Compare commits

...

37 Commits

Author SHA1 Message Date
github-actions[bot] 17a9e5db92 [dependabot skip] chore: update generated content 2026-07-27 05:55:25 +00:00
dependabot[bot] 4d6637e5c0 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 updates
Bumps the aws-sdk-dependencies group with 2 updates in the / directory: [@aws-sdk/client-ecr](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ecr) and [@aws-sdk/client-ecr-public](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ecr-public).


Updates `@aws-sdk/client-ecr` from 3.1091.0 to 3.1095.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ecr/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1095.0/clients/client-ecr)

Updates `@aws-sdk/client-ecr-public` from 3.1091.0 to 3.1095.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ecr-public/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1095.0/clients/client-ecr-public)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-ecr"
  dependency-version: 3.1092.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: aws-sdk-dependencies
- dependency-name: "@aws-sdk/client-ecr-public"
  dependency-version: 3.1092.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: aws-sdk-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-27 05:54:26 +00:00
CrazyMax abd2ef45e7 Merge pull request #1055 from crazy-max/test-registry-auth-oidc
test: cover Docker Hub OIDC with registry-auth
2026-07-24 14:22:47 +02:00
CrazyMax d49d3a9839 Merge pull request #1054 from crazy-max/oidc-missing-dhi
support dhi.io as Docker Hub OIDC registry
2026-07-24 14:22:20 +02:00
CrazyMax b58b17c30b test: cover Docker Hub OIDC with registry-auth
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2026-07-24 10:37:01 +02:00
CrazyMax be646c21ce chore: update generated content
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2026-07-24 10:33:14 +02:00
CrazyMax d77c059cb9 support dhi.io as Docker Hub OIDC registry
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2026-07-24 10:26:38 +02:00
CrazyMax 06fb636fac Merge pull request #1037 from docker/dependabot/npm_and_yarn/aws-sdk-dependencies-001763bcc2
build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 updates
2026-07-23 13:48:53 +02:00
github-actions[bot] a8bc953911 [dependabot skip] chore: update generated content 2026-07-23 11:45:23 +00:00
dependabot[bot] f54b9019bf build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 updates
Bumps the aws-sdk-dependencies group with 2 updates in the / directory: [@aws-sdk/client-ecr](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ecr) and [@aws-sdk/client-ecr-public](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ecr-public).


Updates `@aws-sdk/client-ecr` from 3.1077.0 to 3.1091.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ecr/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1091.0/clients/client-ecr)

Updates `@aws-sdk/client-ecr-public` from 3.1077.0 to 3.1091.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ecr-public/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1091.0/clients/client-ecr-public)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-ecr"
  dependency-version: 3.1079.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: aws-sdk-dependencies
- dependency-name: "@aws-sdk/client-ecr-public"
  dependency-version: 3.1079.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: aws-sdk-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-23 11:44:24 +00:00
CrazyMax 77f18f6713 Merge pull request #1049 from docker/dependabot/github_actions/codeql-actions-6a53124c02
build(deps): bump the codeql-actions group with 2 updates
2026-07-23 13:41:05 +02:00
CrazyMax ec0bf287fb Merge pull request #1050 from docker/dependabot/npm_and_yarn/docker/actions-toolkit-0.94.0
build(deps): bump @docker/actions-toolkit from 0.93.0 to 0.94.0
2026-07-23 13:40:40 +02:00
github-actions[bot] e37171e542 [dependabot skip] chore: update generated content 2026-07-23 11:36:42 +00:00
dependabot[bot] 1d3a7174ca build(deps): bump @docker/actions-toolkit from 0.93.0 to 0.94.0
Bumps [@docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.93.0 to 0.94.0.
- [Release notes](https://github.com/docker/actions-toolkit/releases)
- [Commits](https://github.com/docker/actions-toolkit/compare/v0.93.0...v0.94.0)

---
updated-dependencies:
- dependency-name: "@docker/actions-toolkit"
  dependency-version: 0.94.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-23 11:35:46 +00:00
CrazyMax a5e9150fe2 Merge pull request #1048 from docker/dockerhub-oidc-support
Docker Hub OIDC login support
2026-07-23 13:24:10 +02:00
dependabot[bot] a482ba4366 build(deps): bump the codeql-actions group with 2 updates
Bumps the codeql-actions group with 2 updates: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.36.3 to 4.37.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...e0647621c2984b5ed2f768cb892365bf2a616ad1)

Updates `github/codeql-action/analyze` from 4.36.3 to 4.37.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...e0647621c2984b5ed2f768cb892365bf2a616ad1)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-23 05:54:58 +00:00
CrazyMax 9e3d36ea10 chore: update generated content
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2026-07-22 13:01:47 +02:00
CrazyMax 14d6a7934e docker hub oidc support
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2026-07-22 13:01:46 +02:00
CrazyMax 03c851098f Merge pull request #1044 from docker/dependabot/npm_and_yarn/docker/actions-toolkit-0.93.0
build(deps): bump @docker/actions-toolkit from 0.92.0 to 0.93.0
2026-07-22 08:53:04 +02:00
CrazyMax ad8a81f098 Merge pull request #1046 from docker/dependabot/npm_and_yarn/brace-expansion-1.1.16
build(deps): bump brace-expansion from 1.1.13 to 1.1.16
2026-07-22 08:51:57 +02:00
github-actions[bot] 6d219a4928 [dependabot skip] chore: update generated content 2026-07-22 06:51:44 +00:00
dependabot[bot] b3200694f4 build(deps): bump @docker/actions-toolkit from 0.92.0 to 0.93.0
Bumps [@docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.92.0 to 0.93.0.
- [Release notes](https://github.com/docker/actions-toolkit/releases)
- [Commits](https://github.com/docker/actions-toolkit/compare/v0.92.0...v0.93.0)

---
updated-dependencies:
- dependency-name: "@docker/actions-toolkit"
  dependency-version: 0.93.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-22 06:50:49 +00:00
github-actions[bot] 08d3680aa8 [dependabot skip] chore: update generated content 2026-07-22 06:50:38 +00:00
CrazyMax 381f5a4f5e Merge pull request #1042 from docker/dependabot/github_actions/codeql-actions-af2beed448
build(deps): bump the codeql-actions group with 2 updates
2026-07-22 08:49:44 +02:00
dependabot[bot] 4bc69ce4fd build(deps): bump brace-expansion from 1.1.13 to 1.1.16
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.13 to 1.1.16.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.13...v1.1.16)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.16
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-22 06:49:44 +00:00
CrazyMax ddf94996dc Merge pull request #1043 from docker/dependabot/github_actions/actions/setup-node-7.0.0
build(deps): bump actions/setup-node from 6.4.0 to 7.0.0
2026-07-22 08:49:18 +02:00
CrazyMax d870eb57d3 Merge pull request #1045 from docker/dependabot/github_actions/actions/checkout-7.0.1
build(deps): bump actions/checkout from 7.0.0 to 7.0.1
2026-07-22 08:48:31 +02:00
CrazyMax 4d7b1348c8 Merge pull request #1038 from docker/dependabot/npm_and_yarn/js-yaml-5.2.1
build(deps): bump js-yaml from 5.2.0 to 5.2.1
2026-07-22 08:47:43 +02:00
dependabot[bot] 608836776e build(deps): bump actions/checkout from 7.0.0 to 7.0.1
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-21 05:52:59 +00:00
dependabot[bot] 3bab31f360 build(deps): bump actions/setup-node from 6.4.0 to 7.0.0
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-15 05:52:18 +00:00
dependabot[bot] dc654b7be1 build(deps): bump the codeql-actions group with 2 updates
Bumps the codeql-actions group with 2 updates: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.36.2 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a)

Updates `github/codeql-action/analyze` from 4.36.2 to 4.36.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.36.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-09 12:01:00 +00:00
CrazyMax c66a8fcb24 Merge pull request #1041 from crazy-max/group-codeql-dependabot-updates
chore: group codeql dependabot updates
2026-07-09 13:57:49 +02:00
CrazyMax 6d7f9d458a chore: group codeql dependabot updates
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2026-07-09 12:43:17 +02:00
CrazyMax 13169716da Merge pull request #1040 from docker/dependabot/github_actions/aws-actions/configure-aws-credentials-6.2.2
build(deps): bump aws-actions/configure-aws-credentials from 6.2.1 to 6.2.2
2026-07-09 10:17:14 +02:00
dependabot[bot] c1aa9e5f45 build(deps): bump aws-actions/configure-aws-credentials
Bumps [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) from 6.2.1 to 6.2.2.
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](https://github.com/aws-actions/configure-aws-credentials/compare/254c19bd240aabef8777f48595e9d2d7b972184b...517a711dbcd0e402f90c77e7e2f81e849156e31d)

---
updated-dependencies:
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: 6.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-09 05:53:39 +00:00
github-actions[bot] 026f3975fd [dependabot skip] chore: update generated content 2026-07-06 05:55:36 +00:00
dependabot[bot] 3dbb99fd00 build(deps): bump js-yaml from 5.2.0 to 5.2.1
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 5.2.0 to 5.2.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/5.2.0...5.2.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 5.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-06 05:54:34 +00:00
18 changed files with 891 additions and 408 deletions
+3
View File
@@ -10,6 +10,9 @@ updates:
crazy-max-dot-github:
patterns:
- "crazy-max/.github/*"
codeql-actions:
patterns:
- "github/codeql-action/*"
labels:
- "dependencies"
- "bot"
+71 -27
View File
@@ -25,7 +25,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Stop docker
run: |
@@ -49,7 +49,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to GitHub Container Registry
uses: ./
@@ -67,7 +67,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to GitHub Container Registry
uses: ./
@@ -97,7 +97,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to GitHub Container Registry
uses: ./
@@ -122,7 +122,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to ACR
uses: ./
@@ -142,7 +142,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to Docker Hub
uses: ./
@@ -150,6 +150,50 @@ jobs:
username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
dockerhub-oidc:
permissions:
contents: read
id-token: write
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os:
- ubuntu-latest
- windows-latest
steps:
-
name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to Docker Hub with OIDC
uses: ./
env:
DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
with:
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
registry-auth-oidc:
permissions:
contents: read
id-token: write
runs-on: ubuntu-latest
steps:
-
name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to registries
uses: ./
env:
DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
with:
registry-auth: |
- username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
- registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
ecr:
runs-on: ${{ matrix.os }}
strategy:
@@ -161,7 +205,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to ECR
uses: ./
@@ -181,10 +225,10 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -209,10 +253,10 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
with:
role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd_login_action
aws-region: us-east-1
@@ -233,7 +277,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to Public ECR
continue-on-error: ${{ matrix.os == 'windows-latest' }}
@@ -256,10 +300,10 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -285,10 +329,10 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
with:
role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd_login_action
aws-region: us-east-1
@@ -310,7 +354,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to GitHub Container Registry
uses: ./
@@ -330,7 +374,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to GitLab
uses: ./
@@ -350,7 +394,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to Google Artifact Registry
uses: ./
@@ -370,7 +414,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to Google Container Registry
uses: ./
@@ -384,7 +428,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to registries
uses: ./
@@ -407,7 +451,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to registries
uses: ./
@@ -428,7 +472,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to registries
id: login
@@ -460,7 +504,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to Docker Hub
uses: ./
@@ -490,7 +534,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to Docker Hub
uses: ./
@@ -520,7 +564,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to GitHub Container Registry
uses: ./
@@ -551,7 +595,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Login to GitHub Container Registry
uses: ./
+4 -4
View File
@@ -22,7 +22,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Enable corepack
run: |
@@ -30,17 +30,17 @@ jobs:
yarn --version
-
name: Set up Node
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: ${{ env.NODE_VERSION }}
-
name: Initialize CodeQL
uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
uses: github/codeql-action/init@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
with:
languages: javascript-typescript
build-mode: none
-
name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
uses: github/codeql-action/analyze@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
with:
category: "/language:javascript-typescript"
+1 -1
View File
@@ -22,7 +22,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Publish
uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4
+1 -1
View File
@@ -20,7 +20,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Test
uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+1 -1
View File
@@ -30,7 +30,7 @@ jobs:
permission-contents: write
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ github.event.pull_request.head.ref }}
fetch-depth: 0
+1 -1
View File
@@ -22,7 +22,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
name: Generate matrix
id: generate
+72
View File
@@ -28,6 +28,7 @@ ___
* [Set scopes for the authentication token](#set-scopes-for-the-authentication-token)
* [Customizing](#customizing)
* [inputs](#inputs)
* [environment variables](#environment-variables)
* [Contributing](#contributing)
## Usage
@@ -57,6 +58,36 @@ jobs:
password: ${{ secrets.DOCKERHUB_TOKEN }}
```
You can also [authenticate to Docker Hub with OpenID Connect](https://docs.docker.com/enterprise/security/oidc-connections/)
when your Docker Hub organization has an OIDC connection configured. The
workflow must grant the `id-token: write` permission, pass the Docker Hub
organization name as `username`, omit `password`, and set the OIDC connection
ID in `DOCKERHUB_OIDC_CONNECTIONID` environment variable.
```yaml
name: ci
on:
push:
branches: main
permissions:
contents: read
id-token: write
jobs:
login:
runs-on: ubuntu-latest
steps:
-
name: Login to Docker Hub
uses: docker/login-action@v4
env:
DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
with:
username: ${{ vars.DOCKERHUB_ORGANIZATION }}
```
### GitHub Container Registry
To authenticate to the [GitHub Container Registry](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry),
@@ -617,6 +648,38 @@ jobs:
password: ${{ secrets.GITHUB_TOKEN }}
```
Docker Hub OIDC can also be used with `registry-auth`. Grant `id-token: write`,
set `DOCKERHUB_OIDC_CONNECTIONID`, pass the Docker Hub organization name as
`username`, and omit `password` for the Docker Hub object:
```yaml
name: ci
on:
push:
branches: main
permissions:
contents: read
id-token: write
jobs:
login:
runs-on: ubuntu-latest
steps:
-
name: Login to registries
uses: docker/login-action@v4
env:
DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
with:
registry-auth: |
- username: ${{ vars.DOCKERHUB_ORGANIZATION }}
- registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
```
### Set scopes for the authentication token
The `scope` input allows limiting registry credentials to a specific repository
@@ -690,6 +753,15 @@ The following inputs can be used as `step.with` keys:
> [!NOTE]
> The `registry-auth` input cannot be used with other inputs except `logout`.
### environment variables
The following environment variables can be set as `step.env` keys:
| Name | Type | Default | Description |
|-------------------------------|--------|---------|-----------------------------------------------------------------------------|
| `DOCKERHUB_OIDC_CONNECTIONID` | String | | Docker Hub OIDC connection ID. Required for Docker Hub OIDC login |
| `DOCKERHUB_OIDC_EXPIREIN` | Number | `300` | Docker Hub OIDC token lifetime in seconds. Must be between `300` and `3600` |
## Contributing
Want to contribute? Awesome! You can find information about contributing to
+19
View File
@@ -54,6 +54,25 @@ test('getAuthList skips secret masking when registry-auth password is absent', a
});
});
test('getAuthList supports password-less Docker Hub registry-auth for OIDC', async () => {
const [auth] = getAuthList({
registry: '',
username: '',
password: '',
scope: '',
ecr: '',
logout: true,
registryAuth: '- username: docker-org\n'
});
expect(auth).toMatchObject({
registry: 'docker.io',
username: 'docker-org',
password: undefined,
ecr: 'auto'
});
});
test('getAuthList masks registry-auth password when present', async () => {
const stdoutWriteSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
getAuthList({
+39 -2
View File
@@ -1,8 +1,14 @@
import {expect, test, vi} from 'vitest';
import {afterEach, expect, test, vi} from 'vitest';
import {Docker} from '@docker/actions-toolkit/lib/docker/docker.js';
import {loginStandard, logout} from '../src/docker.js';
import {login, loginStandard, logout} from '../src/docker.js';
import * as dockerhub from '../src/dockerhub.js';
afterEach(() => {
vi.restoreAllMocks();
delete process.env.DOCKERHUB_OIDC_CONNECTIONID;
});
test('loginStandard calls exec', async () => {
const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
@@ -32,6 +38,37 @@ test('loginStandard calls exec', async () => {
});
});
test('login exchanges Docker Hub OIDC token for password-less auth', async () => {
process.env.DOCKERHUB_OIDC_CONNECTIONID = '123e4567-e89b-42d3-a456-426614174000';
const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
return {
exitCode: 0,
stdout: '',
stderr: ''
};
});
const oidcSpy = vi.spyOn(dockerhub, 'getOIDCToken').mockResolvedValue({
username: 'docker-org',
token: 'hub-token'
});
await login({
registry: 'docker.io',
username: 'docker-org',
password: '',
scope: '',
ecr: 'auto',
configDir: ''
});
expect(oidcSpy).toHaveBeenCalledWith('docker.io', 'docker-org');
expect(execSpy).toHaveBeenCalledWith(['login', '--password-stdin', '--username', 'docker-org', 'docker.io'], {
input: Buffer.from('hub-token'),
silent: true,
ignoreReturnCode: true
});
});
test('logout calls exec', async () => {
const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
return {
+133
View File
@@ -0,0 +1,133 @@
import * as core from '@actions/core';
import * as httpm from '@actions/http-client';
import {beforeEach, describe, expect, test, vi} from 'vitest';
import * as dockerhub from '../src/dockerhub.js';
vi.mock('@actions/core', () => ({
getIDToken: vi.fn(),
info: vi.fn(),
setSecret: vi.fn()
}));
const validConnectionID = '123e4567-e89b-42d3-a456-426614174000';
const httpResponse = (statusCode: number, body: string, headers: Record<string, string> = {}): httpm.HttpClientResponse => {
return {
message: {
statusCode,
headers
},
readBody: vi.fn(async () => body)
} as unknown as httpm.HttpClientResponse;
};
describe('isDockerHubOIDC', () => {
beforeEach(() => {
delete process.env.DOCKERHUB_OIDC_CONNECTIONID;
});
test.each(['', 'docker.io', 'registry-1.docker.io', 'registry-1-stage.docker.io'])('detects Docker Hub registry %p with empty password', registry => {
process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
expect(dockerhub.isDockerHubOIDC(registry, '')).toBe(true);
});
test('requires connection ID env var', () => {
expect(dockerhub.isDockerHubOIDC('docker.io', '')).toBe(false);
});
test('requires empty password', () => {
process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
expect(dockerhub.isDockerHubOIDC('docker.io', 'groundcontrol')).toBe(false);
});
test('ignores non-Docker Hub registries', () => {
process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
expect(dockerhub.isDockerHubOIDC('ghcr.io', '')).toBe(false);
});
});
describe('getOIDCToken', () => {
const getIDTokenMock = vi.mocked(core.getIDToken);
const setSecretMock = vi.mocked(core.setSecret);
let postSpy: ReturnType<typeof vi.spyOn>;
beforeEach(() => {
process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
delete process.env.DOCKERHUB_OIDC_EXPIREIN;
getIDTokenMock.mockResolvedValue('github-id-token');
postSpy = vi.spyOn(httpm.HttpClient.prototype, 'post').mockResolvedValue(httpResponse(200, JSON.stringify({access_token: 'hub-token'})));
});
test('exchanges GitHub OIDC token for Docker Hub token', async () => {
const credentials = await dockerhub.getOIDCToken('docker.io', 'dbowie');
expect(credentials).toEqual({
username: 'dbowie',
token: 'hub-token'
});
expect(getIDTokenMock).toHaveBeenCalledWith('https://identity.docker.com');
expect(postSpy).toHaveBeenCalledTimes(1);
expect(postSpy.mock.calls[0][0]).toBe('https://identity.docker.com/oauth/token');
const http = postSpy.mock.contexts[0] as httpm.HttpClient;
expect(http.userAgent).toBe('github.com/docker/login-action');
expect(http.requestOptions?.headers).toEqual({
'Content-Type': 'application/x-www-form-urlencoded'
});
const body = new URLSearchParams(postSpy.mock.calls[0][1]);
expect(body.get('grant_type')).toBe('urn:ietf:params:oauth:grant-type:token-exchange');
expect(body.get('subject_token_type')).toBe('urn:ietf:params:oauth:token-type:id_token');
expect(body.get('subject_token')).toBe('github-id-token');
expect(body.get('connection_id')).toBe(validConnectionID);
expect(body.get('expires_in')).toBe('300');
expect(setSecretMock).toHaveBeenCalledWith('hub-token');
});
test('uses custom token expiration', async () => {
process.env.DOCKERHUB_OIDC_EXPIREIN = '900';
await dockerhub.getOIDCToken('docker.io', 'dbowie');
const body = new URLSearchParams(postSpy.mock.calls[0][1]);
expect(body.get('expires_in')).toBe('900');
});
test('uses stage identity host for stage registry', async () => {
await dockerhub.getOIDCToken('registry-1-stage.docker.io', 'dbowie');
expect(getIDTokenMock).toHaveBeenCalledWith('https://identity-stage.docker.com');
expect(postSpy.mock.calls[0][0]).toBe('https://identity-stage.docker.com/oauth/token');
});
test('requires connection ID env var', async () => {
delete process.env.DOCKERHUB_OIDC_CONNECTIONID;
await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('DOCKERHUB_OIDC_CONNECTIONID is required for Docker Hub OIDC login');
expect(getIDTokenMock).not.toHaveBeenCalled();
expect(postSpy).not.toHaveBeenCalled();
});
test('validates connection ID', async () => {
process.env.DOCKERHUB_OIDC_CONNECTIONID = 'not-a-uuid';
await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('Invalid DOCKERHUB_OIDC_CONNECTIONID. Must be a valid UUID.');
expect(getIDTokenMock).not.toHaveBeenCalled();
expect(postSpy).not.toHaveBeenCalled();
});
test.each(['not-a-number', '299', '3601'])('validates token expiration %p', async expiresIn => {
process.env.DOCKERHUB_OIDC_EXPIREIN = expiresIn;
await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow(`Invalid DOCKERHUB_OIDC_EXPIREIN: ${expiresIn}. Must be between 300 and 3600`);
expect(getIDTokenMock).not.toHaveBeenCalled();
expect(postSpy).not.toHaveBeenCalled();
});
test('retries rate limited token requests with Retry-After', async () => {
postSpy.mockResolvedValueOnce(httpResponse(429, '', {'retry-after': '0'})).mockResolvedValueOnce(httpResponse(200, JSON.stringify({access_token: 'hub-token'})));
await dockerhub.getOIDCToken('docker.io', 'dbowie');
expect(postSpy).toHaveBeenCalledTimes(2);
expect(core.info).toHaveBeenCalledWith('Docker Hub OIDC token request rate limited, retrying in 0ms (attempt 1/5)');
});
test('throws Docker Hub API errors', async () => {
postSpy.mockResolvedValue(httpResponse(400, JSON.stringify({description: 'bad connection'})));
await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('Docker Hub API: bad status code 400: bad connection');
});
});
Generated Vendored
+123 -118
View File
File diff suppressed because one or more lines are too long
Generated Vendored
+4 -4
View File
File diff suppressed because one or more lines are too long
Generated Vendored
+46 -28
View File
@@ -3,7 +3,7 @@ https://www.npmjs.com/package/generate-license-file
The following npm package may be included in this product:
- @aws/lambda-invoke-store@0.2.3
- @aws/lambda-invoke-store@0.3.0
This package contains the following license:
@@ -399,7 +399,7 @@ Apache License
The following npm package may be included in this product:
- @docker/actions-toolkit@0.92.0
- @docker/actions-toolkit@0.94.0
This package contains the following license:
@@ -1913,8 +1913,8 @@ Apache License
The following npm packages may be included in this product:
- @aws-sdk/client-ecr-public@3.1077.0
- @aws-sdk/client-ecr@3.1077.0
- @aws-sdk/client-ecr-public@3.1095.0
- @aws-sdk/client-ecr@3.1095.0
These packages each contain the following license:
@@ -2124,9 +2124,9 @@ Apache License
The following npm packages may be included in this product:
- @aws-sdk/signature-v4-multi-region@3.996.37
- @smithy/core@3.28.0
- @smithy/types@4.15.0
- @aws-sdk/signature-v4-multi-region@3.996.42
- @smithy/core@3.30.0
- @smithy/types@4.16.1
These packages each contain the following license:
@@ -2398,7 +2398,7 @@ SOFTWARE.
The following npm package may be included in this product:
- js-yaml@5.2.0
- js-yaml@5.2.1
This package contains the following license:
@@ -3175,7 +3175,7 @@ software or this license, under any kind of legal claim.***
The following npm package may be included in this product:
- @aws-sdk/core@3.974.25
- @aws-sdk/core@3.977.1
This package contains the following license:
@@ -3385,16 +3385,16 @@ Apache License
The following npm packages may be included in this product:
- @aws-sdk/credential-provider-env@3.972.51
- @aws-sdk/credential-provider-ini@3.972.58
- @aws-sdk/credential-provider-node@3.972.60
- @aws-sdk/token-providers@3.1077.0
- @aws-sdk/types@3.973.14
- @aws-sdk/xml-builder@3.972.32
- @smithy/credential-provider-imds@4.4.4
- @smithy/fetch-http-handler@5.6.1
- @smithy/node-http-handler@4.9.1
- @smithy/signature-v4@5.6.0
- @aws-sdk/credential-provider-env@3.972.61
- @aws-sdk/credential-provider-ini@3.973.6
- @aws-sdk/credential-provider-node@3.972.72
- @aws-sdk/token-providers@3.1095.0
- @aws-sdk/types@3.974.2
- @aws-sdk/xml-builder@3.972.37
- @smithy/credential-provider-imds@4.4.14
- @smithy/fetch-http-handler@5.6.11
- @smithy/node-http-handler@4.9.11
- @smithy/signature-v4@5.6.10
These packages each contain the following license:
@@ -3604,9 +3604,9 @@ Apache License
The following npm packages may be included in this product:
- @aws-sdk/credential-provider-process@3.972.51
- @aws-sdk/credential-provider-sso@3.972.57
- @aws-sdk/credential-provider-web-identity@3.972.57
- @aws-sdk/credential-provider-process@3.972.61
- @aws-sdk/credential-provider-sso@3.973.5
- @aws-sdk/credential-provider-web-identity@3.972.67
These packages each contain the following license:
@@ -3880,9 +3880,9 @@ END OF TERMS AND CONDITIONS
The following npm packages may be included in this product:
- @aws-sdk/credential-provider-http@3.972.53
- @aws-sdk/credential-provider-login@3.972.57
- @aws-sdk/nested-clients@3.997.25
- @aws-sdk/credential-provider-http@3.972.63
- @aws-sdk/credential-provider-login@3.972.68
- @aws-sdk/nested-clients@3.997.35
- @sigstore/verify@4.1.0
These packages each contain the following license:
@@ -4590,7 +4590,7 @@ USE OR OTHER DEALINGS IN THE SOFTWARE.
The following npm packages may be included in this product:
- brace-expansion@1.1.13
- brace-expansion@1.1.16
- brace-expansion@2.0.3
These packages each contain the following license:
@@ -5562,7 +5562,7 @@ THE SOFTWARE.
The following npm package may be included in this product:
- csv-parse@7.0.0
- csv-parse@7.0.1
This package contains the following license:
@@ -5590,6 +5590,24 @@ SOFTWARE.
-----------
The following npm package may be included in this product:
- uuid@14.0.1
This package contains the following license:
The MIT License (MIT)
Copyright (c) 2010-2020 Robert Kieffer and other contributors
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-----------
The following npm package may be included in this product:
- tunnel@0.0.6
@@ -6207,7 +6225,7 @@ THE SOFTWARE.
The following npm packages may be included in this product:
- @actions/artifact@6.2.1
- @actions/cache@6.1.0
- @actions/cache@6.2.0
- @actions/core@3.0.0
- @actions/core@3.0.1
- @actions/exec@3.0.0
+6 -4
View File
@@ -24,12 +24,14 @@
"packageManager": "yarn@4.15.0",
"dependencies": {
"@actions/core": "^3.0.1",
"@aws-sdk/client-ecr": "^3.1077.0",
"@aws-sdk/client-ecr-public": "^3.1077.0",
"@docker/actions-toolkit": "^0.92.0",
"@actions/http-client": "^4.0.1",
"@aws-sdk/client-ecr": "^3.1095.0",
"@aws-sdk/client-ecr-public": "^3.1095.0",
"@docker/actions-toolkit": "^0.94.0",
"http-proxy-agent": "^9.1.0",
"https-proxy-agent": "^9.1.0",
"js-yaml": "^5.2.0"
"js-yaml": "^5.2.1",
"uuid": "^14.0.1"
},
"devDependencies": {
"@eslint/js": "^9.39.3",
+9 -1
View File
@@ -4,12 +4,20 @@ import {Docker} from '@docker/actions-toolkit/lib/docker/docker.js';
import * as aws from './aws.js';
import * as context from './context.js';
import * as dockerhub from './dockerhub.js';
export async function login(auth: context.Auth): Promise<void> {
if (/true/i.test(auth.ecr) || (auth.ecr == 'auto' && aws.isECR(auth.registry))) {
await loginECR(auth.registry, auth.username, auth.password, auth.scope);
} else {
await loginStandard(auth.registry, auth.username, auth.password, auth.scope);
let username = auth.username;
let password = auth.password;
if (dockerhub.isDockerHubOIDC(auth.registry, password)) {
const credentials = await dockerhub.getOIDCToken(auth.registry, username);
username = credentials.username;
password = credentials.token;
}
await loginStandard(auth.registry, username, password, auth.scope);
}
}
+131
View File
@@ -0,0 +1,131 @@
import * as core from '@actions/core';
import * as httpm from '@actions/http-client';
import {HttpCodes} from '@actions/http-client';
import {validate as uuidValidate} from 'uuid';
export interface LoginCredentials {
username: string;
token: string;
}
interface OIDCTokenResponse {
access_token: string;
}
const registries = new Set(['', 'docker.io', 'registry-1.docker.io', 'registry-1-stage.docker.io', 'dhi.io']);
const defaultExpiresIn = 300;
const minExpiresIn = 300;
const maxExpiresIn = 3600;
const maxRetries = 5;
export const isDockerHubOIDC = (registry: string, password: string): boolean => {
return process.env.DOCKERHUB_OIDC_CONNECTIONID !== undefined && !password && registries.has(registry);
};
export const getOIDCToken = async (registry: string, username: string): Promise<LoginCredentials> => {
const connectionID = process.env.DOCKERHUB_OIDC_CONNECTIONID?.trim();
if (!connectionID) {
throw new Error('DOCKERHUB_OIDC_CONNECTIONID is required for Docker Hub OIDC login');
}
if (!uuidValidate(connectionID)) {
throw new Error('Invalid DOCKERHUB_OIDC_CONNECTIONID. Must be a valid UUID.');
}
const expiresIn = getExpiresIn();
const identityHost = registry === 'registry-1-stage.docker.io' ? 'identity-stage.docker.com' : 'identity.docker.com';
const audience = `https://${identityHost}`;
const idToken = await core.getIDToken(audience);
const http: httpm.HttpClient = new httpm.HttpClient('github.com/docker/login-action', [], {
headers: {
'Content-Type': 'application/x-www-form-urlencoded'
}
});
const data = new URLSearchParams();
data.set('grant_type', 'urn:ietf:params:oauth:grant-type:token-exchange');
data.set('subject_token_type', 'urn:ietf:params:oauth:token-type:id_token');
data.set('subject_token', idToken);
data.set('connection_id', connectionID);
data.set('expires_in', expiresIn.toString());
const resp = await postWithRetry(http, `https://${identityHost}/oauth/token`, data.toString());
const tokenResp = <OIDCTokenResponse>JSON.parse(await handleResponse(resp));
core.setSecret(tokenResp.access_token);
return {
username,
token: tokenResp.access_token
};
};
const getExpiresIn = (): number => {
const expiresInInput = process.env.DOCKERHUB_OIDC_EXPIREIN?.trim() || defaultExpiresIn.toString();
const expiresIn = Number(expiresInInput);
if (isNaN(expiresIn) || expiresIn < minExpiresIn || expiresIn > maxExpiresIn) {
throw new Error(`Invalid DOCKERHUB_OIDC_EXPIREIN: ${expiresInInput}. Must be between ${minExpiresIn} and ${maxExpiresIn}`);
}
return expiresIn;
};
const postWithRetry = async (http: httpm.HttpClient, url: string, data: string): Promise<httpm.HttpClientResponse> => {
let resp = await http.post(url, data);
for (let attempt = 0; (resp.message.statusCode || HttpCodes.InternalServerError) === HttpCodes.TooManyRequests && attempt < maxRetries; attempt++) {
const delay = parseRetryAfter(resp.message.headers['retry-after']);
if (delay === null) {
break;
}
await resp.readBody();
core.info(`Docker Hub OIDC token request rate limited, retrying in ${delay}ms (attempt ${attempt + 1}/${maxRetries})`);
await new Promise(resolve => setTimeout(resolve, delay));
resp = await http.post(url, data);
}
return resp;
};
const parseRetryAfter = (value: string | string[] | undefined): number | null => {
if (value === undefined) {
return null;
}
if (Array.isArray(value)) {
value = value[0];
}
const seconds = Number(value);
if (isNaN(seconds)) {
return null;
}
return Math.max(0, seconds * 1000);
};
const handleResponse = async (resp: httpm.HttpClientResponse): Promise<string> => {
const body = await resp.readBody();
const statusCode = resp.message.statusCode || HttpCodes.InternalServerError;
if (statusCode < HttpCodes.OK || statusCode >= HttpCodes.MultipleChoices) {
throw parseError(statusCode, body);
}
return body;
};
const parseError = (statusCode: number, body: string): Error => {
if (statusCode === 401) {
throw new Error(`Docker Hub API: operation not permitted`);
}
if (body) {
const errResp = parseErrorBody(body);
for (const k of ['description', 'message', 'detail', 'error']) {
if (errResp[k]) {
throw new Error(`Docker Hub API: bad status code ${statusCode}: ${errResp[k]}`);
}
}
}
throw new Error(`Docker Hub API: bad status code ${statusCode}`);
};
const parseErrorBody = (body: string): Record<string, string> => {
try {
return <Record<string, string>>JSON.parse(body);
} catch {
return {};
}
};
+227 -216
View File
@@ -34,9 +34,9 @@ __metadata:
languageName: node
linkType: hard
"@actions/cache@npm:^6.1.0":
version: 6.1.0
resolution: "@actions/cache@npm:6.1.0"
"@actions/cache@npm:^6.2.0":
version: 6.2.0
resolution: "@actions/cache@npm:6.2.0"
dependencies:
"@actions/core": "npm:^3.0.1"
"@actions/exec": "npm:^3.0.0"
@@ -47,7 +47,7 @@ __metadata:
"@azure/storage-blob": "npm:^12.31.0"
"@protobuf-ts/runtime-rpc": "npm:^2.11.1"
semver: "npm:^7.7.4"
checksum: 10/0cd89f335c1e89f514d56060110bfddc6ab1112ec0091533364c32aec2621896112cde71cfc4089b86d00f3b5478996088e4c4e0aba0aec32aae0afeb4921b3d
checksum: 10/b2b3d219d3458b6b7e8f47ff6a83a0566f0b3cd5b257e307636d2147f892e595ce8cecbc0675590a57d0eb4d4d73564d08d28753baa50934ad59a65cbee2d8fa
languageName: node
linkType: hard
@@ -170,244 +170,244 @@ __metadata:
languageName: node
linkType: hard
"@aws-sdk/client-ecr-public@npm:^3.1077.0":
version: 3.1077.0
resolution: "@aws-sdk/client-ecr-public@npm:3.1077.0"
"@aws-sdk/client-ecr-public@npm:^3.1095.0":
version: 3.1095.0
resolution: "@aws-sdk/client-ecr-public@npm:3.1095.0"
dependencies:
"@aws-sdk/core": "npm:^3.974.25"
"@aws-sdk/credential-provider-node": "npm:^3.972.60"
"@aws-sdk/types": "npm:^3.973.14"
"@smithy/core": "npm:^3.28.0"
"@smithy/fetch-http-handler": "npm:^5.6.1"
"@smithy/node-http-handler": "npm:^4.9.1"
"@smithy/types": "npm:^4.15.0"
"@aws-sdk/core": "npm:^3.977.0"
"@aws-sdk/credential-provider-node": "npm:^3.972.72"
"@aws-sdk/types": "npm:^3.974.2"
"@smithy/core": "npm:^3.29.8"
"@smithy/fetch-http-handler": "npm:^5.6.10"
"@smithy/node-http-handler": "npm:^4.9.10"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/916cf62d4db13bfcecc8023b26e9cdcc69e1df9c7daa7cbbe8b205998ccb9443251cae24fe3a06f5f20d2fbffee4e400e0714c2963dc75536a3482fd60544f53
checksum: 10/39620a474a5a7b4e77b035b9da4fa446a4a2353141528349007d22e9416340c81f9fb4e09465856df921462cd21f90ee747a034e051f4b23c85f0cd7ed427ab8
languageName: node
linkType: hard
"@aws-sdk/client-ecr@npm:^3.1077.0":
version: 3.1077.0
resolution: "@aws-sdk/client-ecr@npm:3.1077.0"
"@aws-sdk/client-ecr@npm:^3.1095.0":
version: 3.1095.0
resolution: "@aws-sdk/client-ecr@npm:3.1095.0"
dependencies:
"@aws-sdk/core": "npm:^3.974.25"
"@aws-sdk/credential-provider-node": "npm:^3.972.60"
"@aws-sdk/types": "npm:^3.973.14"
"@smithy/core": "npm:^3.28.0"
"@smithy/fetch-http-handler": "npm:^5.6.1"
"@smithy/node-http-handler": "npm:^4.9.1"
"@smithy/types": "npm:^4.15.0"
"@aws-sdk/core": "npm:^3.977.0"
"@aws-sdk/credential-provider-node": "npm:^3.972.72"
"@aws-sdk/types": "npm:^3.974.2"
"@smithy/core": "npm:^3.29.8"
"@smithy/fetch-http-handler": "npm:^5.6.10"
"@smithy/node-http-handler": "npm:^4.9.10"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/5c70110f9a3cac414701b97710ae40147e1e982ab6239ccd6a839f8726f490b548874fc4e4d968ccc548bdc187cd2864b54c2d3d5ed3bfe32285e555c6a413a8
checksum: 10/f629564991f3a20541ae34d71bf79f76a095ddb9e6566601276949b34300e4d95731998a4952fc21d3f9194e1a879c9f30d5929dbeda7de9ded8f91c10934391
languageName: node
linkType: hard
"@aws-sdk/core@npm:^3.974.25":
version: 3.974.25
resolution: "@aws-sdk/core@npm:3.974.25"
"@aws-sdk/core@npm:^3.977.0":
version: 3.977.1
resolution: "@aws-sdk/core@npm:3.977.1"
dependencies:
"@aws-sdk/types": "npm:^3.973.14"
"@aws-sdk/xml-builder": "npm:^3.972.32"
"@aws/lambda-invoke-store": "npm:^0.2.2"
"@smithy/core": "npm:^3.28.0"
"@smithy/signature-v4": "npm:^5.6.0"
"@smithy/types": "npm:^4.15.0"
"@aws-sdk/types": "npm:^3.974.2"
"@aws-sdk/xml-builder": "npm:^3.972.37"
"@aws/lambda-invoke-store": "npm:^0.3.0"
"@smithy/core": "npm:^3.29.8"
"@smithy/signature-v4": "npm:^5.6.9"
"@smithy/types": "npm:^4.16.1"
bowser: "npm:^2.11.0"
tslib: "npm:^2.6.2"
checksum: 10/25ca1498913983d8f7c2f25485d3c825e9b23a48b15eeac3e695b70fd6393f815f644b4ca11bc8145eff2dec5cbee06360ae7bcf76b5fd9dbb214fd80abe81be
checksum: 10/7828709646f5f6260123ebf9c13043650b29c6202314e9f9d463bf95600f982e89658f6edbb475737366141db9b7e3b680f3e3fd282037dd89e640975db97554
languageName: node
linkType: hard
"@aws-sdk/credential-provider-env@npm:^3.972.51":
version: 3.972.51
resolution: "@aws-sdk/credential-provider-env@npm:3.972.51"
"@aws-sdk/credential-provider-env@npm:^3.972.61":
version: 3.972.61
resolution: "@aws-sdk/credential-provider-env@npm:3.972.61"
dependencies:
"@aws-sdk/core": "npm:^3.974.25"
"@aws-sdk/types": "npm:^3.973.14"
"@smithy/core": "npm:^3.28.0"
"@smithy/types": "npm:^4.15.0"
"@aws-sdk/core": "npm:^3.977.0"
"@aws-sdk/types": "npm:^3.974.2"
"@smithy/core": "npm:^3.29.8"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/3e745169838f44f26828a6c860e32d662d9b52be6d7b63dd2407028b53567fdd24b8a2e92bfb27da73c2f71e07a051a17722bfe0c7dd5a665a0d3f302812a148
checksum: 10/baddf90e8ccc0c223f81dc3ca267e0dbdb1e88a71c862e0617f4ebaca661e33e35b60719c98293358feb5d6e044b2e38808aad49dbcba878dec3db0e78475d31
languageName: node
linkType: hard
"@aws-sdk/credential-provider-http@npm:^3.972.53":
version: 3.972.53
resolution: "@aws-sdk/credential-provider-http@npm:3.972.53"
"@aws-sdk/credential-provider-http@npm:^3.972.63":
version: 3.972.63
resolution: "@aws-sdk/credential-provider-http@npm:3.972.63"
dependencies:
"@aws-sdk/core": "npm:^3.974.25"
"@aws-sdk/types": "npm:^3.973.14"
"@smithy/core": "npm:^3.28.0"
"@smithy/fetch-http-handler": "npm:^5.6.1"
"@smithy/node-http-handler": "npm:^4.9.1"
"@smithy/types": "npm:^4.15.0"
"@aws-sdk/core": "npm:^3.977.0"
"@aws-sdk/types": "npm:^3.974.2"
"@smithy/core": "npm:^3.29.8"
"@smithy/fetch-http-handler": "npm:^5.6.10"
"@smithy/node-http-handler": "npm:^4.9.10"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/94247a81a8d0235c3eb14a2e8ac41b70314efa585ca62d0c16c0293f96a2d2f1d0b0ed947d6e15e46d0fdc565725d6d2a37d5e847523995d11f21fe254eb0094
checksum: 10/bfc63fa4a4d6b59475d005e24d22c7cb266b8caffffe06dfea68d02bbdf5bf5ae01549a79569f683651d1049f992aeb24f370b9f057e61bfa24ac9d4b68a6452
languageName: node
linkType: hard
"@aws-sdk/credential-provider-ini@npm:^3.972.58":
version: 3.972.58
resolution: "@aws-sdk/credential-provider-ini@npm:3.972.58"
"@aws-sdk/credential-provider-ini@npm:^3.973.6":
version: 3.973.6
resolution: "@aws-sdk/credential-provider-ini@npm:3.973.6"
dependencies:
"@aws-sdk/core": "npm:^3.974.25"
"@aws-sdk/credential-provider-env": "npm:^3.972.51"
"@aws-sdk/credential-provider-http": "npm:^3.972.53"
"@aws-sdk/credential-provider-login": "npm:^3.972.57"
"@aws-sdk/credential-provider-process": "npm:^3.972.51"
"@aws-sdk/credential-provider-sso": "npm:^3.972.57"
"@aws-sdk/credential-provider-web-identity": "npm:^3.972.57"
"@aws-sdk/nested-clients": "npm:^3.997.25"
"@aws-sdk/types": "npm:^3.973.14"
"@smithy/core": "npm:^3.28.0"
"@smithy/credential-provider-imds": "npm:^4.4.4"
"@smithy/types": "npm:^4.15.0"
"@aws-sdk/core": "npm:^3.977.0"
"@aws-sdk/credential-provider-env": "npm:^3.972.61"
"@aws-sdk/credential-provider-http": "npm:^3.972.63"
"@aws-sdk/credential-provider-login": "npm:^3.972.68"
"@aws-sdk/credential-provider-process": "npm:^3.972.61"
"@aws-sdk/credential-provider-sso": "npm:^3.973.5"
"@aws-sdk/credential-provider-web-identity": "npm:^3.972.67"
"@aws-sdk/nested-clients": "npm:^3.997.35"
"@aws-sdk/types": "npm:^3.974.2"
"@smithy/core": "npm:^3.29.8"
"@smithy/credential-provider-imds": "npm:^4.4.13"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/d9d0024c120fbe0de0a6436fe7d5fd8056549cfd630f385b389d131417cf06ba6848c56a45b0afad5fdeec6b850d2c1dc91fc165d47a671d904e9e1facd7001b
checksum: 10/22f3ce890538b9175263f2b28bd64056b70974d78b2298f62cc3a33a8b95449e70efcca38729a077b8cd1efd643c84295b824e71ee6237c622a37b88bd968b7b
languageName: node
linkType: hard
"@aws-sdk/credential-provider-login@npm:^3.972.57":
version: 3.972.57
resolution: "@aws-sdk/credential-provider-login@npm:3.972.57"
"@aws-sdk/credential-provider-login@npm:^3.972.68":
version: 3.972.68
resolution: "@aws-sdk/credential-provider-login@npm:3.972.68"
dependencies:
"@aws-sdk/core": "npm:^3.974.25"
"@aws-sdk/nested-clients": "npm:^3.997.25"
"@aws-sdk/types": "npm:^3.973.14"
"@smithy/core": "npm:^3.28.0"
"@smithy/types": "npm:^4.15.0"
"@aws-sdk/core": "npm:^3.977.0"
"@aws-sdk/nested-clients": "npm:^3.997.35"
"@aws-sdk/types": "npm:^3.974.2"
"@smithy/core": "npm:^3.29.8"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/22b24eedad0620c15ed78f6e02a6add822357c778acd452adf76a492a41a6750654aa01bd6a7877ee4cf96968988b305dbaf9a15278989f7960dddb53a11ddd0
checksum: 10/2ce33326c891f2043a3eeeaf1cbc3f287aac1b3ab28400d7a6a8244ae7e60858cd0fc2423abaffa7b2145028606e917b7afb05ead5c8ddcea6a5885396593b76
languageName: node
linkType: hard
"@aws-sdk/credential-provider-node@npm:^3.972.60":
version: 3.972.60
resolution: "@aws-sdk/credential-provider-node@npm:3.972.60"
"@aws-sdk/credential-provider-node@npm:^3.972.72":
version: 3.972.72
resolution: "@aws-sdk/credential-provider-node@npm:3.972.72"
dependencies:
"@aws-sdk/credential-provider-env": "npm:^3.972.51"
"@aws-sdk/credential-provider-http": "npm:^3.972.53"
"@aws-sdk/credential-provider-ini": "npm:^3.972.58"
"@aws-sdk/credential-provider-process": "npm:^3.972.51"
"@aws-sdk/credential-provider-sso": "npm:^3.972.57"
"@aws-sdk/credential-provider-web-identity": "npm:^3.972.57"
"@aws-sdk/types": "npm:^3.973.14"
"@smithy/core": "npm:^3.28.0"
"@smithy/credential-provider-imds": "npm:^4.4.4"
"@smithy/types": "npm:^4.15.0"
"@aws-sdk/credential-provider-env": "npm:^3.972.61"
"@aws-sdk/credential-provider-http": "npm:^3.972.63"
"@aws-sdk/credential-provider-ini": "npm:^3.973.6"
"@aws-sdk/credential-provider-process": "npm:^3.972.61"
"@aws-sdk/credential-provider-sso": "npm:^3.973.5"
"@aws-sdk/credential-provider-web-identity": "npm:^3.972.67"
"@aws-sdk/types": "npm:^3.974.2"
"@smithy/core": "npm:^3.29.8"
"@smithy/credential-provider-imds": "npm:^4.4.13"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/5249e3bf1ded99f207ef8b4c80c4c19ab934115304790916def3f29877061c850e3089f71fd65cca3688327763175837a86f5afa100ef926c9749782ca0b7a44
checksum: 10/a13f48bfce124ce2592654f775ccc9016b633ba14eec3e7d3a28d83b042ff8c0aaac328a86e55765a5a1597ffc6c5d5aa5dbc85b84f779680c6714ac6e8ed9a5
languageName: node
linkType: hard
"@aws-sdk/credential-provider-process@npm:^3.972.51":
version: 3.972.51
resolution: "@aws-sdk/credential-provider-process@npm:3.972.51"
"@aws-sdk/credential-provider-process@npm:^3.972.61":
version: 3.972.61
resolution: "@aws-sdk/credential-provider-process@npm:3.972.61"
dependencies:
"@aws-sdk/core": "npm:^3.974.25"
"@aws-sdk/types": "npm:^3.973.14"
"@smithy/core": "npm:^3.28.0"
"@smithy/types": "npm:^4.15.0"
"@aws-sdk/core": "npm:^3.977.0"
"@aws-sdk/types": "npm:^3.974.2"
"@smithy/core": "npm:^3.29.8"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/bdbd1dbd6aadbc8737b03ff776fc3b9c8d7c773214f35113ac7cb796f56bbb9ae141cf282b15a5a17b77c5f06133a28fdbd363053772f5aad9021bd08d777e8d
checksum: 10/89e4a93aa498a78baec8a97dcfbae10e921b6844c9680ca717e207940d3ae6badd7b3002a6aa61efc5166a1c2b18175da1888128103b16b1228e4a52f223dbb4
languageName: node
linkType: hard
"@aws-sdk/credential-provider-sso@npm:^3.972.57":
version: 3.972.57
resolution: "@aws-sdk/credential-provider-sso@npm:3.972.57"
"@aws-sdk/credential-provider-sso@npm:^3.973.5":
version: 3.973.5
resolution: "@aws-sdk/credential-provider-sso@npm:3.973.5"
dependencies:
"@aws-sdk/core": "npm:^3.974.25"
"@aws-sdk/nested-clients": "npm:^3.997.25"
"@aws-sdk/token-providers": "npm:3.1077.0"
"@aws-sdk/types": "npm:^3.973.14"
"@smithy/core": "npm:^3.28.0"
"@smithy/types": "npm:^4.15.0"
"@aws-sdk/core": "npm:^3.977.0"
"@aws-sdk/nested-clients": "npm:^3.997.35"
"@aws-sdk/token-providers": "npm:3.1095.0"
"@aws-sdk/types": "npm:^3.974.2"
"@smithy/core": "npm:^3.29.8"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/53fa4e00bcedd8673ac271503dfe452d3c4076ac780bb381012b0f71732511dcb63e83211b544db1f0bedc667925629af5dc5b3b5fa0e8c11372a4211cbf135d
checksum: 10/db1f4ea8408a42eb074329f033917ef49ce94e31678a0a49598543a74ccc10bfb0d3127717b29b0f7988dd44ba21bc4ab1e0fca94a0c80266577f7d764df7ea9
languageName: node
linkType: hard
"@aws-sdk/credential-provider-web-identity@npm:^3.972.57":
version: 3.972.57
resolution: "@aws-sdk/credential-provider-web-identity@npm:3.972.57"
"@aws-sdk/credential-provider-web-identity@npm:^3.972.67":
version: 3.972.67
resolution: "@aws-sdk/credential-provider-web-identity@npm:3.972.67"
dependencies:
"@aws-sdk/core": "npm:^3.974.25"
"@aws-sdk/nested-clients": "npm:^3.997.25"
"@aws-sdk/types": "npm:^3.973.14"
"@smithy/core": "npm:^3.28.0"
"@smithy/types": "npm:^4.15.0"
"@aws-sdk/core": "npm:^3.977.0"
"@aws-sdk/nested-clients": "npm:^3.997.35"
"@aws-sdk/types": "npm:^3.974.2"
"@smithy/core": "npm:^3.29.8"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/e3db324879b623695584fe4e591a360d930c82dc276fea4d344e537df29c1c821c52886562af51008573d0357e132fe6676a99ac49b545368f8e82ebd94a58f4
checksum: 10/2381ae9fe9805b91da97ca8a5a9856dd6e91d244f433e0f1ecb9049870beed601d4b514e0d6f872d8e9453f60a6cf43627ff2d387f685547d976128bb91d6e45
languageName: node
linkType: hard
"@aws-sdk/nested-clients@npm:^3.997.25":
version: 3.997.25
resolution: "@aws-sdk/nested-clients@npm:3.997.25"
"@aws-sdk/nested-clients@npm:^3.997.35":
version: 3.997.35
resolution: "@aws-sdk/nested-clients@npm:3.997.35"
dependencies:
"@aws-sdk/core": "npm:^3.974.25"
"@aws-sdk/signature-v4-multi-region": "npm:^3.996.37"
"@aws-sdk/types": "npm:^3.973.14"
"@smithy/core": "npm:^3.28.0"
"@smithy/fetch-http-handler": "npm:^5.6.1"
"@smithy/node-http-handler": "npm:^4.9.1"
"@smithy/types": "npm:^4.15.0"
"@aws-sdk/core": "npm:^3.977.0"
"@aws-sdk/signature-v4-multi-region": "npm:^3.996.42"
"@aws-sdk/types": "npm:^3.974.2"
"@smithy/core": "npm:^3.29.8"
"@smithy/fetch-http-handler": "npm:^5.6.10"
"@smithy/node-http-handler": "npm:^4.9.10"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/6e9507477672572d90e7802526f133b9956adb6306f401b51c1f76b55b60e93297943d9927e531cecba63303a157757bfadbf14524e164688a515e351f57d9de
checksum: 10/ee0410e54978819a2173d92548054ff34518b874c9d8979e94e388661784fe45efc4317495a9ee491d5180a7d9ebec9cac8308493a892712a8f3d96d135a4dd3
languageName: node
linkType: hard
"@aws-sdk/signature-v4-multi-region@npm:^3.996.37":
version: 3.996.37
resolution: "@aws-sdk/signature-v4-multi-region@npm:3.996.37"
"@aws-sdk/signature-v4-multi-region@npm:^3.996.42":
version: 3.996.42
resolution: "@aws-sdk/signature-v4-multi-region@npm:3.996.42"
dependencies:
"@aws-sdk/types": "npm:^3.973.14"
"@smithy/signature-v4": "npm:^5.6.0"
"@smithy/types": "npm:^4.15.0"
"@aws-sdk/types": "npm:^3.974.2"
"@smithy/signature-v4": "npm:^5.6.9"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/16608054281ae2b29c409ef772572f27d51c05269efc5965bfb2a72405675fb2449087d635f62e9e6438a73cf2edad15c1161287ddb2672ad8f08e8bc598df0a
checksum: 10/05c6027f1938da947ec33706ec70ebbddb6a7596709a47dca316344378277015be2b5c1891a3810a7ac759ceb6ca0830bc8dcce55b26e11a392ecdf7b4d1c3c1
languageName: node
linkType: hard
"@aws-sdk/token-providers@npm:3.1077.0":
version: 3.1077.0
resolution: "@aws-sdk/token-providers@npm:3.1077.0"
"@aws-sdk/token-providers@npm:3.1095.0":
version: 3.1095.0
resolution: "@aws-sdk/token-providers@npm:3.1095.0"
dependencies:
"@aws-sdk/core": "npm:^3.974.25"
"@aws-sdk/nested-clients": "npm:^3.997.25"
"@aws-sdk/types": "npm:^3.973.14"
"@smithy/core": "npm:^3.28.0"
"@smithy/types": "npm:^4.15.0"
"@aws-sdk/core": "npm:^3.977.0"
"@aws-sdk/nested-clients": "npm:^3.997.35"
"@aws-sdk/types": "npm:^3.974.2"
"@smithy/core": "npm:^3.29.8"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/7b026fd9a234c52424dba53c86208143dc87b009efee933cee5522ac815e77ac567cc25fba013df34b3616268697f36737ad47c4a9e274da57519d4c5cf024f4
checksum: 10/b2b2df9ee103b76ba9efb9e8d1df1f90ef3eff488c984d62ba35e8b9498a8828b16987f930c2b0ee8cb9efec0998224de6604f5a9e45f692927cb1e9aec67381
languageName: node
linkType: hard
"@aws-sdk/types@npm:^3.973.14":
version: 3.973.14
resolution: "@aws-sdk/types@npm:3.973.14"
"@aws-sdk/types@npm:^3.974.2":
version: 3.974.2
resolution: "@aws-sdk/types@npm:3.974.2"
dependencies:
"@smithy/types": "npm:^4.15.0"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/2c960877e3d5bb83b81a2974bc8aab86baa83053179e8fb1a77fde223138a64f5e14bc95d20146292af7eed499dd2b38aefd47ae68b5f746828abea8532e96a8
checksum: 10/12a2a3c13507211881d91d9186c0d20b138a569ab8e1937744393d2bcb14dc01257a97de42dd7ef002500a49f0237ce1faeb11e5a9c607d4ad16fd63357cefee
languageName: node
linkType: hard
"@aws-sdk/xml-builder@npm:^3.972.32":
version: 3.972.32
resolution: "@aws-sdk/xml-builder@npm:3.972.32"
"@aws-sdk/xml-builder@npm:^3.972.37":
version: 3.972.37
resolution: "@aws-sdk/xml-builder@npm:3.972.37"
dependencies:
"@smithy/types": "npm:^4.15.0"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/d42371e477fb55823d406fac361bd2288af56284c52265dfeaa60191f90fc4f9105760df23e803fd5e1ea7bb14cd2567bb101e551d06417dad8bbd16568cf452
checksum: 10/20f221d158a12cb39b117e65cde8ecb19f629d5292def76adee8680dad176cf6c9f0e83a3534c65bcd40ffaf5fa8a2afd62de262c4c00b355d1c8c057c261acb
languageName: node
linkType: hard
"@aws/lambda-invoke-store@npm:^0.2.2":
version: 0.2.3
resolution: "@aws/lambda-invoke-store@npm:0.2.3"
checksum: 10/d0efa8ca73b2d8dc0bf634525eefa1b72cda85f5d47366264849343a6f2860cfa5c52b7f766a16b78da8406bbd3ee975da3abb1dbe38183f8af95413eafeb256
"@aws/lambda-invoke-store@npm:^0.3.0":
version: 0.3.0
resolution: "@aws/lambda-invoke-store@npm:0.3.0"
checksum: 10/4a6c7af16477dd330d4dcd2269f89370be68295b54ae1e90ef8c2175efa4df6735f9a3f914ab7efa21ba7db5477031fe8488853adcd268eeb6cb8e34ad06b206
languageName: node
linkType: hard
@@ -677,12 +677,12 @@ __metadata:
languageName: node
linkType: hard
"@docker/actions-toolkit@npm:^0.92.0":
version: 0.92.0
resolution: "@docker/actions-toolkit@npm:0.92.0"
"@docker/actions-toolkit@npm:^0.94.0":
version: 0.94.0
resolution: "@docker/actions-toolkit@npm:0.94.0"
dependencies:
"@actions/artifact": "npm:^6.2.1"
"@actions/cache": "npm:^6.1.0"
"@actions/cache": "npm:^6.2.0"
"@actions/core": "npm:^3.0.1"
"@actions/exec": "npm:^3.0.0"
"@actions/github": "npm:^9.1.1"
@@ -693,16 +693,16 @@ __metadata:
"@sigstore/tuf": "npm:^5.0.0"
"@sigstore/verify": "npm:^4.1.0"
async-retry: "npm:^1.3.3"
csv-parse: "npm:^7.0.0"
csv-parse: "npm:^7.0.1"
gunzip-maybe: "npm:^1.4.2"
handlebars: "npm:^4.7.9"
he: "npm:^1.2.0"
js-yaml: "npm:^5.2.0"
js-yaml: "npm:^5.2.1"
jwt-decode: "npm:^4.0.0"
semver: "npm:^7.8.5"
tar-stream: "npm:^3.2.0"
tmp: "npm:^0.2.7"
checksum: 10/599cea84b897069c53744a2f05371c6d9ad60da18448b4431273529b92fd2d77ddc718ee205cf0bf1da53083d412da90b1067f1e64a5fdac73fe71d486726064
checksum: 10/96f7b3e488dd50db0b77575e1a2bd7e92506b1a2695d5c31a57d361e4dc07871ef1a14a7ab87bf6fe27af2f817d34351c2e289446b126675a20d9776fe5ab8ce
languageName: node
linkType: hard
@@ -1956,66 +1956,66 @@ __metadata:
languageName: node
linkType: hard
"@smithy/core@npm:^3.28.0":
version: 3.28.0
resolution: "@smithy/core@npm:3.28.0"
"@smithy/core@npm:^3.29.8, @smithy/core@npm:^3.30.0":
version: 3.30.0
resolution: "@smithy/core@npm:3.30.0"
dependencies:
"@smithy/types": "npm:^4.15.0"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/b8fe9db961112b8dd36b48c9d692d0cbe83be3a5962b51874f52079a22595674a9bc30c01bb3868da74e0c9ab328cac1f71405982432434be3e5d9d57777b5d7
checksum: 10/3525dd3b075c9c54119b6385fded81a82beba34df93d866d118653bdef8e7a3cbece7684cfa28687c2b9ec92131c4fa21d38f1951ec4c29e71c743bcf17856cd
languageName: node
linkType: hard
"@smithy/credential-provider-imds@npm:^4.4.4":
version: 4.4.4
resolution: "@smithy/credential-provider-imds@npm:4.4.4"
"@smithy/credential-provider-imds@npm:^4.4.13":
version: 4.4.14
resolution: "@smithy/credential-provider-imds@npm:4.4.14"
dependencies:
"@smithy/core": "npm:^3.28.0"
"@smithy/types": "npm:^4.15.0"
"@smithy/core": "npm:^3.30.0"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/47950acf6e89480592466fec4e7e5d6eed8ff9b939d76ef83a584b39067c593ce06df2616f354fda084b284af1406ac9a82d759a38623066b28ad7efe05a736b
checksum: 10/f0ce754433b48d11d734c8c7ed0c6770f1d2a8e1e0b30cfe9396d8be75a2bc50a392e0f2ce8ece4557d17186c7975b1498d68995e5b533dd284030dcf0bd38c5
languageName: node
linkType: hard
"@smithy/fetch-http-handler@npm:^5.6.1":
version: 5.6.1
resolution: "@smithy/fetch-http-handler@npm:5.6.1"
"@smithy/fetch-http-handler@npm:^5.6.10":
version: 5.6.11
resolution: "@smithy/fetch-http-handler@npm:5.6.11"
dependencies:
"@smithy/core": "npm:^3.28.0"
"@smithy/types": "npm:^4.15.0"
"@smithy/core": "npm:^3.30.0"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/e7a841ef750fcfd936e274cd1bd011d0749328d7597e9d5ba8ed286be883fde25e6629315428502aec343c072c826ed512dd26a08ee33609884812cbbc1e2d84
checksum: 10/381ccd03e229f155bfcc6a03fb57cb56e8a9da98f806b4a4ccfa0e55f40f61958b5c9f3f63856bd4ef1accb2d3a090c21a9df8999b28931c42d05438c239533c
languageName: node
linkType: hard
"@smithy/node-http-handler@npm:^4.9.1":
version: 4.9.1
resolution: "@smithy/node-http-handler@npm:4.9.1"
"@smithy/node-http-handler@npm:^4.9.10":
version: 4.9.11
resolution: "@smithy/node-http-handler@npm:4.9.11"
dependencies:
"@smithy/core": "npm:^3.28.0"
"@smithy/types": "npm:^4.15.0"
"@smithy/core": "npm:^3.30.0"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/d12b489b301b71767036a33c3c6736f4f37ea5ae8f147b054acbebaf3a5b02df05cba38b764813fa0cd24cde3c3faa22842bda31e0840bb4d79dd737f801d82e
checksum: 10/d07a049affdf2f736cc11039e688bc6df73311d3a8de87618b32382f1c6ec09420899ab3550f633d295a9993c22257ae860af621bf65988b6e4329c52f38848c
languageName: node
linkType: hard
"@smithy/signature-v4@npm:^5.6.0":
version: 5.6.0
resolution: "@smithy/signature-v4@npm:5.6.0"
"@smithy/signature-v4@npm:^5.6.9":
version: 5.6.10
resolution: "@smithy/signature-v4@npm:5.6.10"
dependencies:
"@smithy/core": "npm:^3.28.0"
"@smithy/types": "npm:^4.15.0"
"@smithy/core": "npm:^3.30.0"
"@smithy/types": "npm:^4.16.1"
tslib: "npm:^2.6.2"
checksum: 10/e4036321b89bc522d2c1edad6e70151c155dc0e4780a0d828cfdf941d5f8a871fda50912e7b9ed87172916761e84e50030b05f020523873232877b3f814f0b8c
checksum: 10/1c35391afb685a7e77518e164d335f03561bb363a45854a6b587a1508e847aa7c402e48629b1f0cbd1817946034359d52a7190145b5bed47cbd89b7bdcf75824
languageName: node
linkType: hard
"@smithy/types@npm:^4.15.0":
version: 4.15.0
resolution: "@smithy/types@npm:4.15.0"
"@smithy/types@npm:^4.16.1":
version: 4.16.1
resolution: "@smithy/types@npm:4.16.1"
dependencies:
tslib: "npm:^2.6.2"
checksum: 10/e41a84ec3eb9feb45040ccd541b1cacf0fc2375297802886459cb9311ff361080978c08ef98e9ad69f41d80ad212279d682a8fe30a993381b2f1dd376c1006c3
checksum: 10/23651203f2e8800b2b2311ef163ddec166d91e15b30fa1c877be352aeef8ae7cc7b0189f99e07b0dcd52160b10adfb3fa4ca32c38a2d7195fc5428b8986d5201
languageName: node
linkType: hard
@@ -2762,12 +2762,12 @@ __metadata:
linkType: hard
"brace-expansion@npm:^1.1.7":
version: 1.1.13
resolution: "brace-expansion@npm:1.1.13"
version: 1.1.16
resolution: "brace-expansion@npm:1.1.16"
dependencies:
balanced-match: "npm:^1.0.0"
concat-map: "npm:0.0.1"
checksum: 10/b5f4329fdbe9d2e25fa250c8f866ebd054ba946179426e99b86dcccddabdb1d481f0e40ee5430032e62a7d0a6c2837605ace6783d015aa1d65d85ca72154d936
checksum: 10/94498bead66c51536df5b7bf1b0a0e581a5b7f86888be10481d06920c4bd9d976e003b13a3d19fddc733f21a09d162ff72f90e18b2c9d062b15121e973d0e13b
languageName: node
linkType: hard
@@ -3103,10 +3103,10 @@ __metadata:
languageName: node
linkType: hard
"csv-parse@npm:^7.0.0":
version: 7.0.0
resolution: "csv-parse@npm:7.0.0"
checksum: 10/53c96e6b4ff80047713bb4d2967d06495890d4b628284a80271860be089fdb5a74cd97c76fd535a00ad26b11cc6e4fc5a243658e5377c0a6334ddd104620d169
"csv-parse@npm:^7.0.1":
version: 7.0.1
resolution: "csv-parse@npm:7.0.1"
checksum: 10/5c914f01181dbb381068b98e17b49361d853faa95db3e8e82bc96b6a0de5313ecc8325a77db35ff66644d7747099965ba3167ec21bd9ce4500edf21b5bdd49bf
languageName: node
linkType: hard
@@ -3155,9 +3155,10 @@ __metadata:
resolution: "docker-login@workspace:."
dependencies:
"@actions/core": "npm:^3.0.1"
"@aws-sdk/client-ecr": "npm:^3.1077.0"
"@aws-sdk/client-ecr-public": "npm:^3.1077.0"
"@docker/actions-toolkit": "npm:^0.92.0"
"@actions/http-client": "npm:^4.0.1"
"@aws-sdk/client-ecr": "npm:^3.1095.0"
"@aws-sdk/client-ecr-public": "npm:^3.1095.0"
"@docker/actions-toolkit": "npm:^0.94.0"
"@eslint/js": "npm:^9.39.3"
"@types/js-yaml": "npm:^4.0.9"
"@types/node": "npm:^24.11.0"
@@ -3173,9 +3174,10 @@ __metadata:
globals: "npm:^17.3.0"
http-proxy-agent: "npm:^9.1.0"
https-proxy-agent: "npm:^9.1.0"
js-yaml: "npm:^5.2.0"
js-yaml: "npm:^5.2.1"
prettier: "npm:^3.8.1"
typescript: "npm:^5.9.3"
uuid: "npm:^14.0.1"
vitest: "npm:^4.0.18"
languageName: unknown
linkType: soft
@@ -4344,14 +4346,14 @@ __metadata:
languageName: node
linkType: hard
"js-yaml@npm:^5.2.0":
version: 5.2.0
resolution: "js-yaml@npm:5.2.0"
"js-yaml@npm:^5.2.1":
version: 5.2.1
resolution: "js-yaml@npm:5.2.1"
dependencies:
argparse: "npm:^2.0.1"
bin:
js-yaml: bin/js-yaml.mjs
checksum: 10/8a5e55c5d0fcafae4ac02114a99dc070048b8e5a82a056089ce1f69f8a00fd8eb05b622e76ad50aac1f9d409010636c9616c6b2ed4e58dae138379a60d301220
checksum: 10/e1eca2d21c15572585bb236d9fde31d6789eb50b9c63e8753fa7e0777bc480f7521cad517bd7a0c66f27dfc27ddcd7100beeefa51c1a50e10e98f2e009633c3d
languageName: node
linkType: hard
@@ -6300,6 +6302,15 @@ __metadata:
languageName: node
linkType: hard
"uuid@npm:^14.0.1":
version: 14.0.1
resolution: "uuid@npm:14.0.1"
bin:
uuid: dist-node/bin/uuid
checksum: 10/0f978fd5b0269d7acb615342aeb131f0b8d85eeb8ec34f2915d906baa3befcc14a079a430d0f8116aec6fd20c850cbfab65d1b3d1643fa81ed373c0cf9574f18
languageName: node
linkType: hard
"validate-npm-package-name@npm:^7.0.0":
version: 7.0.2
resolution: "validate-npm-package-name@npm:7.0.2"