Skip to content

Commit bcee16a

Browse files
crazy-maxcrazy-max
committed
authentication token scopes support
Signed-off-by: CrazyMax <[email protected]>
1 parent 95c3392 commit bcee16a

File tree

5 files changed

+144
-4
lines changed

5 files changed

+144
-4
lines changed

‎.github/workflows/.test-bake.yml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,55 @@ jobs:
179179
const builderOutputs = JSON.parse(core.getInput('builder-outputs'));
180180
core.info(JSON.stringify(builderOutputs, null, 2));
181181
182+
bake-dockerhub-stage:
183+
uses: ./.github/workflows/bake.yml
184+
permissions:
185+
contents: read
186+
id-token: write
187+
with:
188+
context: test
189+
output: image
190+
push: ${{ github.event_name != 'pull_request' }}
191+
sbom: true
192+
target: hello-cross
193+
meta-images: |
194+
registry-1-stage.docker.io/docker/github-builder-test
195+
meta-tags: |
196+
type=raw,value=bake-ghbuilder-${{ github.run_id }}
197+
secrets:
198+
registry-auths: |
199+
- registry: registry-1-stage.docker.io
200+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
201+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
202+
203+
bake-dockerhub-stage-verify:
204+
uses: ./.github/workflows/verify.yml
205+
if: ${{ github.event_name != 'pull_request' }}
206+
needs:
207+
- bake-dockerhub-stage
208+
with:
209+
builder-outputs: ${{ toJSON(needs.bake-dockerhub-stage.outputs) }}
210+
secrets:
211+
registry-auths: |
212+
- registry: registry-1-stage.docker.io
213+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
214+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
215+
216+
bake-dockerhub-stage-outputs:
217+
runs-on: ubuntu-24.04
218+
needs:
219+
- bake-dockerhub-stage
220+
steps:
221+
-
222+
name: Builder outputs
223+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
224+
env:
225+
INPUT_BUILDER-OUTPUTS: ${{ toJSON(needs.bake-dockerhub-stage.outputs) }}
226+
with:
227+
script: |
228+
const builderOutputs = JSON.parse(core.getInput('builder-outputs'));
229+
core.info(JSON.stringify(builderOutputs, null, 2));
230+
182231
bake-ghcr-and-aws:
183232
uses: ./.github/workflows/bake.yml
184233
permissions:
@@ -447,3 +496,38 @@ jobs:
447496
sbom: true
448497
sign: ${{ github.event_name != 'pull_request' }}
449498
target: hello-cross
499+
500+
bake-auth-scope:
501+
uses: ./.github/workflows/bake.yml
502+
permissions:
503+
contents: read
504+
id-token: write
505+
with:
506+
context: test
507+
output: image
508+
push: ${{ github.event_name != 'pull_request' }}
509+
sbom: true
510+
target: hello-cross
511+
meta-images: |
512+
registry-1-stage.docker.io/docker/github-builder-test
513+
meta-tags: |
514+
type=raw,value=bake-ghbuilder-scope-${{ github.run_id }}
515+
secrets:
516+
registry-auths: |
517+
- registry: registry-1-stage.docker.io
518+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
519+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
520+
scope: '@push'
521+
522+
bake-auth-scope-verify:
523+
uses: ./.github/workflows/verify.yml
524+
if: ${{ github.event_name != 'pull_request' }}
525+
needs:
526+
- bake-auth-scope
527+
with:
528+
builder-outputs: ${{ toJSON(needs.bake-auth-scope.outputs) }}
529+
secrets:
530+
registry-auths: |
531+
- registry: registry-1-stage.docker.io
532+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
533+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}

‎.github/workflows/.test-build.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -542,3 +542,37 @@ jobs:
542542
platforms: linux/amd64,linux/arm64
543543
sbom: true
544544
sign: ${{ github.event_name != 'pull_request' }}
545+
546+
build-auth-scope:
547+
uses: ./.github/workflows/build.yml
548+
permissions:
549+
contents: read
550+
id-token: write
551+
with:
552+
file: test/hello.Dockerfile
553+
output: image
554+
platforms: linux/amd64,linux/arm64
555+
push: ${{ github.event_name != 'pull_request' }}
556+
sbom: true
557+
meta-images: registry-1-stage.docker.io/docker/github-builder-test
558+
meta-tags: |
559+
type=raw,value=build-scope-${{ github.run_id }}
560+
secrets:
561+
registry-auths: |
562+
- registry: registry-1-stage.docker.io
563+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
564+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
565+
scope: '@push'
566+
567+
build-auth-scope-verify:
568+
uses: ./.github/workflows/verify.yml
569+
if: ${{ github.event_name != 'pull_request' }}
570+
needs:
571+
- build-auth-scope
572+
with:
573+
builder-outputs: ${{ toJSON(needs.build-auth-scope.outputs) }}
574+
secrets:
575+
registry-auths: |
576+
- registry: registry-1-stage.docker.io
577+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
578+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}

‎.github/workflows/bake.yml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -632,7 +632,7 @@ jobs:
632632
-
633633
name: Login to registry
634634
if: ${{ inputs.push && inputs.output == 'image' }}
635-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
635+
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
636636
with:
637637
registry-auth: ${{ secrets.registry-auths }}
638638
-
@@ -663,6 +663,14 @@ jobs:
663663
const imageDigest = inpMetadata[inpTarget]['containerimage.digest'];
664664
core.info(imageDigest);
665665
core.setOutput('digest', imageDigest);
666+
-
667+
name: Login to registry for signing
668+
if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' }}
669+
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
670+
with:
671+
registry-auth: ${{ secrets.registry-auths }}
672+
env:
673+
DOCKER_LOGIN_SCOPE_DISABLED: true # make sure the scope feature is disabled to avoid interfering with cosign OIDC login
666674
-
667675
name: Signing attestation manifests
668676
id: signing-attestation-manifests
@@ -812,9 +820,11 @@ jobs:
812820
-
813821
name: Login to registry
814822
if: ${{ inputs.push && inputs.output == 'image' }}
815-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
823+
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
816824
with:
817825
registry-auth: ${{ secrets.registry-auths }}
826+
env:
827+
DOCKER_LOGIN_SCOPE_DISABLED: true # FIXME: scope feature is not yet supported by Buildx imagetools command
818828
-
819829
name: Set up Docker Buildx
820830
if: ${{ inputs.push && inputs.output == 'image' }}

‎.github/workflows/build.yml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -545,7 +545,7 @@ jobs:
545545
-
546546
name: Login to registry
547547
if: ${{ inputs.push && inputs.output == 'image' }}
548-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
548+
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
549549
with:
550550
registry-auth: ${{ secrets.registry-auths }}
551551
-
@@ -571,6 +571,14 @@ jobs:
571571
env:
572572
BUILDKIT_MULTI_PLATFORM: 1
573573
GIT_AUTH_TOKEN: ${{ secrets.github-token || github.token }}
574+
-
575+
name: Login to registry for signing
576+
if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' }}
577+
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
578+
with:
579+
registry-auth: ${{ secrets.registry-auths }}
580+
env:
581+
DOCKER_LOGIN_SCOPE_DISABLED: true # make sure the scope feature is disabled to avoid interfering with cosign OIDC login
574582
-
575583
name: Signing attestation manifests
576584
id: signing-attestation-manifests
@@ -719,9 +727,11 @@ jobs:
719727
-
720728
name: Login to registry
721729
if: ${{ inputs.push && inputs.output == 'image' }}
722-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
730+
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
723731
with:
724732
registry-auth: ${{ secrets.registry-auths }}
733+
env:
734+
DOCKER_LOGIN_SCOPE_DISABLED: true # FIXME: scope feature is not yet supported by Buildx imagetools command
725735
-
726736
name: Set up Docker Buildx
727737
if: ${{ inputs.push && inputs.output == 'image' }}

‎.github/workflows/verify.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,8 @@ jobs:
8484
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
8585
with:
8686
registry-auth: ${{ secrets.registry-auths }}
87+
env:
88+
DOCKER_LOGIN_SCOPE_DISABLED: true # make sure the scope feature is disabled to avoid interfering with cosign OIDC login
8789
-
8890
name: Download artifacts
8991
if: ${{ steps.vars.outputs.signed == 'true' && steps.vars.outputs.output-type == 'local' }}

0 commit comments

Comments
 (0)