Skip to content

Commit 9491fd3

Browse files
crazy-maxcrazy-max
committed
authentication token scopes support
Signed-off-by: CrazyMax <[email protected]>
1 parent 591ea42 commit 9491fd3

File tree

5 files changed

+144
-4
lines changed

5 files changed

+144
-4
lines changed

‎.github/workflows/.test-bake.yml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,55 @@ jobs:
179179
const builderOutputs = JSON.parse(core.getInput('builder-outputs'));
180180
core.info(JSON.stringify(builderOutputs, null, 2));
181181
182+
bake-dockerhub-stage:
183+
uses: ./.github/workflows/bake.yml
184+
permissions:
185+
contents: read
186+
id-token: write
187+
with:
188+
context: test
189+
output: image
190+
push: ${{ github.event_name != 'pull_request' }}
191+
sbom: true
192+
target: hello-cross
193+
meta-images: |
194+
registry-1-stage.docker.io/docker/github-builder-test
195+
meta-tags: |
196+
type=raw,value=bake-ghbuilder-${{ github.run_id }}
197+
secrets:
198+
registry-auths: |
199+
- registry: registry-1-stage.docker.io
200+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
201+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
202+
203+
bake-dockerhub-stage-verify:
204+
uses: ./.github/workflows/verify.yml
205+
if: ${{ github.event_name != 'pull_request' }}
206+
needs:
207+
- bake-dockerhub-stage
208+
with:
209+
builder-outputs: ${{ toJSON(needs.bake-dockerhub-stage.outputs) }}
210+
secrets:
211+
registry-auths: |
212+
- registry: registry-1-stage.docker.io
213+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
214+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
215+
216+
bake-dockerhub-stage-outputs:
217+
runs-on: ubuntu-24.04
218+
needs:
219+
- bake-dockerhub-stage
220+
steps:
221+
-
222+
name: Builder outputs
223+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
224+
env:
225+
INPUT_BUILDER-OUTPUTS: ${{ toJSON(needs.bake-dockerhub-stage.outputs) }}
226+
with:
227+
script: |
228+
const builderOutputs = JSON.parse(core.getInput('builder-outputs'));
229+
core.info(JSON.stringify(builderOutputs, null, 2));
230+
182231
bake-ghcr-and-aws:
183232
uses: ./.github/workflows/bake.yml
184233
permissions:
@@ -461,3 +510,38 @@ jobs:
461510
target: go
462511
vars: |
463512
XX_VERSION=1.9.0
513+
514+
bake-auth-scope:
515+
uses: ./.github/workflows/bake.yml
516+
permissions:
517+
contents: read
518+
id-token: write
519+
with:
520+
context: test
521+
output: image
522+
push: ${{ github.event_name != 'pull_request' }}
523+
sbom: true
524+
target: hello-cross
525+
meta-images: |
526+
registry-1-stage.docker.io/docker/github-builder-test
527+
meta-tags: |
528+
type=raw,value=bake-ghbuilder-scope-${{ github.run_id }}
529+
secrets:
530+
registry-auths: |
531+
- registry: registry-1-stage.docker.io
532+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
533+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
534+
scope: '@push'
535+
536+
bake-auth-scope-verify:
537+
uses: ./.github/workflows/verify.yml
538+
if: ${{ github.event_name != 'pull_request' }}
539+
needs:
540+
- bake-auth-scope
541+
with:
542+
builder-outputs: ${{ toJSON(needs.bake-auth-scope.outputs) }}
543+
secrets:
544+
registry-auths: |
545+
- registry: registry-1-stage.docker.io
546+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
547+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}

‎.github/workflows/.test-build.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -542,3 +542,37 @@ jobs:
542542
platforms: linux/amd64,linux/arm64
543543
sbom: true
544544
sign: ${{ github.event_name != 'pull_request' }}
545+
546+
build-auth-scope:
547+
uses: ./.github/workflows/build.yml
548+
permissions:
549+
contents: read
550+
id-token: write
551+
with:
552+
file: test/hello.Dockerfile
553+
output: image
554+
platforms: linux/amd64,linux/arm64
555+
push: ${{ github.event_name != 'pull_request' }}
556+
sbom: true
557+
meta-images: registry-1-stage.docker.io/docker/github-builder-test
558+
meta-tags: |
559+
type=raw,value=build-scope-${{ github.run_id }}
560+
secrets:
561+
registry-auths: |
562+
- registry: registry-1-stage.docker.io
563+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
564+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
565+
scope: '@push'
566+
567+
build-auth-scope-verify:
568+
uses: ./.github/workflows/verify.yml
569+
if: ${{ github.event_name != 'pull_request' }}
570+
needs:
571+
- build-auth-scope
572+
with:
573+
builder-outputs: ${{ toJSON(needs.build-auth-scope.outputs) }}
574+
secrets:
575+
registry-auths: |
576+
- registry: registry-1-stage.docker.io
577+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
578+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}

‎.github/workflows/bake.yml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -677,7 +677,7 @@ jobs:
677677
-
678678
name: Login to registry
679679
if: ${{ inputs.push && inputs.output == 'image' }}
680-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
680+
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
681681
with:
682682
registry-auth: ${{ secrets.registry-auths }}
683683
-
@@ -706,6 +706,14 @@ jobs:
706706
const imageDigest = inpMetadata[inpTarget]['containerimage.digest'];
707707
core.info(imageDigest);
708708
core.setOutput('digest', imageDigest);
709+
-
710+
name: Login to registry for signing
711+
if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' }}
712+
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
713+
with:
714+
registry-auth: ${{ secrets.registry-auths }}
715+
env:
716+
DOCKER_LOGIN_SCOPE_DISABLED: true # make sure the scope feature is disabled to avoid interfering with cosign OIDC login
709717
-
710718
name: Signing attestation manifests
711719
id: signing-attestation-manifests
@@ -855,9 +863,11 @@ jobs:
855863
-
856864
name: Login to registry
857865
if: ${{ inputs.push && inputs.output == 'image' }}
858-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
866+
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
859867
with:
860868
registry-auth: ${{ secrets.registry-auths }}
869+
env:
870+
DOCKER_LOGIN_SCOPE_DISABLED: true # FIXME: scope feature is not yet supported by Buildx imagetools command
861871
-
862872
name: Set up Docker Buildx
863873
if: ${{ inputs.push && inputs.output == 'image' }}

‎.github/workflows/build.yml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -545,7 +545,7 @@ jobs:
545545
-
546546
name: Login to registry
547547
if: ${{ inputs.push && inputs.output == 'image' }}
548-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
548+
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
549549
with:
550550
registry-auth: ${{ secrets.registry-auths }}
551551
-
@@ -571,6 +571,14 @@ jobs:
571571
env:
572572
BUILDKIT_MULTI_PLATFORM: 1
573573
GIT_AUTH_TOKEN: ${{ secrets.github-token || github.token }}
574+
-
575+
name: Login to registry for signing
576+
if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' }}
577+
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
578+
with:
579+
registry-auth: ${{ secrets.registry-auths }}
580+
env:
581+
DOCKER_LOGIN_SCOPE_DISABLED: true # make sure the scope feature is disabled to avoid interfering with cosign OIDC login
574582
-
575583
name: Signing attestation manifests
576584
id: signing-attestation-manifests
@@ -719,9 +727,11 @@ jobs:
719727
-
720728
name: Login to registry
721729
if: ${{ inputs.push && inputs.output == 'image' }}
722-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
730+
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
723731
with:
724732
registry-auth: ${{ secrets.registry-auths }}
733+
env:
734+
DOCKER_LOGIN_SCOPE_DISABLED: true # FIXME: scope feature is not yet supported by Buildx imagetools command
725735
-
726736
name: Set up Docker Buildx
727737
if: ${{ inputs.push && inputs.output == 'image' }}

‎.github/workflows/verify.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,8 @@ jobs:
8484
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
8585
with:
8686
registry-auth: ${{ secrets.registry-auths }}
87+
env:
88+
DOCKER_LOGIN_SCOPE_DISABLED: true # make sure the scope feature is disabled to avoid interfering with cosign OIDC login
8789
-
8890
name: Download artifacts
8991
if: ${{ steps.vars.outputs.signed == 'true' && steps.vars.outputs.output-type == 'local' }}

0 commit comments

Comments
 (0)