From e7170541d3dcb45a705c564db4360f6038f78cb9 Mon Sep 17 00:00:00 2001 From: Lee Hannigan <29015211+LeeroyHannigan@users.noreply.github.com> Date: Mon, 2 Nov 2026 13:59:57 +0000 Subject: [PATCH] ci: read the Docker Hub credential from Secrets Manager via OIDC The release-image, release-dev-image, promote-image, sign-image and dockerhub-description workflows now fetch the Docker Hub username and token from AWS Secrets Manager (extenddb/dockerhub-publish) through the ExtendDBDockerHubPublisher OIDC role, instead of the DOCKERHUB_USERNAME and DOCKERHUB_TOKEN GitHub Actions secrets. The role is gated to the dockerhub environment and can read only that one secret. promote-image and dockerhub-description gain id-token: write on the job that needs it. --- .github/workflows/dockerhub-description.yml | 17 +++++++++++++++-- .github/workflows/promote-image.yml | 16 +++++++++++++--- .github/workflows/release-dev-image.yml | 16 ++++++++++++++-- .github/workflows/release-image.yml | 21 ++++++++++++++++++--- .github/workflows/sign-image.yml | 15 ++++++++++++--- 5 files changed, 72 insertions(+), 13 deletions(-) diff --git a/.github/workflows/dockerhub-description.yml b/.github/workflows/dockerhub-description.yml index 464b42447..7f6be2863 100644 --- a/.github/workflows/dockerhub-description.yml +++ b/.github/workflows/dockerhub-description.yml @@ -248,6 +248,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 environment: dockerhub + permissions: + contents: read + id-token: write # OIDC: read the Docker Hub credential from Secrets Manager strategy: fail-fast: false matrix: @@ -285,13 +288,23 @@ jobs: echo "file=$FILE" >> "$GITHUB_OUTPUT" echo "short=$SHORT" >> "$GITHUB_OUTPUT" + - name: Fetch the Docker Hub credential via OIDC (Secrets Manager) + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 + with: + role-to-assume: arn:aws:iam::975306274793:role/ExtendDBDockerHubPublisher + role-session-name: extenddb-dockerhub-overview-${{ github.run_id }} + aws-region: us-east-1 + - name: Read the Docker Hub credential from Secrets Manager + uses: aws-actions/aws-secretsmanager-get-secrets@2297f9a879480a9e3af9b293ed15c70caf8e1c88 # v3.0.2 + with: + secret-ids: DOCKERHUB,extenddb/dockerhub-publish + parse-json-secrets: true + - name: Publish the Overview env: IMAGE: ${{ matrix.image }} FILE: ${{ steps.src.outputs.file }} SHORT: ${{ steps.src.outputs.short }} - DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} - DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} run: | set -euo pipefail diff --git a/.github/workflows/promote-image.yml b/.github/workflows/promote-image.yml index d7ba2724b..0f3f63e71 100644 --- a/.github/workflows/promote-image.yml +++ b/.github/workflows/promote-image.yml @@ -102,6 +102,7 @@ jobs: move_latest: ${{ steps.results.outputs.move_latest }} permissions: contents: read + id-token: write # OIDC: read the Docker Hub credential from Secrets Manager steps: - name: Check out main (ancestry and version gates need history) uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 @@ -244,10 +245,19 @@ jobs: echo "::notice::move_latest is unchecked; latest will not be touched" fi + - name: Fetch the Docker Hub credential via OIDC (Secrets Manager) + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 + with: + role-to-assume: arn:aws:iam::975306274793:role/ExtendDBDockerHubPublisher + role-session-name: extenddb-dockerhub-promote-${{ github.run_id }} + aws-region: us-east-1 + - name: Read the Docker Hub credential from Secrets Manager + uses: aws-actions/aws-secretsmanager-get-secrets@2297f9a879480a9e3af9b293ed15c70caf8e1c88 # v3.0.2 + with: + secret-ids: DOCKERHUB,extenddb/dockerhub-publish + parse-json-secrets: true + - name: Log in to Docker Hub (the only step chain with the credential) - env: - DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} - DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} run: | set -euo pipefail skopeo login docker.io -u "$DOCKERHUB_USERNAME" --password-stdin <<< "$DOCKERHUB_TOKEN" diff --git a/.github/workflows/release-dev-image.yml b/.github/workflows/release-dev-image.yml index a85e8ed25..c2052e4ff 100644 --- a/.github/workflows/release-dev-image.yml +++ b/.github/workflows/release-dev-image.yml @@ -272,11 +272,23 @@ jobs: - name: Set up Buildx uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 + - name: Fetch the Docker Hub credential via OIDC (Secrets Manager) + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 + with: + role-to-assume: arn:aws:iam::975306274793:role/ExtendDBDockerHubPublisher + role-session-name: extenddb-dockerhub-dev-${{ github.run_id }} + aws-region: us-east-1 + - name: Read the Docker Hub credential from Secrets Manager + uses: aws-actions/aws-secretsmanager-get-secrets@2297f9a879480a9e3af9b293ed15c70caf8e1c88 # v3.0.2 + with: + secret-ids: DOCKERHUB,extenddb/dockerhub-publish + parse-json-secrets: true + - name: Log in to Docker Hub uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} + username: ${{ env.DOCKERHUB_USERNAME }} + password: ${{ env.DOCKERHUB_TOKEN }} - name: Gate - skopeo and jq present (preinstalled on ubuntu-latest) # The forward-only `latest` guard depends on both. Verified before any diff --git a/.github/workflows/release-image.yml b/.github/workflows/release-image.yml index 37775b3d7..04a89243b 100644 --- a/.github/workflows/release-image.yml +++ b/.github/workflows/release-image.yml @@ -50,7 +50,10 @@ # `tag: v*` rule when the tag trigger was removed). A dispatch from any # other ref cannot read the token at all. # Required reviewers: the candidate push must be approved before it happens. -# Secrets: DOCKERHUB_USERNAME, DOCKERHUB_TOKEN (Docker Hub PAT, Read/Write). +# Secrets: none. The Docker Hub credential is read at run time from AWS +# Secrets Manager (extenddb/dockerhub-publish) through the OIDC role +# ExtendDBDockerHubPublisher, authorized by the dockerhub environment's +# sub claim. No Docker Hub token is stored in GitHub. # # The backend is a dispatch choice rather than a matrix: a partial failure # must not publish one backend's candidate and not the other under the same @@ -372,11 +375,23 @@ jobs: - name: Set up Buildx uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 + - name: Fetch the Docker Hub credential via OIDC (Secrets Manager) + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 + with: + role-to-assume: arn:aws:iam::975306274793:role/ExtendDBDockerHubPublisher + role-session-name: extenddb-dockerhub-release-${{ github.run_id }} + aws-region: us-east-1 + - name: Read the Docker Hub credential from Secrets Manager + uses: aws-actions/aws-secretsmanager-get-secrets@2297f9a879480a9e3af9b293ed15c70caf8e1c88 # v3.0.2 + with: + secret-ids: DOCKERHUB,extenddb/dockerhub-publish + parse-json-secrets: true + - name: Log in to Docker Hub uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} + username: ${{ env.DOCKERHUB_USERNAME }} + password: ${{ env.DOCKERHUB_TOKEN }} - name: Push the commit-addressed candidate only id: push diff --git a/.github/workflows/sign-image.yml b/.github/workflows/sign-image.yml index d0d9d3c61..b744de4f0 100644 --- a/.github/workflows/sign-image.yml +++ b/.github/workflows/sign-image.yml @@ -109,6 +109,18 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - name: Fetch the Docker Hub credential via OIDC (Secrets Manager) + uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 + with: + role-to-assume: arn:aws:iam::975306274793:role/ExtendDBDockerHubPublisher + role-session-name: extenddb-dockerhub-sign-${{ github.run_id }} + aws-region: us-east-1 + - name: Read the Docker Hub credential from Secrets Manager + uses: aws-actions/aws-secretsmanager-get-secrets@2297f9a879480a9e3af9b293ed15c70caf8e1c88 # v3.0.2 + with: + secret-ids: DOCKERHUB,extenddb/dockerhub-publish + parse-json-secrets: true + - name: Assume the signing role via OIDC (no stored AWS secrets) uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 with: @@ -117,9 +129,6 @@ jobs: aws-region: us-east-1 - name: Log in to Docker Hub (environment credential) - env: - DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} - DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} run: | set -euo pipefail docker login docker.io -u "$DOCKERHUB_USERNAME" --password-stdin <<< "$DOCKERHUB_TOKEN"