';
+import {afterEach, expect, test, vi} from 'vitest';
+import * as path from 'path';
 
-import {getInputs} from '../src/context';
+import {Buildx} from '@docker/actions-toolkit/lib/buildx/buildx.js';
+
+import {getAuthList, getInputs} from '../src/context.js';
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  for (const key of Object.keys(process.env)) {
+    if (key.startsWith('INPUT_')) {
+      delete process.env[key];
+    }
+  }
+});
 
 test('with password and username getInputs does not throw error', async () => {
   process.env['INPUT_USERNAME'] = 'dbowie';
@@ -10,3 +22,49 @@ test('with password and username getInputs does not throw error', async () => {
     getInputs();
   }).not.toThrow();
 });
+
+test('getAuthList uses the default Docker Hub registry when computing scoped config dir', async () => {
+  process.env['INPUT_USERNAME'] = 'dbowie';
+  process.env['INPUT_PASSWORD'] = 'groundcontrol';
+  process.env['INPUT_SCOPE'] = 'myscope';
+  process.env['INPUT_LOGOUT'] = 'false';
+  const [auth] = getAuthList(getInputs());
+  expect(auth).toMatchObject({
+    registry: 'docker.io',
+    configDir: path.join(Buildx.configDir, 'config', 'registry-1.docker.io', 'myscope')
+  });
+});
+
+test('getAuthList skips secret masking when registry-auth password is absent', async () => {
+  const stdoutWriteSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+  const [auth] = getAuthList({
+    registry: '',
+    username: '',
+    password: '',
+    scope: '',
+    ecr: '',
+    logout: true,
+    registryAuth: '- registry: public.ecr.aws\n'
+  });
+
+  expect(stdoutWriteSpy.mock.calls.map(call => call[0]).join('')).not.toContain('::add-mask::');
+  expect(auth).toMatchObject({
+    registry: 'public.ecr.aws',
+    ecr: 'auto'
+  });
+});
+
+test('getAuthList masks registry-auth password when present', async () => {
+  const stdoutWriteSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+  getAuthList({
+    registry: '',
+    username: '',
+    password: '',
+    scope: '',
+    ecr: '',
+    logout: true,
+    registryAuth: '- registry: ghcr.io\n  username: dbowie\n  password: groundcontrol\n'
+  });
+
+  expect(stdoutWriteSpy.mock.calls.map(call => call[0]).join('')).toContain('::add-mask::groundcontrol');
+});

__tests__/docker.test.ts

@@ -1,16 +1,11 @@
-import {expect, jest, test} from '@jest/globals';
+import {expect, test, vi} from 'vitest';
-import * as path from 'path';
 
-import {loginStandard, logout} from '../src/docker';
+import {Docker} from '@docker/actions-toolkit/lib/docker/docker.js';
 
-import {Docker} from '@docker/actions-toolkit/lib/docker/docker';
+import {loginStandard, logout} from '../src/docker.js';
-
-process.env['RUNNER_TEMP'] = path.join(__dirname, 'runner');
 
 test('loginStandard calls exec', async () => {
-  // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+  const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
-  // @ts-ignore
-  const execSpy = jest.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
     return {
       exitCode: expect.any(Number),
       stdout: expect.any(Function),
@@ -38,9 +33,7 @@ test('loginStandard calls exec', async () => {
 });
 
 test('logout calls exec', async () => {
-  // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+  const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
-  // @ts-ignore
-  const execSpy = jest.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
     return {
       exitCode: expect.any(Number),
       stdout: expect.any(Function),

__tests__/dockerhub.test.ts

@@ -0,0 +1,133 @@
+import * as core from '@actions/core';
+import * as httpm from '@actions/http-client';
+import {beforeEach, describe, expect, test, vi} from 'vitest';
+
+import * as dockerhub from '../src/dockerhub.js';
+
+vi.mock('@actions/core', () => ({
+  getIDToken: vi.fn(),
+  info: vi.fn(),
+  setSecret: vi.fn()
+}));
+
+const validConnectionID = '123e4567-e89b-42d3-a456-426614174000';
+
+const httpResponse = (statusCode: number, body: string, headers: Record<string, string> = {}): httpm.HttpClientResponse => {
+  return {
+    message: {
+      statusCode,
+      headers
+    },
+    readBody: vi.fn(async () => body)
+  } as unknown as httpm.HttpClientResponse;
+};
+
+describe('isDockerHubOIDC', () => {
+  beforeEach(() => {
+    delete process.env.DOCKERHUB_OIDC_CONNECTIONID;
+  });
+
+  test.each(['', 'docker.io', 'registry-1.docker.io', 'registry-1-stage.docker.io'])('detects Docker Hub registry %p with empty password', registry => {
+    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
+    expect(dockerhub.isDockerHubOIDC(registry, '')).toBe(true);
+  });
+
+  test('requires connection ID env var', () => {
+    expect(dockerhub.isDockerHubOIDC('docker.io', '')).toBe(false);
+  });
+
+  test('requires empty password', () => {
+    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
+    expect(dockerhub.isDockerHubOIDC('docker.io', 'groundcontrol')).toBe(false);
+  });
+
+  test('ignores non-Docker Hub registries', () => {
+    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
+    expect(dockerhub.isDockerHubOIDC('ghcr.io', '')).toBe(false);
+  });
+});
+
+describe('getOIDCToken', () => {
+  const getIDTokenMock = vi.mocked(core.getIDToken);
+  const setSecretMock = vi.mocked(core.setSecret);
+  let postSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
+    delete process.env.DOCKERHUB_OIDC_EXPIREIN;
+    getIDTokenMock.mockResolvedValue('github-id-token');
+    postSpy = vi.spyOn(httpm.HttpClient.prototype, 'post').mockResolvedValue(httpResponse(200, JSON.stringify({access_token: 'hub-token'})));
+  });
+
+  test('exchanges GitHub OIDC token for Docker Hub token', async () => {
+    const credentials = await dockerhub.getOIDCToken('docker.io', 'dbowie');
+
+    expect(credentials).toEqual({
+      username: 'dbowie',
+      token: 'hub-token'
+    });
+    expect(getIDTokenMock).toHaveBeenCalledWith('https://identity.docker.com');
+    expect(postSpy).toHaveBeenCalledTimes(1);
+    expect(postSpy.mock.calls[0][0]).toBe('https://identity.docker.com/oauth/token');
+
+    const http = postSpy.mock.contexts[0] as httpm.HttpClient;
+    expect(http.userAgent).toBe('github.com/docker/login-action');
+    expect(http.requestOptions?.headers).toEqual({
+      'Content-Type': 'application/x-www-form-urlencoded'
+    });
+
+    const body = new URLSearchParams(postSpy.mock.calls[0][1]);
+    expect(body.get('grant_type')).toBe('urn:ietf:params:oauth:grant-type:token-exchange');
+    expect(body.get('subject_token_type')).toBe('urn:ietf:params:oauth:token-type:id_token');
+    expect(body.get('subject_token')).toBe('github-id-token');
+    expect(body.get('connection_id')).toBe(validConnectionID);
+    expect(body.get('expires_in')).toBe('300');
+    expect(setSecretMock).toHaveBeenCalledWith('hub-token');
+  });
+
+  test('uses custom token expiration', async () => {
+    process.env.DOCKERHUB_OIDC_EXPIREIN = '900';
+    await dockerhub.getOIDCToken('docker.io', 'dbowie');
+    const body = new URLSearchParams(postSpy.mock.calls[0][1]);
+    expect(body.get('expires_in')).toBe('900');
+  });
+
+  test('uses stage identity host for stage registry', async () => {
+    await dockerhub.getOIDCToken('registry-1-stage.docker.io', 'dbowie');
+    expect(getIDTokenMock).toHaveBeenCalledWith('https://identity-stage.docker.com');
+    expect(postSpy.mock.calls[0][0]).toBe('https://identity-stage.docker.com/oauth/token');
+  });
+
+  test('requires connection ID env var', async () => {
+    delete process.env.DOCKERHUB_OIDC_CONNECTIONID;
+    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('DOCKERHUB_OIDC_CONNECTIONID is required for Docker Hub OIDC login');
+    expect(getIDTokenMock).not.toHaveBeenCalled();
+    expect(postSpy).not.toHaveBeenCalled();
+  });
+
+  test('validates connection ID', async () => {
+    process.env.DOCKERHUB_OIDC_CONNECTIONID = 'not-a-uuid';
+    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('Invalid DOCKERHUB_OIDC_CONNECTIONID. Must be a valid UUID.');
+    expect(getIDTokenMock).not.toHaveBeenCalled();
+    expect(postSpy).not.toHaveBeenCalled();
+  });
+
+  test.each(['not-a-number', '299', '3601'])('validates token expiration %p', async expiresIn => {
+    process.env.DOCKERHUB_OIDC_EXPIREIN = expiresIn;
+    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow(`Invalid DOCKERHUB_OIDC_EXPIREIN: ${expiresIn}. Must be between 300 and 3600`);
+    expect(getIDTokenMock).not.toHaveBeenCalled();
+    expect(postSpy).not.toHaveBeenCalled();
+  });
+
+  test('retries rate limited token requests with Retry-After', async () => {
+    postSpy.mockResolvedValueOnce(httpResponse(429, '', {'retry-after': '0'})).mockResolvedValueOnce(httpResponse(200, JSON.stringify({access_token: 'hub-token'})));
+    await dockerhub.getOIDCToken('docker.io', 'dbowie');
+    expect(postSpy).toHaveBeenCalledTimes(2);
+    expect(core.info).toHaveBeenCalledWith('Docker Hub OIDC token request rate limited, retrying in 0ms (attempt 1/5)');
+  });
+
+  test('throws Docker Hub API errors', async () => {
+    postSpy.mockResolvedValue(httpResponse(400, JSON.stringify({description: 'bad connection'})));
+    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('Docker Hub API: bad status code 400: bad connection');
+  });
+});

__tests__/setup.unit.ts

@@ -0,0 +1,12 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'docker-login-action-'));
+
+process.env = Object.assign({}, process.env, {
+  TEMP: tmpDir,
+  GITHUB_REPOSITORY: 'docker/login-action',
+  RUNNER_TEMP: path.join(tmpDir, 'runner-temp'),
+  RUNNER_TOOL_CACHE: path.join(tmpDir, 'runner-tool-cache')
+});

action.yml

@@ -31,6 +31,6 @@ inputs:
     required: false
 
 runs:
-  using: 'node20'
+  using: 'node24'
-  main: 'dist/index.js'
+  main: 'dist/index.cjs'
-  post: 'dist/index.js'
+  post: 'dist/index.cjs'

dev.Dockerfile

@@ -1,12 +1,13 @@
 # syntax=docker/dockerfile:1
 
-ARG NODE_VERSION=20
+ARG NODE_VERSION=24
 
 FROM node:${NODE_VERSION}-alpine AS base
-RUN apk add --no-cache cpio findutils git
+RUN apk add --no-cache cpio findutils git rsync
 WORKDIR /src
 RUN --mount=type=bind,target=.,rw \
   --mount=type=cache,target=/src/.yarn/cache <<EOT
+  set -e
   corepack enable
   yarn --version
   yarn config set --home enableTelemetry 0
@@ -16,7 +17,7 @@ FROM base AS deps
 RUN --mount=type=bind,target=.,rw \
   --mount=type=cache,target=/src/.yarn/cache \
   --mount=type=cache,target=/src/node_modules \
-  yarn install && mkdir /vendor && cp yarn.lock /vendor
+  yarn install --immutable && mkdir /vendor && cp yarn.lock /vendor
 
 FROM scratch AS vendor-update
 COPY --from=deps /vendor /
@@ -34,18 +35,27 @@ RUN --mount=type=bind,target=.,rw <<EOT
 EOT
 
 FROM deps AS build
-RUN --mount=type=bind,target=.,rw \
+RUN --mount=target=/context \
   --mount=type=cache,target=/src/.yarn/cache \
-  --mount=type=cache,target=/src/node_modules \
+  --mount=type=cache,target=/src/node_modules <<EOT
-  yarn run build && mkdir /out && cp -Rf dist /out/
+  set -e
+  rsync -a /context/. .
+  rm -rf dist
+  yarn run build
+  mkdir /out
+  cp -r dist /out
+EOT
 
 FROM scratch AS build-update
 COPY --from=build /out /
 
 FROM build AS build-validate
-RUN --mount=type=bind,target=.,rw <<EOT
+RUN --mount=target=/context \
+  --mount=target=.,type=tmpfs <<EOT
   set -e
+  rsync -a /context/. .
   git add -A
+  rm -rf dist
   cp -rf /out/* .
   if [ -n "$(git status --porcelain -- dist)" ]; then
     echo >&2 'ERROR: Build result differs. Please build first with "docker buildx bake build"'
@@ -58,8 +68,7 @@ FROM deps AS format
 RUN --mount=type=bind,target=.,rw \
   --mount=type=cache,target=/src/.yarn/cache \
   --mount=type=cache,target=/src/node_modules \
-  yarn run format \
+  yarn run format && mkdir /out && find . -name '*.ts' -not -path './node_modules/*' -not -path './.yarn/*' | cpio -pdm /out
-  && mkdir /out && find . -name '*.ts' -not -path './node_modules/*' -not -path './.yarn/*' | cpio -pdm /out
 
 FROM scratch AS format-update
 COPY --from=format /out /
@@ -76,7 +85,7 @@ ENV RUNNER_TOOL_CACHE=/tmp/github_tool_cache
 RUN --mount=type=bind,target=.,rw \
   --mount=type=cache,target=/src/.yarn/cache \
   --mount=type=cache,target=/src/node_modules \
-  yarn run test --coverage --coverageDirectory=/tmp/coverage
+  yarn run test --coverage --coverage.reportsDirectory=/tmp/coverage
 
 FROM scratch AS test-coverage
 COPY --from=test /tmp/coverage /

eslint.config.mjs

@@ -0,0 +1,52 @@
+import {defineConfig} from 'eslint/config';
+import js from '@eslint/js';
+import tseslint from '@typescript-eslint/eslint-plugin';
+import vitest from '@vitest/eslint-plugin';
+import globals from 'globals';
+import eslintConfigPrettier from 'eslint-config-prettier/flat';
+import eslintPluginPrettier from 'eslint-plugin-prettier';
+
+export default defineConfig([
+  {
+    ignores: ['.yarn/**/*', 'coverage/**/*', 'dist/**/*']
+  },
+  js.configs.recommended,
+  ...tseslint.configs['flat/recommended'],
+  eslintConfigPrettier,
+  {
+    languageOptions: {
+      globals: {
+        ...globals.node
+      }
+    }
+  },
+  {
+    files: ['__tests__/**'],
+    ...vitest.configs.recommended,
+    languageOptions: {
+      globals: {
+        ...globals.node,
+        ...vitest.environments.env.globals
+      }
+    },
+    rules: {
+      ...vitest.configs.recommended.rules,
+      'vitest/no-conditional-expect': 'error',
+      'vitest/no-disabled-tests': 0
+    }
+  },
+  {
+    plugins: {
+      prettier: eslintPluginPrettier
+    },
+    rules: {
+      'prettier/prettier': 'error',
+      '@typescript-eslint/no-require-imports': [
+        'error',
+        {
+          allowAsImport: true
+        }
+      ]
+    }
+  }
+]);

jest.config.ts

@@ -1,30 +0,0 @@
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-
-const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'docker-login-action-')).split(path.sep).join(path.posix.sep);
-
-process.env = Object.assign({}, process.env, {
-  TEMP: tmpDir,
-  GITHUB_REPOSITORY: 'docker/login-action',
-  RUNNER_TEMP: path.join(tmpDir, 'runner-temp').split(path.sep).join(path.posix.sep),
-  RUNNER_TOOL_CACHE: path.join(tmpDir, 'runner-tool-cache').split(path.sep).join(path.posix.sep)
-}) as {
-  [key: string]: string;
-};
-
-module.exports = {
-  clearMocks: true,
-  testEnvironment: 'node',
-  moduleFileExtensions: ['js', 'ts'],
-  testMatch: ['**/*.test.ts'],
-  transform: {
-    '^.+\\.ts$': 'ts-jest'
-  },
-  moduleNameMapper: {
-    '^csv-parse/sync': '<rootDir>/node_modules/csv-parse/dist/cjs/sync.cjs'
-  },
-  collectCoverageFrom: ['src/**/{!(main.ts),}.ts'],
-  coveragePathIgnorePatterns: ['lib/', 'node_modules/', '__tests__/'],
-  verbose: true
-};

package.json

@@ -1,16 +1,14 @@
 {
   "name": "docker-login",
   "description": "GitHub Action to login against a Docker registry",
+  "type": "module",
   "main": "src/main.ts",
   "scripts": {
-    "build": "ncc build --source-map --minify --license licenses.txt",
+    "build": "esbuild src/main.ts --bundle --platform=node --target=node24 --format=cjs --outfile=dist/index.cjs --sourcemap --minify --keep-names && yarn run license",
-    "lint": "yarn run prettier && yarn run eslint",
+    "lint": "eslint --max-warnings=0 .",
-    "format": "yarn run prettier:fix && yarn run eslint:fix",
+    "format": "eslint --fix .",
-    "eslint": "eslint --max-warnings=0 .",
+    "test": "vitest run",
-    "eslint:fix": "eslint --fix .",
+    "license": "generate-license-file --input package.json --output dist/licenses.txt --overwrite --ci --no-spinner --eol lf"
-    "prettier": "prettier --check \"./**/*.ts\"",
-    "prettier:fix": "prettier --write \"./**/*.ts\"",
-    "test": "jest"
   },
   "repository": {
     "type": "git",
@@ -23,30 +21,34 @@
   ],
   "author": "Docker Inc.",
   "license": "Apache-2.0",
-  "packageManager": "yarn@4.9.2",
+  "packageManager": "yarn@4.15.0",
   "dependencies": {
-    "@actions/core": "^1.11.1",
+    "@actions/core": "^3.0.1",
-    "@aws-sdk/client-ecr": "^3.890.0",
+    "@actions/http-client": "^4.0.1",
-    "@aws-sdk/client-ecr-public": "^3.890.0",
+    "@aws-sdk/client-ecr": "^3.1091.0",
-    "@docker/actions-toolkit": "^0.63.0",
+    "@aws-sdk/client-ecr-public": "^3.1091.0",
-    "http-proxy-agent": "^7.0.2",
+    "@docker/actions-toolkit": "^0.94.0",
-    "https-proxy-agent": "^7.0.6",
+    "http-proxy-agent": "^9.1.0",
-    "js-yaml": "^4.1.0"
+    "https-proxy-agent": "^9.1.0",
+    "js-yaml": "^5.2.1",
+    "uuid": "^14.0.1"
   },
   "devDependencies": {
+    "@eslint/js": "^9.39.3",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^20.19.9",
+    "@types/node": "^24.11.0",
-    "@typescript-eslint/eslint-plugin": "^7.18.0",
+    "@typescript-eslint/eslint-plugin": "^8.56.1",
-    "@typescript-eslint/parser": "^7.18.0",
+    "@typescript-eslint/parser": "^8.56.1",
-    "@vercel/ncc": "^0.38.3",
+    "@vitest/coverage-v8": "^4.0.18",
-    "eslint": "^8.57.1",
+    "@vitest/eslint-plugin": "^1.6.9",
-    "eslint-config-prettier": "^9.1.2",
+    "esbuild": "^0.28.0",
-    "eslint-plugin-jest": "^28.14.0",
+    "eslint": "^9.39.3",
-    "eslint-plugin-prettier": "^5.5.4",
+    "eslint-config-prettier": "^10.1.8",
-    "jest": "^29.7.0",
+    "eslint-plugin-prettier": "^5.5.5",
-    "prettier": "^3.6.2",
+    "generate-license-file": "^4.1.1",
-    "ts-jest": "^29.4.1",
+    "globals": "^17.3.0",
-    "ts-node": "^10.9.2",
+    "prettier": "^3.8.1",
-    "typescript": "^5.9.2"
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.18"
   }
 }

src/context.ts

@@ -2,8 +2,8 @@ import path from 'path';
 import * as core from '@actions/core';
 import * as yaml from 'js-yaml';
 
-import {Buildx} from '@docker/actions-toolkit/lib/buildx/buildx';
+import {Buildx} from '@docker/actions-toolkit/lib/buildx/buildx.js';
-import {Util} from '@docker/actions-toolkit/lib/util';
+import {Util} from '@docker/actions-toolkit/lib/util.js';
 
 export interface Inputs {
   registry: string;
@@ -42,24 +42,28 @@ export function getAuthList(inputs: Inputs): Array<Auth> {
   }
   let auths: Array<Auth> = [];
   if (!inputs.registryAuth) {
+    const registry = inputs.registry || 'docker.io';
     auths.push({
-      registry: inputs.registry || 'docker.io',
+      registry,
       username: inputs.username,
       password: inputs.password,
       scope: inputs.scope,
       ecr: inputs.ecr || 'auto',
-      configDir: scopeToConfigDir(inputs.registry, inputs.scope)
+      configDir: scopeToConfigDir(registry, inputs.scope)
     });
   } else {
     auths = (yaml.load(inputs.registryAuth) as Array<Auth>).map(auth => {
-      core.setSecret(auth.password); // redacted in workflow logs
+      if (auth.password) {
+        core.setSecret(auth.password); // redacted in workflow logs
+      }
+      const registry = auth.registry || 'docker.io';
       return {
-        registry: auth.registry || 'docker.io',
+        registry,
         username: auth.username,
         password: auth.password,
         scope: auth.scope,
         ecr: auth.ecr || 'auto',
-        configDir: scopeToConfigDir(auth.registry || 'docker.io', auth.scope)
+        configDir: scopeToConfigDir(registry, auth.scope)
       };
     });
   }

src/docker.ts

@@ -1,15 +1,23 @@
 import * as core from '@actions/core';
 
-import * as aws from './aws';
+import {Docker} from '@docker/actions-toolkit/lib/docker/docker.js';
-import * as context from './context';
 
-import {Docker} from '@docker/actions-toolkit/lib/docker/docker';
+import * as aws from './aws.js';
+import * as context from './context.js';
+import * as dockerhub from './dockerhub.js';
 
 export async function login(auth: context.Auth): Promise<void> {
   if (/true/i.test(auth.ecr) || (auth.ecr == 'auto' && aws.isECR(auth.registry))) {
     await loginECR(auth.registry, auth.username, auth.password, auth.scope);
   } else {
-    await loginStandard(auth.registry, auth.username, auth.password, auth.scope);
+    let username = auth.username;
+    let password = auth.password;
+    if (dockerhub.isDockerHubOIDC(auth.registry, password)) {
+      const credentials = await dockerhub.getOIDCToken(auth.registry, username);
+      username = credentials.username;
+      password = credentials.token;
+    }
+    await loginStandard(auth.registry, username, password, auth.scope);
   }
 }
 

src/dockerhub.ts

@@ -0,0 +1,134 @@
+import * as core from '@actions/core';
+import * as httpm from '@actions/http-client';
+import {HttpCodes} from '@actions/http-client';
+import {validate as uuidValidate} from 'uuid';
+
+export interface LoginCredentials {
+  username: string;
+  token: string;
+}
+
+interface OIDCTokenResponse {
+  access_token: string;
+}
+
+const defaultExpiresIn = 300;
+const minExpiresIn = 300;
+const maxExpiresIn = 3600;
+const maxRetries = 5;
+
+export const isDockerHubOIDC = (registry: string, password: string): boolean => {
+  return process.env.DOCKERHUB_OIDC_CONNECTIONID !== undefined && !password && isDockerHubRegistry(registry);
+};
+
+const isDockerHubRegistry = (registry: string): boolean => {
+  return registry === '' || registry === 'docker.io' || registry === 'registry-1.docker.io' || registry === 'registry-1-stage.docker.io';
+};
+
+export const getOIDCToken = async (registry: string, username: string): Promise<LoginCredentials> => {
+  const connectionID = process.env.DOCKERHUB_OIDC_CONNECTIONID?.trim();
+  if (!connectionID) {
+    throw new Error('DOCKERHUB_OIDC_CONNECTIONID is required for Docker Hub OIDC login');
+  }
+
+  if (!uuidValidate(connectionID)) {
+    throw new Error('Invalid DOCKERHUB_OIDC_CONNECTIONID. Must be a valid UUID.');
+  }
+
+  const expiresIn = getExpiresIn();
+  const identityHost = registry === 'registry-1-stage.docker.io' ? 'identity-stage.docker.com' : 'identity.docker.com';
+  const audience = `https://${identityHost}`;
+  const idToken = await core.getIDToken(audience);
+  const http: httpm.HttpClient = new httpm.HttpClient('github.com/docker/login-action', [], {
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded'
+    }
+  });
+
+  const data = new URLSearchParams();
+  data.set('grant_type', 'urn:ietf:params:oauth:grant-type:token-exchange');
+  data.set('subject_token_type', 'urn:ietf:params:oauth:token-type:id_token');
+  data.set('subject_token', idToken);
+  data.set('connection_id', connectionID);
+  data.set('expires_in', expiresIn.toString());
+
+  const resp = await postWithRetry(http, `https://${identityHost}/oauth/token`, data.toString());
+
+  const tokenResp = <OIDCTokenResponse>JSON.parse(await handleResponse(resp));
+  core.setSecret(tokenResp.access_token);
+
+  return {
+    username,
+    token: tokenResp.access_token
+  };
+};
+
+const getExpiresIn = (): number => {
+  const expiresInInput = process.env.DOCKERHUB_OIDC_EXPIREIN?.trim() || defaultExpiresIn.toString();
+  const expiresIn = Number(expiresInInput);
+  if (isNaN(expiresIn) || expiresIn < minExpiresIn || expiresIn > maxExpiresIn) {
+    throw new Error(`Invalid DOCKERHUB_OIDC_EXPIREIN: ${expiresInInput}. Must be between ${minExpiresIn} and ${maxExpiresIn}`);
+  }
+  return expiresIn;
+};
+
+const postWithRetry = async (http: httpm.HttpClient, url: string, data: string): Promise<httpm.HttpClientResponse> => {
+  let resp = await http.post(url, data);
+  for (let attempt = 0; (resp.message.statusCode || HttpCodes.InternalServerError) === HttpCodes.TooManyRequests && attempt < maxRetries; attempt++) {
+    const delay = parseRetryAfter(resp.message.headers['retry-after']);
+    if (delay === null) {
+      break;
+    }
+    await resp.readBody();
+    core.info(`Docker Hub OIDC token request rate limited, retrying in ${delay}ms (attempt ${attempt + 1}/${maxRetries})`);
+    await new Promise(resolve => setTimeout(resolve, delay));
+    resp = await http.post(url, data);
+  }
+  return resp;
+};
+
+const parseRetryAfter = (value: string | string[] | undefined): number | null => {
+  if (value === undefined) {
+    return null;
+  }
+  if (Array.isArray(value)) {
+    value = value[0];
+  }
+  const seconds = Number(value);
+  if (isNaN(seconds)) {
+    return null;
+  }
+  return Math.max(0, seconds * 1000);
+};
+
+const handleResponse = async (resp: httpm.HttpClientResponse): Promise<string> => {
+  const body = await resp.readBody();
+  const statusCode = resp.message.statusCode || HttpCodes.InternalServerError;
+  if (statusCode < HttpCodes.OK || statusCode >= HttpCodes.MultipleChoices) {
+    throw parseError(statusCode, body);
+  }
+  return body;
+};
+
+const parseError = (statusCode: number, body: string): Error => {
+  if (statusCode === 401) {
+    throw new Error(`Docker Hub API: operation not permitted`);
+  }
+  if (body) {
+    const errResp = parseErrorBody(body);
+    for (const k of ['description', 'message', 'detail', 'error']) {
+      if (errResp[k]) {
+        throw new Error(`Docker Hub API: bad status code ${statusCode}: ${errResp[k]}`);
+      }
+    }
+  }
+  throw new Error(`Docker Hub API: bad status code ${statusCode}`);
+};
+
+const parseErrorBody = (body: string): Record<string, string> => {
+  try {
+    return <Record<string, string>>JSON.parse(body);
+  } catch {
+    return {};
+  }
+};

src/main.ts

@@ -1,9 +1,9 @@
 import * as core from '@actions/core';
 import * as actionsToolkit from '@docker/actions-toolkit';
 
-import * as context from './context';
+import * as context from './context.js';
-import * as docker from './docker';
+import * as docker from './docker.js';
-import * as stateHelper from './state-helper';
+import * as stateHelper from './state-helper.js';
 
 export async function main(): Promise<void> {
   const inputs: context.Inputs = context.getInputs();

tsconfig.json

@@ -1,9 +1,8 @@
 {
   "compilerOptions": {
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
     "esModuleInterop": true,
-    "target": "es6",
-    "module": "commonjs",
-    "strict": true,
     "newLine": "lf",
     "outDir": "./lib",
     "rootDir": "./src",
@@ -12,10 +11,7 @@
     "resolveJsonModule": true,
     "useUnknownInCatchVariables": false,
   },
-  "exclude": [
+  "include": [
-    "./__tests__/**/*",
+    "src/**/*.ts"
-    "./lib/**/*",
-    "node_modules",
-    "jest.config.ts"
   ]
 }

vitest.config.ts

@@ -0,0 +1,16 @@
+import {defineConfig} from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    clearMocks: true,
+    environment: 'node',
+    setupFiles: ['./__tests__/setup.unit.ts'],
+    include: ['**/*.test.ts'],
+    coverage: {
+      provider: 'v8',
+      reporter: ['clover'],
+      include: ['src/**/*.ts'],
+      exclude: ['src/**/main.ts']
+    }
+  }
+});