From d4fb9e3c4b6769bc83a42f20fe4297adc6c5e732 Mon Sep 17 00:00:00 2001 From: Lior Poterman <191881919+cx-lior-poterman@users.noreply.github.com> Date: Mon, 24 Aug 2026 15:25:06 +0300 Subject: [PATCH] fix(ci): use Docker Hub OIDC federation in release pipeline The release workflow's Docker Hub login step used static username/password credentials via step-security/docker-login-action v4.1.0, which predates OIDC support. Bump the action to v4.5.1 and switch to OIDC federation using vars.DOCKERHUB_USERNAME and secrets.DOCKERHUB_OIDC_CONNECTIONID, which are already configured on the repo's release GitHub Environment. The job already declares environment: release and id-token: write, so no permissions changes are needed. This removes the last static Docker Hub credential from the release pipeline. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 806ec9fb..79e7f4c9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -135,10 +135,11 @@ jobs: docker info - name: Login to Docker Hub if: inputs.dev == false - uses: step-security/docker-login-action@870af644803bf9f204aed474adbad2958fec048b # v4.1.0 + uses: step-security/docker-login-action@bd6978fd4ef9a5f78130095b298b8a721afcb0d8 # v4.5.1 with: - username: ${{ env.DOCKER_USERNAME }} - password: ${{ env.DOCKER_PASSWORD }} + username: ${{ vars.DOCKERHUB_USERNAME }} + env: + DOCKERHUB_OIDC_CONNECTIONID: ${{ secrets.DOCKERHUB_OIDC_CONNECTIONID }} - name: Install Cosign if: inputs.dev == false