From bdff906f4e4a1bf6efb5512a965c14374972bfe6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= Date: Wed, 5 Aug 2026 13:14:30 +0200 Subject: [PATCH 1/2] Update docker/github-builder action to v1.16.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It includes a fix which skips registry identity validation when image pushes are disabled. Signed-off-by: Paweł Gronowski --- .github/workflows/bin-image.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/bin-image.yml b/.github/workflows/bin-image.yml index ffb138c241..f753909429 100644 --- a/.github/workflows/bin-image.yml +++ b/.github/workflows/bin-image.yml @@ -28,7 +28,7 @@ jobs: build: if: ${{ !failure() && !cancelled() && (github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'ci/validate-only')) }} - uses: docker/github-builder/.github/workflows/bake.yml@27ade872c1e2296e62ef15ab3b10d37665e57cf7 # v1.15.0 + uses: docker/github-builder/.github/workflows/bake.yml@a492c6d04fd3315f67230809b44d60cc0acd50b3 # v1.16.0 needs: - validate-dco permissions: From 1995fe2e6feb9cb593d67551ada88c83ad45c70c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= Date: Tue, 4 Aug 2026 19:21:19 +0200 Subject: [PATCH 2/2] gha/bin-image: Use OIDC to publish to Docker Hub MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Paweł Gronowski --- .github/workflows/bin-image.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/.github/workflows/bin-image.yml b/.github/workflows/bin-image.yml index f753909429..49c27f6fd0 100644 --- a/.github/workflows/bin-image.yml +++ b/.github/workflows/bin-image.yml @@ -33,7 +33,7 @@ jobs: - validate-dco permissions: contents: read # same as global permission - id-token: write # for signing attestation(s) with GitHub OIDC Token + id-token: write # for signing attestation(s) and authenticating to Docker Hub with GitHub OIDC Token with: setup-qemu: true target: bin-image-cross @@ -67,8 +67,7 @@ jobs: type=semver,pattern={{version}},match=docker-(.*) type=semver,pattern={{major}}.{{minor}},match=docker-(.*) type=semver,pattern={{major}},match=docker-(.*) - secrets: - registry-auths: | - - registry: docker.io - username: ${{ secrets.DOCKERHUB_MOBYBIN_USERNAME }} - password: ${{ secrets.DOCKERHUB_MOBYBIN_TOKEN }} + registry-identities: | + - type: dockerhub + username: moby + connection_id: ${{ vars.MOBYBIN_DOCKERHUB_OIDC_CONNECTIONID }}