Merge pull request #53304 from vvoland/bimimg-oidc

gha/bin-image: Use OIDC to publish to Docker Hub

.github/workflows/bin-image.yml

@@ -28,12 +28,12 @@ jobs:
 
   build:
     if: ${{ !failure() && !cancelled() && (github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'ci/validate-only')) }}
-    uses: docker/github-builder/.github/workflows/bake.yml@27ade872c1e2296e62ef15ab3b10d37665e57cf7 # v1.15.0
+    uses: docker/github-builder/.github/workflows/bake.yml@a492c6d04fd3315f67230809b44d60cc0acd50b3 # v1.16.0
     needs:
       - validate-dco
     permissions:
       contents: read # same as global permission
-      id-token: write # for signing attestation(s) with GitHub OIDC Token
+      id-token: write # for signing attestation(s) and authenticating to Docker Hub with GitHub OIDC Token
     with:
       setup-qemu: true
       target: bin-image-cross
@@ -67,8 +67,7 @@ jobs:
         type=semver,pattern={{version}},match=docker-(.*)
         type=semver,pattern={{major}}.{{minor}},match=docker-(.*)
         type=semver,pattern={{major}},match=docker-(.*)
-    secrets:
-      registry-auths: |
-        - registry: docker.io
-          username: ${{ secrets.DOCKERHUB_MOBYBIN_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_MOBYBIN_TOKEN }}
+      registry-identities: |
+        - type: dockerhub
+          username: moby
+          connection_id: ${{ vars.MOBYBIN_DOCKERHUB_OIDC_CONNECTIONID }}