Skip to content

ci: read the Docker Hub credential from Secrets Manager via OIDC #744

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
robinnsc merged 1 commit into from
Nov 2, 2026
Merged

ci: read the Docker Hub credential from Secrets Manager via OIDC #744

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 15 additions & 2 deletions .github/workflows/dockerhub-description.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -248,6 +248,9 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 10
environment: dockerhub
permissions:
contents: read
id-token: write # OIDC: read the Docker Hub credential from Secrets Manager
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -285,13 +288,23 @@ jobs:
echo "file=$FILE" >> "$GITHUB_OUTPUT"
echo "short=$SHORT" >> "$GITHUB_OUTPUT"

- name: Fetch the Docker Hub credential via OIDC (Secrets Manager)
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: arn:aws:iam::975306274793:role/ExtendDBDockerHubPublisher
role-session-name: extenddb-dockerhub-overview-${{ github.run_id }}
aws-region: us-east-1
- name: Read the Docker Hub credential from Secrets Manager
uses: aws-actions/aws-secretsmanager-get-secrets@2297f9a879480a9e3af9b293ed15c70caf8e1c88 # v3.0.2
with:
secret-ids: DOCKERHUB,extenddb/dockerhub-publish
parse-json-secrets: true

- name: Publish the Overview
env:
IMAGE: ${{ matrix.image }}
FILE: ${{ steps.src.outputs.file }}
SHORT: ${{ steps.src.outputs.short }}
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
run: |
set -euo pipefail

Expand Down
16 changes: 13 additions & 3 deletions .github/workflows/promote-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,7 @@ jobs:
move_latest: ${{ steps.results.outputs.move_latest }}
permissions:
contents: read
id-token: write # OIDC: read the Docker Hub credential from Secrets Manager
steps:
- name: Check out main (ancestry and version gates need history)
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
Expand Down Expand Up @@ -244,10 +245,19 @@ jobs:
echo "::notice::move_latest is unchecked; latest will not be touched"
fi

- name: Fetch the Docker Hub credential via OIDC (Secrets Manager)
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: arn:aws:iam::975306274793:role/ExtendDBDockerHubPublisher
role-session-name: extenddb-dockerhub-promote-${{ github.run_id }}
aws-region: us-east-1
- name: Read the Docker Hub credential from Secrets Manager
uses: aws-actions/aws-secretsmanager-get-secrets@2297f9a879480a9e3af9b293ed15c70caf8e1c88 # v3.0.2
with:
secret-ids: DOCKERHUB,extenddb/dockerhub-publish
parse-json-secrets: true

@robinnsc robinnsc Nov 2, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A small one: the action exports the values to GITHUB_ENV, so DOCKERHUB_TOKEN is now in the environment of every later step in the job, not just the login. Before this, promote-image, sign-image and dockerhub-description passed the token only to their login step, and here promote-registry, skopeo and (in sign-image) the signing-role step and cosign can now read it. The values are masked in logs and the action clears them in its post step, so this isn't a blocker. If you wanted to keep it step-scoped, one option would be to read the secret inside the login step itself, e.g. aws secretsmanager get-secret-value --secret-id extenddb/dockerhub-publish --query SecretString --output text piped through jq into --password-stdin, with an ::add-mask:: for the username. The same applies to the other four workflows.


- name: Log in to Docker Hub (the only step chain with the credential)
env:
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
run: |
set -euo pipefail
skopeo login docker.io -u "$DOCKERHUB_USERNAME" --password-stdin <<< "$DOCKERHUB_TOKEN"
Expand Down
16 changes: 14 additions & 2 deletions .github/workflows/release-dev-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -272,11 +272,23 @@ jobs:
- name: Set up Buildx
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

- name: Fetch the Docker Hub credential via OIDC (Secrets Manager)
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: arn:aws:iam::975306274793:role/ExtendDBDockerHubPublisher
role-session-name: extenddb-dockerhub-dev-${{ github.run_id }}
aws-region: us-east-1
- name: Read the Docker Hub credential from Secrets Manager
uses: aws-actions/aws-secretsmanager-get-secrets@2297f9a879480a9e3af9b293ed15c70caf8e1c88 # v3.0.2
with:
secret-ids: DOCKERHUB,extenddb/dockerhub-publish
parse-json-secrets: true

- name: Log in to Docker Hub
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
username: ${{ env.DOCKERHUB_USERNAME }}
password: ${{ env.DOCKERHUB_TOKEN }}

- name: Gate - skopeo and jq present (preinstalled on ubuntu-latest)
# The forward-only `latest` guard depends on both. Verified before any
Expand Down
21 changes: 18 additions & 3 deletions .github/workflows/release-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,10 @@
# `tag: v*` rule when the tag trigger was removed). A dispatch from any
# other ref cannot read the token at all.
# Required reviewers: the candidate push must be approved before it happens.
# Secrets: DOCKERHUB_USERNAME, DOCKERHUB_TOKEN (Docker Hub PAT, Read/Write).
# Secrets: none. The Docker Hub credential is read at run time from AWS
# Secrets Manager (extenddb/dockerhub-publish) through the OIDC role
# ExtendDBDockerHubPublisher, authorized by the dockerhub environment's
# sub claim. No Docker Hub token is stored in GitHub.
#
# The backend is a dispatch choice rather than a matrix: a partial failure
# must not publish one backend's candidate and not the other under the same
Expand Down Expand Up @@ -372,11 +375,23 @@ jobs:
- name: Set up Buildx
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

- name: Fetch the Docker Hub credential via OIDC (Secrets Manager)
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: arn:aws:iam::975306274793:role/ExtendDBDockerHubPublisher
role-session-name: extenddb-dockerhub-release-${{ github.run_id }}
aws-region: us-east-1
- name: Read the Docker Hub credential from Secrets Manager
uses: aws-actions/aws-secretsmanager-get-secrets@2297f9a879480a9e3af9b293ed15c70caf8e1c88 # v3.0.2
with:
secret-ids: DOCKERHUB,extenddb/dockerhub-publish
parse-json-secrets: true

- name: Log in to Docker Hub
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
username: ${{ env.DOCKERHUB_USERNAME }}
password: ${{ env.DOCKERHUB_TOKEN }}

- name: Push the commit-addressed candidate only
id: push
Expand Down
15 changes: 12 additions & 3 deletions .github/workflows/sign-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,18 @@ jobs:

- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

- name: Fetch the Docker Hub credential via OIDC (Secrets Manager)
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
role-to-assume: arn:aws:iam::975306274793:role/ExtendDBDockerHubPublisher
role-session-name: extenddb-dockerhub-sign-${{ github.run_id }}
aws-region: us-east-1
- name: Read the Docker Hub credential from Secrets Manager
uses: aws-actions/aws-secretsmanager-get-secrets@2297f9a879480a9e3af9b293ed15c70caf8e1c88 # v3.0.2
with:
secret-ids: DOCKERHUB,extenddb/dockerhub-publish
parse-json-secrets: true

- name: Assume the signing role via OIDC (no stored AWS secrets)
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
with:
Expand All @@ -117,9 +129,6 @@ jobs:
aws-region: us-east-1

- name: Log in to Docker Hub (environment credential)
env:
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
run: |
set -euo pipefail
docker login docker.io -u "$DOCKERHUB_USERNAME" --password-stdin <<< "$DOCKERHUB_TOKEN"
Expand Down
Loading