Skip to content

build/bake: support configurable Docker Hub and GCP token lifetimes #340

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
crazy-max merged 1 commit into from
Nov 5, 2026
+39 −7
Merged

build/bake: support configurable Docker Hub and GCP token lifetimes #340

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/.test-bake.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ jobs:
registry: docker.io
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
expires_in: 7200
meta-images: |
docker.io/dockereng/github-builder-test
meta-tags: |
Expand All @@ -69,6 +70,7 @@ jobs:
registry: docker.io
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
expires_in: 7200

bake-dockerhub-single-outputs:
runs-on: ubuntu-26.04
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/.test-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@ jobs:
registry: docker.io
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
expires_in: 7200
meta-images: |
docker.io/dockereng/github-builder-test
meta-tags: |
Expand All @@ -68,6 +69,7 @@ jobs:
registry: docker.io
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
expires_in: 7200

build-dockerhub-single-outputs:
runs-on: ubuntu-26.04
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/bake.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -760,6 +760,7 @@ jobs:
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
with:
token_format: access_token
access_token_lifetime: ${{ format('{0}s', needs.registry-identities.outputs.gcp-wif-expires-in || '3600') }}
workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }}
service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }}
project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }}
Expand All @@ -780,6 +781,7 @@ jobs:
uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
env:
DOCKERHUB_OIDC_CONNECTIONID: ${{ needs.registry-identities.outputs.dockerhub-oidc-connection-id }}
DOCKERHUB_OIDC_EXPIREIN: ${{ needs.registry-identities.outputs.dockerhub-oidc-expires-in || '3600' }}
with:
registry-auth: |
- registry: ${{ needs.registry-identities.outputs.dockerhub-oidc-registry }}
Expand Down Expand Up @@ -1037,6 +1039,7 @@ jobs:
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
with:
token_format: access_token
access_token_lifetime: ${{ format('{0}s', needs.registry-identities.outputs.gcp-wif-expires-in || '3600') }}
workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }}
service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }}
project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }}
Expand All @@ -1057,6 +1060,7 @@ jobs:
uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
env:
DOCKERHUB_OIDC_CONNECTIONID: ${{ needs.registry-identities.outputs.dockerhub-oidc-connection-id }}
DOCKERHUB_OIDC_EXPIREIN: ${{ needs.registry-identities.outputs.dockerhub-oidc-expires-in || '3600' }}
DOCKER_LOGIN_SCOPE_DISABLED: true # make signing credentials available outside Buildx scoped configuration
with:
registry-auth: |
Expand Down Expand Up @@ -1275,6 +1279,7 @@ jobs:
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
with:
token_format: access_token
access_token_lifetime: ${{ format('{0}s', needs.registry-identities.outputs.gcp-wif-expires-in || '3600') }}
workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }}
service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }}
project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }}
Expand All @@ -1295,6 +1300,7 @@ jobs:
uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
env:
DOCKERHUB_OIDC_CONNECTIONID: ${{ needs.registry-identities.outputs.dockerhub-oidc-connection-id }}
DOCKERHUB_OIDC_EXPIREIN: ${{ needs.registry-identities.outputs.dockerhub-oidc-expires-in || '3600' }}
with:
registry-auth: |
- registry: ${{ needs.registry-identities.outputs.dockerhub-oidc-registry }}
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -690,6 +690,7 @@ jobs:
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
with:
token_format: access_token
access_token_lifetime: ${{ format('{0}s', needs.registry-identities.outputs.gcp-wif-expires-in || '3600') }}
workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }}
service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }}
project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }}
Expand All @@ -710,6 +711,7 @@ jobs:
uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
env:
DOCKERHUB_OIDC_CONNECTIONID: ${{ needs.registry-identities.outputs.dockerhub-oidc-connection-id }}
DOCKERHUB_OIDC_EXPIREIN: ${{ needs.registry-identities.outputs.dockerhub-oidc-expires-in || '3600' }}
with:
registry-auth: |
- registry: ${{ needs.registry-identities.outputs.dockerhub-oidc-registry }}
Expand Down Expand Up @@ -934,6 +936,7 @@ jobs:
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
with:
token_format: access_token
access_token_lifetime: ${{ format('{0}s', needs.registry-identities.outputs.gcp-wif-expires-in || '3600') }}
workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }}
service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }}
project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }}
Expand All @@ -954,6 +957,7 @@ jobs:
uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
env:
DOCKERHUB_OIDC_CONNECTIONID: ${{ needs.registry-identities.outputs.dockerhub-oidc-connection-id }}
DOCKERHUB_OIDC_EXPIREIN: ${{ needs.registry-identities.outputs.dockerhub-oidc-expires-in || '3600' }}
DOCKER_LOGIN_SCOPE_DISABLED: true # make signing credentials available outside Buildx scoped configuration
with:
registry-auth: |
Expand Down Expand Up @@ -1171,6 +1175,7 @@ jobs:
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
with:
token_format: access_token
access_token_lifetime: ${{ format('{0}s', needs.registry-identities.outputs.gcp-wif-expires-in || '3600') }}
workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }}
service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }}
project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }}
Expand All @@ -1191,6 +1196,7 @@ jobs:
uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
env:
DOCKERHUB_OIDC_CONNECTIONID: ${{ needs.registry-identities.outputs.dockerhub-oidc-connection-id }}
DOCKERHUB_OIDC_EXPIREIN: ${{ needs.registry-identities.outputs.dockerhub-oidc-expires-in || '3600' }}
with:
registry-auth: |
- registry: ${{ needs.registry-identities.outputs.dockerhub-oidc-registry }}
Expand Down
12 changes: 12 additions & 0 deletions .github/workflows/setup-registry-identities.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,9 @@ on:
gcp-wif-project-id:
description: "GCP project ID"
value: ${{ jobs.setup-registry-identities.outputs.gcp-wif-project-id }}
gcp-wif-expires-in:
description: "GCP access token lifetime in seconds"
value: ${{ jobs.setup-registry-identities.outputs.gcp-wif-expires-in }}
dockerhub-oidc-enabled:
description: "Whether a Docker Hub OIDC registry identity was configured"
value: ${{ jobs.setup-registry-identities.outputs.dockerhub-oidc-enabled }}
Expand All @@ -55,6 +58,9 @@ on:
dockerhub-oidc-connection-id:
description: "Docker Hub OIDC connection ID"
value: ${{ jobs.setup-registry-identities.outputs.dockerhub-oidc-connection-id }}
dockerhub-oidc-expires-in:
description: "Docker Hub OIDC token lifetime in seconds"
value: ${{ jobs.setup-registry-identities.outputs.dockerhub-oidc-expires-in }}
dockerhub-oidc-scope:
description: "Docker Hub authentication scope"
value: ${{ jobs.setup-registry-identities.outputs.dockerhub-oidc-scope }}
Expand Down Expand Up @@ -113,10 +119,12 @@ jobs:
gcp-wif-workload-identity-provider: ${{ steps.validate.outputs.gcp-wif-workload-identity-provider }}
gcp-wif-service-account: ${{ steps.validate.outputs.gcp-wif-service-account }}
gcp-wif-project-id: ${{ steps.validate.outputs.gcp-wif-project-id }}
gcp-wif-expires-in: ${{ steps.validate.outputs.gcp-wif-expires-in }}
dockerhub-oidc-enabled: ${{ steps.validate.outputs.dockerhub-oidc-enabled }}
dockerhub-oidc-registry: ${{ steps.validate.outputs.dockerhub-oidc-registry }}
dockerhub-oidc-username: ${{ steps.validate.outputs.dockerhub-oidc-username }}
dockerhub-oidc-connection-id: ${{ steps.validate.outputs.dockerhub-oidc-connection-id }}
dockerhub-oidc-expires-in: ${{ steps.validate.outputs.dockerhub-oidc-expires-in }}
dockerhub-oidc-scope: ${{ steps.validate.outputs.dockerhub-oidc-scope }}
azure-acr-enabled: ${{ steps.validate.outputs.azure-acr-enabled }}
azure-acr-registry: ${{ steps.validate.outputs.azure-acr-registry }}
Expand Down Expand Up @@ -186,10 +194,12 @@ jobs:
core.setOutput('gcp-wif-workload-identity-provider', '');
core.setOutput('gcp-wif-service-account', '');
core.setOutput('gcp-wif-project-id', '');
core.setOutput('gcp-wif-expires-in', '');
core.setOutput('dockerhub-oidc-enabled', 'false');
core.setOutput('dockerhub-oidc-registry', '');
core.setOutput('dockerhub-oidc-username', '');
core.setOutput('dockerhub-oidc-connection-id', '');
core.setOutput('dockerhub-oidc-expires-in', '');
core.setOutput('dockerhub-oidc-scope', '');
core.setOutput('azure-acr-enabled', 'false');
core.setOutput('azure-acr-registry', '');
Expand Down Expand Up @@ -246,10 +256,12 @@ jobs:
core.setOutput('gcp-wif-workload-identity-provider', gcpWif?.workloadIdentityProvider || '');
core.setOutput('gcp-wif-service-account', gcpWif?.serviceAccount || '');
core.setOutput('gcp-wif-project-id', gcpWif?.projectId || '');
core.setOutput('gcp-wif-expires-in', gcpWif?.expiresIn ?? '');
core.setOutput('dockerhub-oidc-enabled', dockerhubOidc ? 'true' : 'false');
core.setOutput('dockerhub-oidc-registry', dockerhubOidc?.registry || '');
core.setOutput('dockerhub-oidc-username', dockerhubOidc?.username || '');
core.setOutput('dockerhub-oidc-connection-id', dockerhubOidc?.connectionID || '');
core.setOutput('dockerhub-oidc-expires-in', dockerhubOidc?.expiresIn ?? '');
core.setOutput('dockerhub-oidc-scope', dockerhubOidc?.scope || '');
core.setOutput('azure-acr-enabled', azureAcr ? 'true' : 'false');
core.setOutput('azure-acr-registry', azureAcr?.registry || '');
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/verify.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,6 +139,7 @@ jobs:
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
with:
token_format: access_token
access_token_lifetime: ${{ format('{0}s', needs.registry-identities.outputs.gcp-wif-expires-in || '3600') }}
workload_identity_provider: ${{ needs.registry-identities.outputs.gcp-wif-workload-identity-provider }}
service_account: ${{ needs.registry-identities.outputs.gcp-wif-service-account }}
project_id: ${{ needs.registry-identities.outputs.gcp-wif-project-id }}
Expand All @@ -159,6 +160,7 @@ jobs:
uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
env:
DOCKERHUB_OIDC_CONNECTIONID: ${{ needs.registry-identities.outputs.dockerhub-oidc-connection-id }}
DOCKERHUB_OIDC_EXPIREIN: ${{ needs.registry-identities.outputs.dockerhub-oidc-expires-in || '3600' }}
with:
registry-auth: |
- registry: ${{ needs.registry-identities.outputs.dockerhub-oidc-registry }}
Expand Down
16 changes: 9 additions & 7 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -555,6 +555,7 @@ jobs:
| `registry` | String | No | Registry hostname passed to `docker/login-action`. Defaults to `docker.io`. |
| `username` | String | Yes | Docker Hub username or organization passed to `docker/login-action`. |
| `connection_id` | String | Yes | Docker Hub OIDC connection ID passed to `docker/login-action` in each job. |
| `expires_in` | Number | No | Token lifetime in seconds, from `300` to `21600`. Defaults to `3600`. |
| `scope` | String | No | [Authentication scope](https://github.com/docker/login-action#set-scopes-for-the-authentication-token) for `docker/login-action`. |

The workflow mints the Docker Hub access token inside each reusable workflow
Expand Down Expand Up @@ -632,13 +633,14 @@ jobs:
project_id: my-project
```

| Name | Type | Required | Description |
|------------------------------|--------|----------|------------------------------------------------------------------------------------------------------------------------------------------------|
| `type` | String | Yes | Registry identity provider type. Must be `gcp-wif`. |
| `registry` | String | Yes | Google Artifact Registry host passed to `docker/login-action`, such as `us-docker.pkg.dev`. Do not use the full repository path. |
| `workload_identity_provider` | String | Yes | Workload Identity Provider resource name passed to `google-github-actions/auth`. |
| `service_account` | String | Yes | Service account email passed to `google-github-actions/auth` for Workload Identity Federation. |
| `project_id` | String | No | Google Cloud project ID passed to `google-github-actions/auth` when provided. |
| Name | Type | Required | Description |
|------------------------------|--------|----------|----------------------------------------------------------------------------------------------------------------------------------|
| `type` | String | Yes | Registry identity provider type. Must be `gcp-wif`. |
| `registry` | String | Yes | Google Artifact Registry host passed to `docker/login-action`, such as `us-docker.pkg.dev`. Do not use the full repository path. |
| `workload_identity_provider` | String | Yes | Workload Identity Provider resource name passed to `google-github-actions/auth`. |
| `service_account` | String | Yes | Service account email passed to `google-github-actions/auth` for Workload Identity Federation. |
| `project_id` | String | No | Google Cloud project ID passed to `google-github-actions/auth` when provided. |
| `expires_in` | Number | No | Access token lifetime in seconds, from `1` to `43200`. Defaults to `3600`. |

The `registry` value is required for GCP WIF. Use the Artifact Registry host
that `docker/login-action` should log in to, such as `us-docker.pkg.dev`, not
Expand Down
Loading