Skip to content

Commit 229f7d6

Browse files
crazy-maxcrazy-max
committed
authentication token scopes support
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
1 parent 6a1cfbc commit 229f7d6

File tree

5 files changed

+142
-10
lines changed

5 files changed

+142
-10
lines changed

‎.github/workflows/.test-bake.yml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,55 @@ jobs:
179179
const builderOutputs = JSON.parse(core.getInput('builder-outputs'));
180180
core.info(JSON.stringify(builderOutputs, null, 2));
181181
182+
bake-dockerhub-stage:
183+
uses: ./.github/workflows/bake.yml
184+
permissions:
185+
contents: read
186+
id-token: write
187+
with:
188+
context: test
189+
output: image
190+
push: ${{ github.event_name != 'pull_request' }}
191+
sbom: true
192+
target: hello-cross
193+
meta-images: |
194+
registry-1-stage.docker.io/docker/github-builder-test
195+
meta-tags: |
196+
type=raw,value=bake-ghbuilder-${{ github.run_id }}
197+
secrets:
198+
registry-auths: |
199+
- registry: registry-1-stage.docker.io
200+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
201+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
202+
203+
bake-dockerhub-stage-verify:
204+
uses: ./.github/workflows/verify.yml
205+
if: ${{ github.event_name != 'pull_request' }}
206+
needs:
207+
- bake-dockerhub-stage
208+
with:
209+
builder-outputs: ${{ toJSON(needs.bake-dockerhub-stage.outputs) }}
210+
secrets:
211+
registry-auths: |
212+
- registry: registry-1-stage.docker.io
213+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
214+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
215+
216+
bake-dockerhub-stage-outputs:
217+
runs-on: ubuntu-24.04
218+
needs:
219+
- bake-dockerhub-stage
220+
steps:
221+
-
222+
name: Builder outputs
223+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
224+
env:
225+
INPUT_BUILDER-OUTPUTS: ${{ toJSON(needs.bake-dockerhub-stage.outputs) }}
226+
with:
227+
script: |
228+
const builderOutputs = JSON.parse(core.getInput('builder-outputs'));
229+
core.info(JSON.stringify(builderOutputs, null, 2));
230+
182231
bake-ghcr-and-aws:
183232
uses: ./.github/workflows/bake.yml
184233
permissions:
@@ -395,3 +444,38 @@ jobs:
395444
public.ecr.aws/q3b5f1u4/test-docker-action
396445
meta-tags: |
397446
type=raw,value=bake-ghbuilder-${{ github.run_id }}
447+
448+
bake-auth-scope:
449+
uses: ./.github/workflows/bake.yml
450+
permissions:
451+
contents: read
452+
id-token: write
453+
with:
454+
context: test
455+
output: image
456+
push: ${{ github.event_name != 'pull_request' }}
457+
sbom: true
458+
target: hello-cross
459+
meta-images: |
460+
registry-1-stage.docker.io/docker/github-builder-test
461+
meta-tags: |
462+
type=raw,value=bake-ghbuilder-scope-${{ github.run_id }}
463+
secrets:
464+
registry-auths: |
465+
- registry: registry-1-stage.docker.io
466+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
467+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
468+
scope: '@push'
469+
470+
bake-auth-scope-verify:
471+
uses: ./.github/workflows/verify.yml
472+
if: ${{ github.event_name != 'pull_request' }}
473+
needs:
474+
- bake-auth-scope
475+
with:
476+
builder-outputs: ${{ toJSON(needs.bake-auth-scope.outputs) }}
477+
secrets:
478+
registry-auths: |
479+
- registry: registry-1-stage.docker.io
480+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
481+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}

‎.github/workflows/.test-build.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -490,3 +490,37 @@ jobs:
490490
meta-images: ghcr.io/docker/github-builder-test
491491
meta-tags: |
492492
type=raw,value=build-${{ github.run_id }}
493+
494+
build-auth-scope:
495+
uses: ./.github/workflows/build.yml
496+
permissions:
497+
contents: read
498+
id-token: write
499+
with:
500+
file: test/hello.Dockerfile
501+
output: image
502+
platforms: linux/amd64,linux/arm64
503+
push: ${{ github.event_name != 'pull_request' }}
504+
sbom: true
505+
meta-images: registry-1-stage.docker.io/docker/github-builder-test
506+
meta-tags: |
507+
type=raw,value=build-scope-${{ github.run_id }}
508+
secrets:
509+
registry-auths: |
510+
- registry: registry-1-stage.docker.io
511+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
512+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
513+
scope: '@push'
514+
515+
build-auth-scope-verify:
516+
uses: ./.github/workflows/verify.yml
517+
if: ${{ github.event_name != 'pull_request' }}
518+
needs:
519+
- build-auth-scope
520+
with:
521+
builder-outputs: ${{ toJSON(needs.build-auth-scope.outputs) }}
522+
secrets:
523+
registry-auths: |
524+
- registry: registry-1-stage.docker.io
525+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
526+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}

‎.github/workflows/bake.yml‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ on:
137137
value: ${{ jobs.finalize.outputs.signed }}
138138

139139
env:
140-
BUILDX_VERSION: "v0.30.1"
140+
BUILDX_VERSION: "https://github.com/docker/buildx.git#8037f199dbf353dd0bc51b6d4f4cec64544dbcdd" # TODO: pin to a specific version when scope feature is available
141141
BUILDKIT_IMAGE: "moby/buildkit:master@sha256:bdefeba47634c596286beabe68219708ed364c4f1a5e4e9a2e160274712a0e89" # TODO: pin to a specific version when signed gha cache feature is available
142142
DOCKER_ACTIONS_TOOLKIT_MODULE: "@docker/actions-toolkit@0.72.0"
143143
COSIGN_VERSION: "v3.0.2"
@@ -358,7 +358,6 @@ jobs:
358358
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
359359
with:
360360
version: ${{ env.BUILDX_VERSION }}
361-
cache-binary: false
362361
buildkitd-flags: --debug
363362
driver-opts: |
364363
image=${{ env.BUILDKIT_IMAGE }}
@@ -603,7 +602,7 @@ jobs:
603602
-
604603
name: Login to registry
605604
if: ${{ inputs.push && inputs.output == 'image' }}
606-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
605+
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
607606
with:
608607
registry-auth: ${{ secrets.registry-auths }}
609608
-
@@ -634,6 +633,14 @@ jobs:
634633
const imageDigest = inpMetadata[inpTarget]['containerimage.digest'];
635634
core.info(imageDigest);
636635
core.setOutput('digest', imageDigest);
636+
-
637+
name: Login to registry
638+
if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' }}
639+
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
640+
with:
641+
registry-auth: ${{ secrets.registry-auths }}
642+
env:
643+
DOCKER_LOGIN_SCOPE_DISABLED: true # make sure the scope feature is disabled to avoid interfering with cosign OIDC login
637644
-
638645
name: Signing attestation manifests
639646
id: signing-attestation-manifests
@@ -784,7 +791,7 @@ jobs:
784791
-
785792
name: Login to registry
786793
if: ${{ inputs.push && inputs.output == 'image' }}
787-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
794+
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
788795
with:
789796
registry-auth: ${{ secrets.registry-auths }}
790797
-
@@ -795,7 +802,6 @@ jobs:
795802
version: ${{ env.BUILDX_VERSION }}
796803
buildkitd-flags: --debug
797804
driver-opts: image=${{ env.BUILDKIT_IMAGE }}
798-
cache-binary: false
799805
-
800806
name: Create manifest
801807
if: ${{ inputs.output == 'image' }}

‎.github/workflows/build.yml‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ on:
144144
value: ${{ jobs.finalize.outputs.signed }}
145145

146146
env:
147-
BUILDX_VERSION: "v0.30.1"
147+
BUILDX_VERSION: "https://github.com/docker/buildx.git#8037f199dbf353dd0bc51b6d4f4cec64544dbcdd" # TODO: pin to a specific version when scope feature is available
148148
BUILDKIT_IMAGE: "moby/buildkit:master@sha256:bdefeba47634c596286beabe68219708ed364c4f1a5e4e9a2e160274712a0e89" # TODO: pin to a specific version when signed gha cache feature is available
149149
DOCKER_ACTIONS_TOOLKIT_MODULE: "@docker/actions-toolkit@0.72.0"
150150
COSIGN_VERSION: "v3.0.2"
@@ -319,7 +319,6 @@ jobs:
319319
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
320320
with:
321321
version: ${{ env.BUILDX_VERSION }}
322-
cache-binary: false
323322
buildkitd-flags: --debug
324323
driver-opts: |
325324
image=${{ env.BUILDKIT_IMAGE }}
@@ -512,7 +511,7 @@ jobs:
512511
-
513512
name: Login to registry
514513
if: ${{ inputs.push && inputs.output == 'image' }}
515-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
514+
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
516515
with:
517516
registry-auth: ${{ secrets.registry-auths }}
518517
-
@@ -538,6 +537,14 @@ jobs:
538537
env:
539538
BUILDKIT_MULTI_PLATFORM: 1
540539
GIT_AUTH_TOKEN: ${{ secrets.github-token || github.token }}
540+
-
541+
name: Login to registry
542+
if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' }}
543+
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
544+
with:
545+
registry-auth: ${{ secrets.registry-auths }}
546+
env:
547+
DOCKER_LOGIN_SCOPE_DISABLED: true # make sure the scope feature is disabled to avoid interfering with cosign OIDC login
541548
-
542549
name: Signing attestation manifests
543550
id: signing-attestation-manifests
@@ -687,7 +694,7 @@ jobs:
687694
-
688695
name: Login to registry
689696
if: ${{ inputs.push && inputs.output == 'image' }}
690-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
697+
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
691698
with:
692699
registry-auth: ${{ secrets.registry-auths }}
693700
-
@@ -698,7 +705,6 @@ jobs:
698705
version: ${{ env.BUILDX_VERSION }}
699706
buildkitd-flags: --debug
700707
driver-opts: image=${{ env.BUILDKIT_IMAGE }}
701-
cache-binary: false
702708
-
703709
name: Create manifest
704710
if: ${{ inputs.output == 'image' }}

‎.github/workflows/verify.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,8 @@ jobs:
8484
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
8585
with:
8686
registry-auth: ${{ secrets.registry-auths }}
87+
env:
88+
DOCKER_LOGIN_SCOPE_DISABLED: true # make sure the scope feature is disabled to avoid interfering with cosign OIDC login
8789
-
8890
name: Download artifacts
8991
if: ${{ steps.vars.outputs.signed == 'true' && steps.vars.outputs.output-type == 'local' }}

0 commit comments

Comments
 (0)