Just for good measure and extra safety, redact temporary
credentials when aws authorization token is retrieved using
IAM authentication credentials to access Amazon ECR.
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
Hi there! We're thrilled that you'd like to contribute to this project. Your help is essential for keeping it great.
Hi there! We're thrilled that you'd like to contribute to this project. Your help is essential for keeping it great.
Contributions to this project are [released](https://help.github.com/articles/github-terms-of-service/#6-contributions-under-repository-license) to the public under the [project's open source license](LICENSE).
Contributions to this project are [released](https://docs.github.com/en/github/site-policy/github-terms-of-service#6-contributions-under-repository-license)
to the public under the [project's open source license](LICENSE).
## Submitting a pull request
## Submitting a pull request
1. [Fork](https://github.com/docker/login-action/fork) and clone the repository
1. [Fork](https://github.com/docker/login-action/fork) and clone the repository
2. Configure and install the dependencies: `yarn install`
2. Configure and install the dependencies: `yarn install`
4. Create a new branch: `git checkout -b my-branch-name`
3. Create a new branch: `git checkout -b my-branch-name`
5. Make your change
4. Make your changes
6. Run pre-checkin: `yarn run pre-checkin`
5. Make sure the tests pass: `docker buildx bake test`
7. Push to your fork and [submit a pull request](https://github.com/docker/login-action/compare)
6. Format code and build javascript artifacts: `docker buildx bake pre-checkin`
8. Pat your self on the back and wait for your pull request to be reviewed and merged.
7. Validate all code has correctly formatted and built: `docker buildx bake validate`
8. Push to your fork and [submit a pull request](https://github.com/docker/login-action/compare)
9. Pat your self on the back and wait for your pull request to be reviewed and merged.
Here are a few things you can do that will increase the likelihood of your pull request being accepted:
Here are a few things you can do that will increase the likelihood of your pull request being accepted:
- Write tests.
- Make sure the `README.md` and any other relevant **documentation are kept up-to-date**.
- Make sure the `README.md` and any other relevant **documentation are kept up-to-date**.
- We try to follow [SemVer v2.0.0](https://semver.org/). Randomly breaking public APIs is not an option.
- We try to follow [SemVer v2.0.0](https://semver.org/). Randomly breaking public APIs is not an option.
- Keep your change as focused as possible. If there are multiple changes you would like to make that are not dependent upon each other, consider submitting them as **separate pull requests**.
- Keep your change as focused as possible. If there are multiple changes you would like to make that are not dependent upon each other, consider submitting them as **separate pull requests**.
@@ -24,5 +28,5 @@ Here are a few things you can do that will increase the likelihood of your pull
## Resources
## Resources
- [How to Contribute to Open Source](https://opensource.guide/how-to-contribute/)
- [How to Contribute to Open Source](https://opensource.guide/how-to-contribute/)
@@ -30,4 +30,5 @@ about: Create a report to help us improve
### Logs
### Logs
> Download the [log file of your build](https://help.github.com/en/actions/configuring-and-managing-workflows/managing-a-workflow-run#downloading-logs) and [attach it](https://help.github.com/en/github/managing-your-work-on-github/file-attachments-on-issues-and-pull-requests) to this issue.
> Download the [log file of your build](https://docs.github.com/en/actions/managing-workflow-runs/using-workflow-run-logs#downloading-logs)
> and [attach it](https://docs.github.com/en/github/managing-your-work-on-github/file-attachments-on-issues-and-pull-requests) to this issue.
* [Keep up-to-date with GitHub Dependabot](#keep-up-to-date-with-github-dependabot)
* [Keep up-to-date with GitHub Dependabot](#keep-up-to-date-with-github-dependabot)
* [Limitation](#limitation)
## Usage
## Usage
### DockerHub
### DockerHub
To authenticate against [DockerHub](https://hub.docker.com) it's strongly recommended to create a
To authenticate against [Docker Hub](https://hub.docker.com) it's strongly recommended to create a
[personal access token](https://docs.docker.com/docker-hub/access-tokens/) as an alternative to your password.
[personal access token](https://docs.docker.com/docker-hub/access-tokens/) as an alternative to your password.
```yaml
```yaml
@@ -42,60 +39,32 @@ name: ci
on:
on:
push:
push:
branches:master
branches:main
jobs:
jobs:
login:
login:
runs-on:ubuntu-latest
runs-on:ubuntu-latest
steps:
steps:
-
-
name:Login to DockerHub
name:Login to DockerHub
uses:docker/login-action@v1
uses:docker/login-action@v2
with:
with:
username:${{ secrets.DOCKERHUB_USERNAME }}
username:${{ secrets.DOCKERHUB_USERNAME }}
password:${{ secrets.DOCKERHUB_TOKEN }}
password:${{ secrets.DOCKERHUB_TOKEN }}
```
```
### GitHub Packages Docker Registry
> :warning: GitHub Packages Docker Registry (aka `docker.pkg.github.com`) **is deprecated** and will sunset early next
> year. It's strongly advised to [migrate to GitHub Container Registry](https://docs.github.com/en/packages/getting-started-with-github-container-registry/migrating-to-github-container-registry-for-docker-images)
> instead.
You can configure the Docker client to use [GitHub Packages to publish and retrieve docker images](https://docs.github.com/en/packages/using-github-packages-with-your-projects-ecosystem/configuring-docker-for-use-with-github-packages).
```yaml
name:ci
on:
push:
branches:master
jobs:
login:
runs-on:ubuntu-latest
steps:
-
name:Login to GitHub Packages Docker Registry
uses:docker/login-action@v1
with:
registry:docker.pkg.github.com
username:${{ github.repository_owner }}
password:${{ secrets.GITHUB_TOKEN }}
```
### GitHub Container Registry
### GitHub Container Registry
To authenticate against the [GitHub Container Registry](https://docs.github.com/en/packages/getting-started-with-github-container-registry),
To authenticate against the [GitHub Container Registry](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry),
you will need to create a new [personal access token (PAT)](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token)
use the [`GITHUB_TOKEN`](https://docs.github.com/en/actions/reference/authentication-in-a-workflow) for the best
with the [appropriate scopes](https://docs.github.com/en/packages/getting-started-with-github-container-registry/migrating-to-github-container-registry-for-docker-images#authenticating-with-the-container-registry).
security and experience.
```yaml
```yaml
name:ci
name:ci
on:
on:
push:
push:
branches:master
branches:main
jobs:
jobs:
login:
login:
@@ -103,13 +72,19 @@ jobs:
steps:
steps:
-
-
name:Login to GitHub Container Registry
name:Login to GitHub Container Registry
uses:docker/login-action@v1
uses:docker/login-action@v2
with:
with:
registry:ghcr.io
registry:ghcr.io
username:${{ github.repository_owner }}
username:${{ github.actor }}
password:${{ secrets.CR_PAT }}
password:${{ secrets.GITHUB_TOKEN }}
```
```
You may need to [manage write and read access of GitHub Actions](https://docs.github.com/en/packages/managing-github-packages-using-github-actions-workflows/publishing-and-installing-a-package-with-github-actions#upgrading-a-workflow-that-accesses-ghcrio)
for repositories in the container settings.
You can also use a [personal access token (PAT)](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token)
with the [appropriate scopes](https://docs.github.com/en/packages/getting-started-with-github-container-registry/migrating-to-github-container-registry-for-docker-images#authenticating-with-the-container-registry).
### GitLab
### GitLab
```yaml
```yaml
@@ -117,7 +92,7 @@ name: ci
on:
on:
push:
push:
branches:master
branches:main
jobs:
jobs:
login:
login:
@@ -125,13 +100,15 @@ jobs:
steps:
steps:
-
-
name:Login to GitLab
name:Login to GitLab
uses:docker/login-action@v1
uses:docker/login-action@v2
with:
with:
registry:registry.gitlab.com
registry:registry.gitlab.com
username:${{ secrets.GITLAB_USERNAME }}
username:${{ secrets.GITLAB_USERNAME }}
password:${{ secrets.GITLAB_PASSWORD }}
password:${{ secrets.GITLAB_PASSWORD }}
```
```
If you have [Two-Factor Authentication](https://gitlab.com/help/user/profile/account/two_factor_authentication) enabled, use a [Personal Access Token](https://gitlab.com/help/user/profile/personal_access_tokens) instead of a password.
### Azure Container Registry (ACR)
### Azure Container Registry (ACR)
[Create a service principal](https://docs.microsoft.com/en-us/azure/container-registry/container-registry-auth-service-principal#create-a-service-principal)
[Create a service principal](https://docs.microsoft.com/en-us/azure/container-registry/container-registry-auth-service-principal#create-a-service-principal)
@@ -143,7 +120,7 @@ name: ci
on:
on:
push:
push:
branches:master
branches:main
jobs:
jobs:
login:
login:
@@ -151,7 +128,7 @@ jobs:
steps:
steps:
-
-
name:Login to ACR
name:Login to ACR
uses:docker/login-action@v1
uses:docker/login-action@v2
with:
with:
registry:<registry-name>.azurecr.io
registry:<registry-name>.azurecr.io
username:${{ secrets.AZURE_CLIENT_ID }}
username:${{ secrets.AZURE_CLIENT_ID }}
@@ -162,17 +139,62 @@ jobs:
### Google Container Registry (GCR)
### Google Container Registry (GCR)
Use a service account with the ability to push to GCR and [configure access control](https://cloud.google.com/container-registry/docs/access-control).
> [Google Artifact Registry](#google-artifact-registry-gar) is the evolution of Google Container Registry. As a
Then create and download the JSON key for this service account and save content of `.json` file
> fully-managed service with support for both container images and non-container artifacts. If you currently use
[as a secret](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
> Google Container Registry, use the information [on this page](https://cloud.google.com/artifact-registry/docs/transition/transition-from-gcr)
called `GCR_JSON_KEY` in your GitHub repo. Ensure you set the username to `_json_key`.
> to learn about transitioning to Google Artifact Registry.
You can use either workload identity federation based keyless authentication or service account based authentication.
#### Workload identity federation based authentication
Configure the workload identity federation for github actions in gcloud (for steps, [refer here](https://github.com/google-github-actions/auth#setting-up-workload-identity-federation)). In the steps, your service account should the ability to push to GCR. Then use google-github-actions/auth action for authentication using workload identity like below:
> Replace `<workload_identity_provider>` with configured workload identity provider. For steps to configure, [refer here](https://github.com/google-github-actions/auth#setting-up-workload-identity-federation).
> Replace `<service_account>` with configured service account in workload identity provider which has access to push to GCR
#### Service account based authentication
Use a service account with the ability to push to GCR and [configure access control](https://cloud.google.com/container-registry/docs/access-control).
Then create and download the JSON key for this service account and save content of `.json` file
[as a secret](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
called `GCR_JSON_KEY` in your GitHub repo. Ensure you set the username to `_json_key`,
or `_json_key_base64` if you use a base64-encoded key.
```yaml
name:ci
on:
push:
branches:main
jobs:
jobs:
login:
login:
@@ -180,16 +202,88 @@ jobs:
steps:
steps:
-
-
name:Login to GCR
name:Login to GCR
uses:docker/login-action@v1
uses:docker/login-action@v2
with:
with:
registry:gcr.io
registry:gcr.io
username:_json_key
username:_json_key
password:${{ secrets.GCR_JSON_KEY }}
password:${{ secrets.GCR_JSON_KEY }}
```
```
### Google Artifact Registry (GAR)
You can use either workload identity federation based keyless authentication or service account based authentication.
#### Workload identity federation based authentication
Configure the workload identity federation for github actions in gcloud (for steps, [refer here](https://github.com/google-github-actions/auth#setting-up-workload-identity-federation)). In the steps, your service account should the ability to push to GAR. Then use google-github-actions/auth action for authentication using workload identity like below:
> Replace `<workload_identity_provider>` with configured workload identity provider
> Replace `<service_account>` with configured service account in workload identity provider which has access to push to GCR
> Replace `<location>` with the regional or multi-regional [location](https://cloud.google.com/artifact-registry/docs/repo-organize#locations)
> of the repository where the image is stored.
#### Service account based authentication
Use a service account with the ability to push to GAR and [configure access control](https://cloud.google.com/artifact-registry/docs/access-control).
Then create and download the JSON key for this service account and save content of `.json` file
[as a secret](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
called `GAR_JSON_KEY` in your GitHub repo. Ensure you set the username to `_json_key`,
or `_json_key_base64` if you use a base64-encoded key.
```yaml
name:ci
on:
push:
branches:main
jobs:
login:
runs-on:ubuntu-latest
steps:
-
name:Login to GAR
uses:docker/login-action@v2
with:
registry:<location>-docker.pkg.dev
username:_json_key
password:${{ secrets.GAR_JSON_KEY }}
```
> Replace `<location>` with the regional or multi-regional [location](https://cloud.google.com/artifact-registry/docs/repo-organize#locations)
> of the repository where the image is stored.
### AWS Elastic Container Registry (ECR)
### AWS Elastic Container Registry (ECR)
Use an IAM user with the [ability to push to ECR](https://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr_managed_policies.html).
Use an IAM user with the ability to [push to ECR with `AmazonEC2ContainerRegistryPowerUser` managed policy for example](https://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr_managed_policies.html#AmazonEC2ContainerRegistryPowerUser).
Then create and download access keys and save `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` [as secrets](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
Then create and download access keys and save `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` [as secrets](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
> Replace `<aws-account-number>` and `<region>` with their respective values.
> Replace `<aws-account-number>` and `<region>` with their respective values.
### AWS Public Elastic Container Registry (ECR)
Use an IAM user with the ability to [push to ECR Public with `AmazonElasticContainerRegistryPublicPowerUser` managed policy for example](https://docs.aws.amazon.com/AmazonECR/latest/public/public-ecr-managed-policies.html#AmazonElasticContainerRegistryPublicPowerUser).
Then create and download access keys and save `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` [as secrets](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
in your GitHub repo.
```yaml
name:ci
on:
push:
branches:main
jobs:
login:
runs-on:ubuntu-latest
steps:
-
name:Login to Public ECR
uses:docker/login-action@v2
with:
registry:public.ecr.aws
username:${{ secrets.AWS_ACCESS_KEY_ID }}
password:${{ secrets.AWS_SECRET_ACCESS_KEY }}
env:
AWS_REGION:<region>
```
> Replace `<region>` with its respective value (default `us-east-1`).
To push into OCIR in specific tenancy the [username](https://www.oracle.com/webfolder/technetwork/tutorials/obe/oci/registry/index.html#LogintoOracleCloudInfrastructureRegistryfromtheDockerCLI)
must be placed in format `<tenancy>/<username>` (in case of federated tenancy use the format
For password [create an auth token](https://www.oracle.com/webfolder/technetwork/tutorials/obe/oci/registry/index.html#GetanAuthToken).
Save username and token [as a secrets](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
in your GitHub repo.
```yaml
name:ci
on:
push:
branches:main
jobs:
login:
runs-on:ubuntu-latest
steps:
-
name:Login to OCIR
uses:docker/login-action@v2
with:
registry:<region>.ocir.io
username:${{ secrets.OCI_USERNAME }}
password:${{ secrets.OCI_TOKEN }}
```
> Replace `<region>` with their respective values from [availability regions](https://docs.cloud.oracle.com/iaas/Content/Registry/Concepts/registryprerequisites.htm#Availab)
### Quay.io
Use a [Robot account](https://docs.quay.io/glossary/robot-accounts.html) with the ability to push to a public/private Quay.io repository.
```yaml
name:ci
on:
push:
branches:main
jobs:
login:
runs-on:ubuntu-latest
steps:
-
name:Login to Quay.io
uses:docker/login-action@v2
with:
registry:quay.io
username:${{ secrets.QUAY_USERNAME }}
password:${{ secrets.QUAY_ROBOT_TOKEN }}
```
## Customizing
## Customizing
### inputs
### inputs
@@ -226,6 +461,7 @@ Following inputs can be used as `step.with` keys
| `registry` | String | | Server address of Docker registry. If not set then will default to Docker Hub |
| `registry` | String | | Server address of Docker registry. If not set then will default to Docker Hub |
| `username` | String | | Username used to log against the Docker registry |
| `username` | String | | Username used to log against the Docker registry |
| `password` | String | | Password or personal access token used to log against the Docker registry |
| `password` | String | | Password or personal access token used to log against the Docker registry |
| `ecr` | String | `auto` | Specifies whether the given registry is ECR (`auto`, `true` or `false`) |
| `logout` | Bool | `true` | Log out from the Docker registry at the end of a job |
| `logout` | Bool | `true` | Log out from the Docker registry at the end of a job |
## Keep up-to-date with GitHub Dependabot
## Keep up-to-date with GitHub Dependabot
@@ -243,7 +479,3 @@ updates:
schedule:
schedule:
interval:"daily"
interval:"daily"
```
```
## Limitation
This action is only available for Linux [virtual environments](https://help.github.com/en/articles/virtual-environments-for-github-actions#supported-virtual-environments-and-hardware-resources).
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
CrazyMax
