diff --git a/.github/workflows/.test-bake.yml b/.github/workflows/.test-bake.yml index e122f48c..4db2aa63 100644 --- a/.github/workflows/.test-bake.yml +++ b/.github/workflows/.test-bake.yml @@ -49,6 +49,7 @@ jobs: registry: docker.io username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} + expires_in: 7200 meta-images: | docker.io/dockereng/github-builder-test meta-tags: | @@ -69,6 +70,7 @@ jobs: registry: docker.io username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} + expires_in: 7200 bake-dockerhub-single-outputs: runs-on: ubuntu-26.04 diff --git a/.github/workflows/.test-build.yml b/.github/workflows/.test-build.yml index 65038afd..b9317cfc 100644 --- a/.github/workflows/.test-build.yml +++ b/.github/workflows/.test-build.yml @@ -48,6 +48,7 @@ jobs: registry: docker.io username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} + expires_in: 7200 meta-images: | docker.io/dockereng/github-builder-test meta-tags: | @@ -68,6 +69,7 @@ jobs: registry: docker.io username: ${{ vars.DOCKERHUB_OIDC_USERNAME }} connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }} + expires_in: 7200 build-dockerhub-single-outputs: runs-on: ubuntu-26.04 diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml index 8f03906c..10b5b5a7 100644 --- a/.github/workflows/bake.yml +++ b/.github/workflows/bake.yml @@ -760,6 +760,7 @@ jobs: uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: token_format: access_token + access_token_lifetime: ${{ format('{0}s', needs.registry-identities.outputs.gcp-wif-expires-in || '3600') }} workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }} service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }} project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }} @@ -780,6 +781,7 @@ jobs: uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0 env: DOCKERHUB_OIDC_CONNECTIONID: ${{ needs.registry-identities.outputs.dockerhub-oidc-connection-id }} + DOCKERHUB_OIDC_EXPIREIN: ${{ needs.registry-identities.outputs.dockerhub-oidc-expires-in || '3600' }} with: registry-auth: | - registry: ${{ needs.registry-identities.outputs.dockerhub-oidc-registry }} @@ -1037,6 +1039,7 @@ jobs: uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: token_format: access_token + access_token_lifetime: ${{ format('{0}s', needs.registry-identities.outputs.gcp-wif-expires-in || '3600') }} workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }} service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }} project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }} @@ -1057,6 +1060,7 @@ jobs: uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0 env: DOCKERHUB_OIDC_CONNECTIONID: ${{ needs.registry-identities.outputs.dockerhub-oidc-connection-id }} + DOCKERHUB_OIDC_EXPIREIN: ${{ needs.registry-identities.outputs.dockerhub-oidc-expires-in || '3600' }} DOCKER_LOGIN_SCOPE_DISABLED: true # make signing credentials available outside Buildx scoped configuration with: registry-auth: | @@ -1275,6 +1279,7 @@ jobs: uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: token_format: access_token + access_token_lifetime: ${{ format('{0}s', needs.registry-identities.outputs.gcp-wif-expires-in || '3600') }} workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }} service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }} project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }} @@ -1295,6 +1300,7 @@ jobs: uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0 env: DOCKERHUB_OIDC_CONNECTIONID: ${{ needs.registry-identities.outputs.dockerhub-oidc-connection-id }} + DOCKERHUB_OIDC_EXPIREIN: ${{ needs.registry-identities.outputs.dockerhub-oidc-expires-in || '3600' }} with: registry-auth: | - registry: ${{ needs.registry-identities.outputs.dockerhub-oidc-registry }} diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 492a925c..bbfc0043 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -690,6 +690,7 @@ jobs: uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: token_format: access_token + access_token_lifetime: ${{ format('{0}s', needs.registry-identities.outputs.gcp-wif-expires-in || '3600') }} workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }} service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }} project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }} @@ -710,6 +711,7 @@ jobs: uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0 env: DOCKERHUB_OIDC_CONNECTIONID: ${{ needs.registry-identities.outputs.dockerhub-oidc-connection-id }} + DOCKERHUB_OIDC_EXPIREIN: ${{ needs.registry-identities.outputs.dockerhub-oidc-expires-in || '3600' }} with: registry-auth: | - registry: ${{ needs.registry-identities.outputs.dockerhub-oidc-registry }} @@ -934,6 +936,7 @@ jobs: uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: token_format: access_token + access_token_lifetime: ${{ format('{0}s', needs.registry-identities.outputs.gcp-wif-expires-in || '3600') }} workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }} service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }} project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }} @@ -954,6 +957,7 @@ jobs: uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0 env: DOCKERHUB_OIDC_CONNECTIONID: ${{ needs.registry-identities.outputs.dockerhub-oidc-connection-id }} + DOCKERHUB_OIDC_EXPIREIN: ${{ needs.registry-identities.outputs.dockerhub-oidc-expires-in || '3600' }} DOCKER_LOGIN_SCOPE_DISABLED: true # make signing credentials available outside Buildx scoped configuration with: registry-auth: | @@ -1171,6 +1175,7 @@ jobs: uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: token_format: access_token + access_token_lifetime: ${{ format('{0}s', needs.registry-identities.outputs.gcp-wif-expires-in || '3600') }} workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }} service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }} project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }} @@ -1191,6 +1196,7 @@ jobs: uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0 env: DOCKERHUB_OIDC_CONNECTIONID: ${{ needs.registry-identities.outputs.dockerhub-oidc-connection-id }} + DOCKERHUB_OIDC_EXPIREIN: ${{ needs.registry-identities.outputs.dockerhub-oidc-expires-in || '3600' }} with: registry-auth: | - registry: ${{ needs.registry-identities.outputs.dockerhub-oidc-registry }} diff --git a/.github/workflows/setup-registry-identities.yml b/.github/workflows/setup-registry-identities.yml index b926d17a..be20cdc2 100644 --- a/.github/workflows/setup-registry-identities.yml +++ b/.github/workflows/setup-registry-identities.yml @@ -43,6 +43,9 @@ on: gcp-wif-project-id: description: "GCP project ID" value: ${{ jobs.setup-registry-identities.outputs.gcp-wif-project-id }} + gcp-wif-expires-in: + description: "GCP access token lifetime in seconds" + value: ${{ jobs.setup-registry-identities.outputs.gcp-wif-expires-in }} dockerhub-oidc-enabled: description: "Whether a Docker Hub OIDC registry identity was configured" value: ${{ jobs.setup-registry-identities.outputs.dockerhub-oidc-enabled }} @@ -55,6 +58,9 @@ on: dockerhub-oidc-connection-id: description: "Docker Hub OIDC connection ID" value: ${{ jobs.setup-registry-identities.outputs.dockerhub-oidc-connection-id }} + dockerhub-oidc-expires-in: + description: "Docker Hub OIDC token lifetime in seconds" + value: ${{ jobs.setup-registry-identities.outputs.dockerhub-oidc-expires-in }} dockerhub-oidc-scope: description: "Docker Hub authentication scope" value: ${{ jobs.setup-registry-identities.outputs.dockerhub-oidc-scope }} @@ -113,10 +119,12 @@ jobs: gcp-wif-workload-identity-provider: ${{ steps.validate.outputs.gcp-wif-workload-identity-provider }} gcp-wif-service-account: ${{ steps.validate.outputs.gcp-wif-service-account }} gcp-wif-project-id: ${{ steps.validate.outputs.gcp-wif-project-id }} + gcp-wif-expires-in: ${{ steps.validate.outputs.gcp-wif-expires-in }} dockerhub-oidc-enabled: ${{ steps.validate.outputs.dockerhub-oidc-enabled }} dockerhub-oidc-registry: ${{ steps.validate.outputs.dockerhub-oidc-registry }} dockerhub-oidc-username: ${{ steps.validate.outputs.dockerhub-oidc-username }} dockerhub-oidc-connection-id: ${{ steps.validate.outputs.dockerhub-oidc-connection-id }} + dockerhub-oidc-expires-in: ${{ steps.validate.outputs.dockerhub-oidc-expires-in }} dockerhub-oidc-scope: ${{ steps.validate.outputs.dockerhub-oidc-scope }} azure-acr-enabled: ${{ steps.validate.outputs.azure-acr-enabled }} azure-acr-registry: ${{ steps.validate.outputs.azure-acr-registry }} @@ -186,10 +194,12 @@ jobs: core.setOutput('gcp-wif-workload-identity-provider', ''); core.setOutput('gcp-wif-service-account', ''); core.setOutput('gcp-wif-project-id', ''); + core.setOutput('gcp-wif-expires-in', ''); core.setOutput('dockerhub-oidc-enabled', 'false'); core.setOutput('dockerhub-oidc-registry', ''); core.setOutput('dockerhub-oidc-username', ''); core.setOutput('dockerhub-oidc-connection-id', ''); + core.setOutput('dockerhub-oidc-expires-in', ''); core.setOutput('dockerhub-oidc-scope', ''); core.setOutput('azure-acr-enabled', 'false'); core.setOutput('azure-acr-registry', ''); @@ -246,10 +256,12 @@ jobs: core.setOutput('gcp-wif-workload-identity-provider', gcpWif?.workloadIdentityProvider || ''); core.setOutput('gcp-wif-service-account', gcpWif?.serviceAccount || ''); core.setOutput('gcp-wif-project-id', gcpWif?.projectId || ''); + core.setOutput('gcp-wif-expires-in', gcpWif?.expiresIn ?? ''); core.setOutput('dockerhub-oidc-enabled', dockerhubOidc ? 'true' : 'false'); core.setOutput('dockerhub-oidc-registry', dockerhubOidc?.registry || ''); core.setOutput('dockerhub-oidc-username', dockerhubOidc?.username || ''); core.setOutput('dockerhub-oidc-connection-id', dockerhubOidc?.connectionID || ''); + core.setOutput('dockerhub-oidc-expires-in', dockerhubOidc?.expiresIn ?? ''); core.setOutput('dockerhub-oidc-scope', dockerhubOidc?.scope || ''); core.setOutput('azure-acr-enabled', azureAcr ? 'true' : 'false'); core.setOutput('azure-acr-registry', azureAcr?.registry || ''); diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml index d18bd4c7..41df7127 100644 --- a/.github/workflows/verify.yml +++ b/.github/workflows/verify.yml @@ -139,6 +139,7 @@ jobs: uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 with: token_format: access_token + access_token_lifetime: ${{ format('{0}s', needs.registry-identities.outputs.gcp-wif-expires-in || '3600') }} workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }} service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }} project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }} @@ -159,6 +160,7 @@ jobs: uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0 env: DOCKERHUB_OIDC_CONNECTIONID: ${{ needs.registry-identities.outputs.dockerhub-oidc-connection-id }} + DOCKERHUB_OIDC_EXPIREIN: ${{ needs.registry-identities.outputs.dockerhub-oidc-expires-in || '3600' }} with: registry-auth: | - registry: ${{ needs.registry-identities.outputs.dockerhub-oidc-registry }} diff --git a/README.md b/README.md index 810a5637..b7e3e246 100644 --- a/README.md +++ b/README.md @@ -555,6 +555,7 @@ jobs: | `registry` | String | No | Registry hostname passed to `docker/login-action`. Defaults to `docker.io`. | | `username` | String | Yes | Docker Hub username or organization passed to `docker/login-action`. | | `connection_id` | String | Yes | Docker Hub OIDC connection ID passed to `docker/login-action` in each job. | +| `expires_in` | Number | No | Token lifetime in seconds, from `300` to `21600`. Defaults to `3600`. | | `scope` | String | No | [Authentication scope](https://github.com/docker/login-action#set-scopes-for-the-authentication-token) for `docker/login-action`. | The workflow mints the Docker Hub access token inside each reusable workflow @@ -632,13 +633,14 @@ jobs: project_id: my-project ``` -| Name | Type | Required | Description | -|------------------------------|--------|----------|------------------------------------------------------------------------------------------------------------------------------------------------| -| `type` | String | Yes | Registry identity provider type. Must be `gcp-wif`. | -| `registry` | String | Yes | Google Artifact Registry host passed to `docker/login-action`, such as `us-docker.pkg.dev`. Do not use the full repository path. | -| `workload_identity_provider` | String | Yes | Workload Identity Provider resource name passed to `google-github-actions/auth`. | -| `service_account` | String | Yes | Service account email passed to `google-github-actions/auth` for Workload Identity Federation. | -| `project_id` | String | No | Google Cloud project ID passed to `google-github-actions/auth` when provided. | +| Name | Type | Required | Description | +|------------------------------|--------|----------|----------------------------------------------------------------------------------------------------------------------------------| +| `type` | String | Yes | Registry identity provider type. Must be `gcp-wif`. | +| `registry` | String | Yes | Google Artifact Registry host passed to `docker/login-action`, such as `us-docker.pkg.dev`. Do not use the full repository path. | +| `workload_identity_provider` | String | Yes | Workload Identity Provider resource name passed to `google-github-actions/auth`. | +| `service_account` | String | Yes | Service account email passed to `google-github-actions/auth` for Workload Identity Federation. | +| `project_id` | String | No | Google Cloud project ID passed to `google-github-actions/auth` when provided. | +| `expires_in` | Number | No | Access token lifetime in seconds, from `1` to `43200`. Defaults to `3600`. | The `registry` value is required for GCP WIF. Use the Artifact Registry host that `docker/login-action` should log in to, such as `us-docker.pkg.dev`, not