Just for good measure and extra safety, redact temporary
credentials when aws authorization token is retrieved using
IAM authentication credentials to access Amazon ECR.
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
Hi there! We're thrilled that you'd like to contribute to this project. Your help is essential for keeping it great.
Contributions to this project are [released](https://help.github.com/articles/github-terms-of-service/#6-contributions-under-repository-license) to the public under the [project's open source license](LICENSE).
Contributions to this project are [released](https://docs.github.com/en/github/site-policy/github-terms-of-service#6-contributions-under-repository-license)
to the public under the [project's open source license](LICENSE).
## Submitting a pull request
1. [Fork](https://github.com/crazy-max/ghaction-docker-login/fork) and clone the repository
1. [Fork](https://github.com/docker/login-action/fork) and clone the repository
2. Configure and install the dependencies: `yarn install`
4. Create a new branch: `git checkout -b my-branch-name`
5. Make your change
6. Run pre-checkin: `yarn run pre-checkin`
7. Push to your fork and [submit a pull request](https://github.com/crazy-max/ghaction-docker-login/compare)
8. Pat your self on the back and wait for your pull request to be reviewed and merged.
3. Create a new branch: `git checkout -b my-branch-name`
4. Make your changes
5. Make sure the tests pass: `docker buildx bake test`
6. Format code and build javascript artifacts: `docker buildx bake pre-checkin`
7. Validate all code has correctly formatted and built: `docker buildx bake validate`
8. Push to your fork and [submit a pull request](https://github.com/docker/login-action/compare)
9. Pat your self on the back and wait for your pull request to be reviewed and merged.
Here are a few things you can do that will increase the likelihood of your pull request being accepted:
- Write tests.
- Make sure the `README.md` and any other relevant **documentation are kept up-to-date**.
- We try to follow [SemVer v2.0.0](https://semver.org/). Randomly breaking public APIs is not an option.
- Keep your change as focused as possible. If there are multiple changes you would like to make that are not dependent upon each other, consider submitting them as **separate pull requests**.
@@ -24,5 +28,5 @@ Here are a few things you can do that will increase the likelihood of your pull
## Resources
- [How to Contribute to Open Source](https://opensource.guide/how-to-contribute/)
# paste your YAML workflow file here and remove sensitive data
```
### Logs
> Download the [log file of your build](https://help.github.com/en/actions/configuring-and-managing-workflows/managing-a-workflow-run#downloading-logs) and [attach it](https://help.github.com/en/github/managing-your-work-on-github/file-attachments-on-issues-and-pull-requests) to this issue.
# Support [](https://isitmaintained.com/project/crazy-max/ghaction-docker-login)
## Reporting an issue
Please do a search in [open issues](https://github.com/crazy-max/ghaction-docker-login/issues?utf8=%E2%9C%93&q=) to see if the issue or feature request has already been filed.
If you find your issue already exists, make relevant comments and add your [reaction](https://github.com/blog/2119-add-reactions-to-pull-requests-issues-and-comments). Use a reaction in place of a "+1" comment.
:+1: - upvote
:-1: - downvote
If you cannot find an existing issue that describes your bug or feature, submit an issue using the guidelines below.
## Writing good bug reports and feature requests
File a single issue per problem and feature request.
* Do not enumerate multiple bugs or feature requests in the same issue.
* Do not add your issue as a comment to an existing issue unless it's for the identical input. Many issues look similar, but have different causes.
The more information you can provide, the more likely someone will be successful reproducing the issue and finding a fix.
You are now ready to [create a new issue](https://github.com/crazy-max/ghaction-docker-login/issues/new/choose)!
## Closure policy
* Issues that don't have the information requested above (when applicable) will be closed immediately and the poster directed to the support guidelines.
* Issues that go a week without a response from original poster are subject to closure at my discretion.
* [Keep up-to-date with GitHub Dependabot](#keep-up-to-date-with-github-dependabot)
## Usage
### DockerHub
### DockerHub
When authenticating to [Docker Hub](https://hub.docker.com) with GitHub Actions,
use a [personal access token](https://docs.docker.com/docker-hub/access-tokens/).
Don't use your account password.
```yaml
name:ci
on:
push:
branches:master
branches:main
jobs:
login:
runs-on:ubuntu-latest
steps:
-
name:Checkout
uses:actions/checkout@v2
-
name:Login to DockerHub
uses:crazy-max/ghaction-docker-login@v1
name:Login to Docker Hub
uses:docker/login-action@v3
with:
username:${{ secrets.DOCKERHUB_USERNAME }}
password:${{ secrets.DOCKERHUB_PASSWORD }}
password:${{ secrets.DOCKERHUB_TOKEN }}
```
### GitHub Package Registry
### GitHub Container Registry
To authenticate to the [GitHub Container Registry](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry),
use the [`GITHUB_TOKEN`](https://docs.github.com/en/actions/reference/authentication-in-a-workflow)
secret.
```yaml
name:ci
on:
push:
branches:master
branches:main
jobs:
login:
runs-on:ubuntu-latest
steps:
-
name:Checkout
uses:actions/checkout@v2
-
name:Login to GitHub Package Registry
uses:crazy-max/ghaction-docker-login@v1
name:Login to GitHub Container Registry
uses:docker/login-action@v3
with:
registry:docker.pkg.github.com
username:${{ github.repository_owner }}
registry:ghcr.io
username:${{ github.actor }}
password:${{ secrets.GITHUB_TOKEN }}
```
You may need to [manage write and read access of GitHub Actions](https://docs.github.com/en/packages/managing-github-packages-using-github-actions-workflows/publishing-and-installing-a-package-with-github-actions#upgrading-a-workflow-that-accesses-ghcrio)
for repositories in the container settings.
You can also use a [personal access token (PAT)](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token)
with the [appropriate scopes](https://docs.github.com/en/packages/getting-started-with-github-container-registry/migrating-to-github-container-registry-for-docker-images#authenticating-with-the-container-registry).
### GitLab
```yaml
@@ -84,58 +93,217 @@ name: ci
on:
push:
branches:master
branches:main
jobs:
login:
runs-on:ubuntu-latest
steps:
-
name:Checkout
uses:actions/checkout@v2
-
name:Login to GitLab
uses:crazy-max/ghaction-docker-login@v1
uses:docker/login-action@v3
with:
registry:registry.gitlab.com
username:${{ secrets.GITLAB_USERNAME }}
password:${{ secrets.GITLAB_PASSWORD }}
```
### Google Container Registry (GCR)
If you have [Two-Factor Authentication](https://gitlab.com/help/user/profile/account/two_factor_authentication)
enabled, use a [Personal Access Token](https://gitlab.com/help/user/profile/personal_access_tokens)
instead of a password.
Use a service account with the ability to push to GCR and [configure access control](https://cloud.google.com/container-registry/docs/access-control).
Then create and download the JSON key for this service account and save content of `.json` file
[as a secret](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
called `GCR_JSON_KEY` in your GitHub repo. Ensure you set the username to `_json_key`.
### Azure Container Registry (ACR)
[Create a service principal](https://docs.microsoft.com/en-us/azure/container-registry/container-registry-auth-service-principal#create-a-service-principal)
with access to your container registry through the [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli)
and take note of the generated service principal's ID (also called _client ID_)
and password (also called _client secret_).
```yaml
name:ci
on:
push:
branches:master
branches:main
jobs:
login:
runs-on:ubuntu-latest
steps:
-
name:Checkout
uses:actions/checkout@v2
name:Login to ACR
uses:docker/login-action@v3
with:
registry:<registry-name>.azurecr.io
username:${{ secrets.AZURE_CLIENT_ID }}
password:${{ secrets.AZURE_CLIENT_SECRET }}
```
> Replace `<registry-name>` with the name of your registry.
### Google Container Registry (GCR)
> [Google Artifact Registry](#google-artifact-registry-gar) is the evolution of
> Google Container Registry. As a fully-managed service with support for both
> container images and non-container artifacts. If you currently use Google
> Container Registry, use the information [on this page](https://cloud.google.com/artifact-registry/docs/transition/transition-from-gcr)
> to learn about transitioning to Google Artifact Registry.
You can authenticate with workload identity federation or a service account.
#### Workload identity federation
Configure the workload identity federation for GitHub Actions in Google Cloud,
> Replace `<workload_identity_provider>` with configured workload identity
> provider. For steps to configure, [see here](https://github.com/google-github-actions/auth#setting-up-workload-identity-federation).
> Replace `<service_account>` with configured service account in workload
> identity provider which has access to push to GCR
#### Service account based authentication
Use a service account with permission to push to GCR and [configure access control](https://cloud.google.com/container-registry/docs/access-control).
Download the key for the service account as a JSON file. Save the contents of
the file [as a secret](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
named `GCR_JSON_KEY` in your GitHub repository. Set the username to `_json_key`,
or `_json_key_base64` if you use a base64-encoded key.
```yaml
name:ci
on:
push:
branches:main
jobs:
login:
runs-on:ubuntu-latest
steps:
-
name:Login to GCR
uses:crazy-max/ghaction-docker-login@v1
uses:docker/login-action@v3
with:
registry:gcr.io
username:_json_key
password:${{ secrets.GCR_JSON_KEY }}
```
### Google Artifact Registry (GAR)
You can authenticate with workload identity federation or a service account.
#### Workload identity federation
Download the key for the service account as a JSON file. Save the contents of
the file [as a secret](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
named `GCR_JSON_KEY` in your GitHub repository. Set the username to `_json_key`,
or `_json_key_base64` if you use a base64-encoded key.
> Replace `<workload_identity_provider>` with configured workload identity
> provider
> Replace `<service_account>` with configured service account in workload
> identity provider which has access to push to GCR
> Replace `<location>` with the regional or multi-regional [location](https://cloud.google.com/artifact-registry/docs/repo-organize#locations)
> of the repository where the image is stored.
#### Service account based authentication
Use a service account with permission to push to GAR and [configure access control](https://cloud.google.com/artifact-registry/docs/access-control).
Download the key for the service account as a JSON file. Save the contents of
the file [as a secret](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
named `GCR_JSON_KEY` in your GitHub repository. Set the username to `_json_key`,
or `_json_key_base64` if you use a base64-encoded key.
```yaml
name:ci
on:
push:
branches:main
jobs:
login:
runs-on:ubuntu-latest
steps:
-
name:Login to GAR
uses:docker/login-action@v3
with:
registry:<location>-docker.pkg.dev
username:_json_key
password:${{ secrets.GAR_JSON_KEY }}
```
> Replace `<location>` with the regional or multi-regional [location](https://cloud.google.com/artifact-registry/docs/repo-organize#locations)
> of the repository where the image is stored.
### AWS Elastic Container Registry (ECR)
Use an IAM user with the [ability to push to ECR](https://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr_managed_policies.html).
Then create and download access keys and save `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` [as secrets](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
Use an IAM user with the ability to [push to ECR with `AmazonEC2ContainerRegistryPowerUser` managed policy for example](https://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr_managed_policies.html#AmazonEC2ContainerRegistryPowerUser).
Download the access keys and save them as `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` [as secrets](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
> Replace `<aws-account-number>` and `<region>` with their respective values.
### AWS Public Elastic Container Registry (ECR)
Use an IAM user with permission to push to ECR Public, for example using [managed policies](https://docs.aws.amazon.com/AmazonECR/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonEC2ContainerRegistryPowerUser).
Download the access keys and save them as `AWS_ACCESS_KEY_ID` and
To push into OCIR in specific tenancy the [username](https://www.oracle.com/webfolder/technetwork/tutorials/obe/oci/registry/index.html#LogintoOracleCloudInfrastructureRegistryfromtheDockerCLI)
must be placed in format `<tenancy>/<username>` (in case of federated tenancy use the format
For password [create an auth token](https://www.oracle.com/webfolder/technetwork/tutorials/obe/oci/registry/index.html#GetanAuthToken).
Save username and token [as a secrets](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
in your GitHub repo.
```yaml
name:ci
on:
push:
branches:main
jobs:
login:
runs-on:ubuntu-latest
steps:
-
name:Login to OCIR
uses:docker/login-action@v3
with:
registry:<region>.ocir.io
username:${{ secrets.OCI_USERNAME }}
password:${{ secrets.OCI_TOKEN }}
```
> Replace `<region>` with their respective values from [availability regions](https://docs.cloud.oracle.com/iaas/Content/Registry/Concepts/registryprerequisites.htm#Availab)
### Quay.io
Use a [Robot account](https://docs.quay.io/glossary/robot-accounts.html) with
permission to push to a Quay.io repository.
```yaml
name:ci
on:
push:
branches:main
jobs:
login:
runs-on:ubuntu-latest
steps:
-
name:Login to Quay.io
uses:docker/login-action@v3
with:
registry:quay.io
username:${{ secrets.QUAY_USERNAME }}
password:${{ secrets.QUAY_ROBOT_TOKEN }}
```
## Customizing
### inputs
Following inputs can be used as `step.with` keys
The following inputs can be used as `step.with` keys:
| `registry` | String | | Server address of Docker registry. If not set then will default to Docker Hub |
| `username` | String | | Username for authenticating to the Docker registry |
| `password` | String | | Password or personal access token for authenticating the Docker registry |
| `ecr` | String | `auto` | Specifies whether the given registry is ECR (`auto`, `true` or `false`) |
| `logout` | Bool | `true` | Log out from the Docker registry at the end of a job |
## Limitation
## Keep up-to-date with GitHub Dependabot
This action is only available for Linux [virtual environments](https://help.github.com/en/articles/virtual-environments-for-github-actions#supported-virtual-environments-and-hardware-resources).
Since [Dependabot](https://docs.github.com/en/github/administering-a-repository/keeping-your-actions-up-to-date-with-github-dependabot)
has [native GitHub Actions support](https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates#package-ecosystem),
to enable it on your GitHub repo all you need to do is add the `.github/dependabot.yml` file:
## How can I help?
All kinds of contributions are welcome :raised_hands:! The most basic way to show your support is to star :star2:
the project, or to raise issues :speech_balloon: You can also support this project by
[**becoming a sponsor on GitHub**](https://github.com/sponsors/crazy-max) :clap: or by making a
[Paypal donation](https://www.paypal.me/crazyws) to ensure this journey continues indefinitely! :rocket:
Thanks again for your support, it is much appreciated! :pray:
(()=>{vare={650:e=>{varr=Object.prototype.toString;varn=typeofBuffer.alloc==="function"&&typeofBuffer.allocUnsafe==="function"&&typeofBuffer.from==="function";functionisArrayBuffer(e){returnr.call(e).slice(8,-1)==="ArrayBuffer"}functionfromArrayBuffer(e,r,t){r>>>=0;varo=e.byteLength-r;if(o<0){thrownewRangeError("'offset' is out of bounds")}if(t===undefined){t=o}else{t>>>=0;if(t>o){thrownewRangeError("'length' is out of bounds")}}returnn?Buffer.from(e.slice(r,r+t)):newBuffer(newUint8Array(e.slice(r,r+t)))}functionfromString(e,r){if(typeofr!=="string"||r===""){r="utf8"}if(!Buffer.isEncoding(r)){thrownewTypeError('"encoding" must be a valid string encoding')}returnn?Buffer.from(e,r):newBuffer(e,r)}functionbufferFrom(e,r,t){if(typeofe==="number"){thrownewTypeError('"value" argument must not be a number')}if(isArrayBuffer(e)){returnfromArrayBuffer(e,r,t)}if(typeofe==="string"){returnfromString(e,r)}returnn?Buffer.from(e):newBuffer(e)}e.exports=bufferFrom},274:(e,r,n)=>{vart=n(339);varo=Object.prototype.hasOwnProperty;vari=typeofMap!=="undefined";functionArraySet(){this._array=[];this._set=i?newMap:Object.create(null)}ArraySet.fromArray=functionArraySet_fromArray(e,r){varn=newArraySet;for(vart=0,o=e.length;t<o;t++){n.add(e[t],r)}returnn};ArraySet.prototype.size=functionArraySet_size(){returni?this._set.size:Object.getOwnPropertyNames(this._set).length};ArraySet.prototype.add=functionArraySet_add(e,r){varn=i?e:t.toSetString(e);vara=i?this.has(e):o.call(this._set,n);varu=this._array.length;if(!a||r){this._array.push(e)}if(!a){if(i){this._set.set(e,u)}else{this._set[n]=u}}};ArraySet.prototype.has=functionArraySet_has(e){if(i){returnthis._set.has(e)}else{varr=t.toSetString(e);returno.call(this._set,r)}};ArraySet.prototype.indexOf=functionArraySet_indexOf(e){if(i){varr=this._set.get(e);if(r>=0){returnr}}else{varn=t.toSetString(e);if(o.call(this._set,n)){returnthis._set[n]}}thrownewError('"'+e+'" is not in the set.')};ArraySet.prototype.at=functionArraySet_at(e){if(e>=0&&e<this._array.length){returnthis._array[e]}thrownewError("No element indexed by "+e)};ArraySet.prototype.toArray=functionArraySet_toArray(){returnthis._array.slice()};r.I=ArraySet},449:(e,r,n)=>{vart=n(190);varo=5;vari=1<<o;vara=i-1;varu=i;functiontoVLQSigned(e){returne<0?(-e<<1)+1:(e<<1)+0}functionfromVLQSigned(e){varr=(e&1)===1;varn=e>>1;returnr?-n:n}r.encode=functionbase64VLQ_encode(e){varr="";varn;vari=toVLQSigned(e);do{n=i&a;i>>>=o;if(i>0){n|=u}r+=t.encode(n)}while(i>0);returnr};r.decode=functionbase64VLQ_decode(e,r,n){vari=e.length;vars=0;varl=0;varc,p;do{if(r>=i){thrownewError("Expected more digits in base 64 VLQ value.")}p=t.decode(e.charCodeAt(r++));if(p===-1){thrownewError("Invalid base64 digit: "+e.charAt(r-1))}c=!!(p&u);p&=a;s=s+(p<<l);l+=o}while(c);n.value=fromVLQSigned(s);n.rest=r}},190:(e,r)=>{varn="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".split("");r.encode=function(e){if(0<=e&&e<n.length){returnn[e]}thrownewTypeError("Must be between 0 and 63: "+e)};r.decode=function(e){varr=65;varn=90;vart=97;varo=122;vari=48;vara=57;varu=43;vars=47;varl=26;varc=52;if(r<=e&&e<=n){returne-r}if(t<=e&&e<=o){returne-t+l}if(i<=e&&e<=a){returne-i+c}if(e==u){return62}if(e==s){return63}return-1}},345:(e,r)=>{r.GREATEST_LOWER_BOUND=1;r.LEAST_UPPER_BOUND=2;functionrecursiveSearch(e,n,t,o,i,a){varu=Math.floor((n-e)/2)+e;vars=i(t,o[u],true);if(s===0){returnu}elseif(s>0){if(n-u>1){returnrecursiveSearch(u,n,t,o,i,a)}if(a==r.LEAST_UPPER_BOUND){returnn<o.length?n:-1}else{returnu}}else{if(u-e>1){returnrecursiveSearch(e,u,t,o,i,a)}if(a==r.LEAST_UPPER_BOUND){returnu}else{returne<0?-1:e}}}r.search=functionsearch(e,n,t,o){if(n.length===0){return-1}vari=recursiveSearch(-1,n.length,e,n,t,o||r.GREATEST_LOWER_BOUND);if(i<0){return-1}while(i-1>=0){if(t(n[i],n[i-1],true)!==0){break}--i}returni}},680:(e,r,n)=>{vart=n(339);functiongeneratedPositionAfter(e,r){varn=e.generatedLine;varo=r.generatedLine;vari=e.generatedColumn;vara=r.generatedColumn;returno>n||o==n&&a>=i||t.compareByGeneratedPositionsInflated(e,r)<=0}functionMappingList(){this._array=[];this._sorted=true;this._last={generatedLine:-1,generatedColumn:0}}MappingList.prototype.unsortedForEach=functionMappingList_forEach(e,r){this._array.forEach(e,r)};MappingList.prototype.add=functionMappingList_add(e){if(generatedPositionAfter(this._last,e)){this._last=e;this._array.push(e)}else{this._sorted=false;this._array.push(e)}};MappingList.prototype.toArray=functionMappingList_toArray(){if(!this._sorted){this._array.sort(t.compareByGeneratedPositionsInflated);this._sorted=true}returnthis._array};r.H=MappingList},758:(e,r)=>{functionswap(e,r,n){vart=e[r];e[r]=e[n];e[n]=t}functionrandomIntInRange(e,r){returnMath.round(e+Math.random()*(r-e))}functiondoQuickSort(e,r,n,t){if(n<t){varo=randomIntInRange(n,t);vari=n-1;swap(e,o,t);vara=e[t];for(varu=n;u<t;u++){if(r(e[u],Line truncated
File diff suppressed because it is too large.
Load diff
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
CrazyMax
