.github/dependabot.yml

@@ -10,9 +10,6 @@ updates:
       crazy-max-dot-github:
         patterns:
           - "crazy-max/.github/*"
-      codeql-actions:
-        patterns:
-          - "github/codeql-action/*"
     labels:
       - "dependencies"
       - "bot"

.github/workflows/ci.yml

@@ -7,9 +7,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-env:
-  GHCR_TEST_IMAGE: ghcr.io/docker/login-action-test:ci-${{ github.sha }}
-
 on:
   workflow_dispatch:
   schedule:
@@ -25,7 +22,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Stop docker
         run: |
@@ -49,7 +46,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Login to GitHub Container Registry
         uses: ./
@@ -59,75 +56,44 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
           logout: ${{ matrix.logout }}
 
-  push-ghcr:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      -
-        name: Login to GitHub Container Registry
-        uses: ./
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      -
-        name: Build and push test image
-        run: |
-          docker buildx build --push -t "${GHCR_TEST_IMAGE}" - <<EOF
-          FROM scratch
-          LABEL org.opencontainers.image.title="docker/login-action CI test image"
-          LABEL org.opencontainers.image.description="Empty image used by CI to verify GHCR authentication."
-          LABEL org.opencontainers.image.source="https://github.com/${GITHUB_REPOSITORY}"
-          EOF
-
   dind:
     runs-on: ubuntu-latest
-    needs:
-      - push-ghcr
-    permissions:
-      contents: read
-      packages: read
     env:
       DOCKER_CONFIG: $HOME/.docker
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Login to GitHub Container Registry
         uses: ./
         with:
           registry: ghcr.io
-          username: ${{ github.actor }}
+          username: ${{ secrets.GHCR_USERNAME }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.GHCR_PAT }}
       -
         name: DinD
         uses: docker://docker:29.3@sha256:4d90f1f6c400315c2dba96d3ec93c01e64198395cbba04f79d12adce4f737029
         with:
           entrypoint: docker
-          args: pull ${{ env.GHCR_TEST_IMAGE }}
+          args: pull ghcr.io/docker-ghactiontest/test
       -
-        name: Pull test image
+        name: Pull private image
         run: |
           docker image prune -a -f >/dev/null 2>&1
-          docker pull "${GHCR_TEST_IMAGE}"
+          docker pull ghcr.io/docker-ghactiontest/test
 
   acr:
     runs-on: ubuntu-latest
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Login to ACR
         uses: ./
         with:
-          registry: officialgithubactions.azurecr.io
+          registry: ${{ secrets.AZURE_REGISTRY_NAME }}.azurecr.io
           username: ${{ secrets.AZURE_CLIENT_ID }}
           password: ${{ secrets.AZURE_CLIENT_SECRET }}
 
@@ -142,57 +108,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Login to Docker Hub
         uses: ./
         with:
-          username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-  dockerhub-oidc:
-    permissions:
-      contents: read
-      id-token: write
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - ubuntu-latest
-          - windows-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      -
-        name: Login to Docker Hub with OIDC
-        uses: ./
-        env:
-          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
-        with:
-          username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
-
-  registry-auth-oidc:
-    permissions:
-      contents: read
-      id-token: write
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      -
-        name: Login to registries
-        uses: ./
-        env:
-          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
-        with:
-          registry-auth: |
-            - username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
-            - registry: ghcr.io
-              username: ${{ github.actor }}
-              password: ${{ secrets.GITHUB_TOKEN }}
 
   ecr:
     runs-on: ${{ matrix.os }}
@@ -205,12 +127,12 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Login to ECR
         uses: ./
         with:
-          registry: 175142243308.dkr.ecr.us-east-1.amazonaws.com
+          registry: ${{ secrets.AWS_ACCOUNT_NUMBER }}.dkr.ecr.us-east-1.amazonaws.com
           username: ${{ secrets.AWS_ACCESS_KEY_ID }}
           password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
 
@@ -225,10 +147,10 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -237,34 +159,7 @@ jobs:
         name: Login to ECR
         uses: ./
         with:
-          registry: 175142243308.dkr.ecr.us-east-1.amazonaws.com
+          registry: ${{ secrets.AWS_ACCOUNT_NUMBER }}.dkr.ecr.us-east-1.amazonaws.com
-
-  ecr-oidc:
-    permissions:
-      contents: read
-      id-token: write
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - ubuntu-latest
-          - windows-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      -
-        name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
-        with:
-          role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd_login_action
-          aws-region: us-east-1
-      -
-        name: Login to ECR
-        uses: ./
-        with:
-          registry: 175142243308.dkr.ecr.us-east-1.amazonaws.com
 
   ecr-public:
     runs-on: ${{ matrix.os }}
@@ -277,7 +172,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Login to Public ECR
         continue-on-error: ${{ matrix.os == 'windows-latest' }}
@@ -300,10 +195,10 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -315,34 +210,6 @@ jobs:
         with:
           registry: public.ecr.aws
 
-  ecr-public-oidc:
-    permissions:
-      contents: read
-      id-token: write
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - ubuntu-latest
-          - windows-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      -
-        name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
-        with:
-          role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd_login_action
-          aws-region: us-east-1
-      -
-        name: Login to Public ECR
-        continue-on-error: ${{ matrix.os == 'windows-latest' }}
-        uses: ./
-        with:
-          registry: public.ecr.aws
-
   ghcr:
     runs-on: ${{ matrix.os }}
     strategy:
@@ -354,7 +221,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Login to GitHub Container Registry
         uses: ./
@@ -374,7 +241,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Login to GitLab
         uses: ./
@@ -394,12 +261,12 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Login to Google Artifact Registry
         uses: ./
         with:
-          registry: us-east4-docker.pkg.dev
+          registry: ${{ secrets.GAR_LOCATION }}-docker.pkg.dev
           username: _json_key
           password: ${{ secrets.GAR_JSON_KEY }}
 
@@ -414,7 +281,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Login to Google Container Registry
         uses: ./
@@ -428,14 +295,14 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Login to registries
         uses: ./
         with:
           registry-auth: |
-            - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
+            - username: ${{ secrets.DOCKERHUB_USERNAME }}
-              password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
+              password: ${{ secrets.DOCKERHUB_TOKEN }}
             - registry: ghcr.io
               username: ${{ github.actor }}
               password: ${{ secrets.GITHUB_TOKEN }}
@@ -451,7 +318,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Login to registries
         uses: ./
@@ -472,7 +339,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Login to registries
         id: login
@@ -483,8 +350,8 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
           registry-auth: |
-            - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
+            - username: ${{ secrets.DOCKERHUB_USERNAME }}
-              password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
+              password: ${{ secrets.DOCKERHUB_TOKEN }}
       -
         name: Check
         run: |
@@ -504,13 +371,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Login to Docker Hub
         uses: ./
         with:
-          username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
           scope: '@push'
       -
         name: Print config.json files
@@ -534,13 +401,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Login to Docker Hub
         uses: ./
         with:
-          username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
           scope: 'docker/buildx-bin@push'
       -
         name: Print config.json files
@@ -564,7 +431,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Login to GitHub Container Registry
         uses: ./
@@ -595,7 +462,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Login to GitHub Container Registry
         uses: ./

.github/workflows/codeql.yml

@@ -22,7 +22,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Enable corepack
         run: |
@@ -30,17 +30,17 @@ jobs:
           yarn --version
       -
         name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       -
         name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
         with:
           languages: javascript-typescript
           build-mode: none
       -
         name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
         with:
           category: "/language:javascript-typescript"

.github/workflows/pr-assign-author.yml

@@ -11,7 +11,7 @@ on:
 
 jobs:
   run:
-    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@46267a6e61cd56aac2fc79943df180152f4c89d6 # v1.10.1
+    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@9ba6e6f9450baf3b1237f8035c1fdc45932510bd # v1.8.0
     permissions:
       contents: read
       pull-requests: write

.github/workflows/publish.yml

@@ -22,7 +22,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Publish
         uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4

.github/workflows/test.yml

@@ -20,16 +20,16 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Test
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
         with:
           source: .
           targets: test
       -
         name: Upload coverage
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         with:
           files: ./coverage/clover.xml
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/update-dist.yml

@@ -30,14 +30,14 @@ jobs:
           permission-contents: write
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           fetch-depth: 0
           token: ${{ steps.docker-read-app.outputs.token }}
       -
         name: Build
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
         with:
           source: .
           targets: build
@@ -50,7 +50,7 @@ jobs:
               git config user.name "github-actions[bot]"
               git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
               git add dist
-              git commit -m "[dependabot skip] chore: update generated content"
+              git commit -m "chore: update generated content"
               git push
             )
           else

.github/workflows/validate.yml

@@ -22,11 +22,11 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       -
         name: Generate matrix
         id: generate
-        uses: docker/bake-action/subaction/matrix@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        uses: docker/bake-action/subaction/matrix@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
         with:
           target: validate
 
@@ -41,6 +41,6 @@ jobs:
     steps:
       -
         name: Validate
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
         with:
           targets: ${{ matrix.target }}

.github/workflows/zizmor.yml

@@ -19,7 +19,7 @@ on:
 
 jobs:
   zizmor:
-    uses: crazy-max/.github/.github/workflows/zizmor.yml@46267a6e61cd56aac2fc79943df180152f4c89d6 # v1.10.1
+    uses: crazy-max/.github/.github/workflows/zizmor.yml@9ba6e6f9450baf3b1237f8035c1fdc45932510bd # v1.8.0
     permissions:
       contents: read
       security-events: write

.yarnrc.yml

@@ -1,10 +1,10 @@
 # https://yarnpkg.com/configuration/yarnrc
 
-nodeLinker: node-modules
+compressionLevel: mixed
+enableGlobalCache: false
+enableHardenedMode: true
 
 logFilters:
-  - code: YN0004
-    level: discard
   - code: YN0013
     level: discard
   - code: YN0019
@@ -14,11 +14,4 @@ logFilters:
   - code: YN0086
     level: discard
 
-npmPreapprovedPackages:
+nodeLinker: node-modules
-  - "@docker/actions-toolkit"
-
-compressionLevel: mixed
-enableGlobalCache: false
-enableHardenedMode: true
-enableScripts: false
-npmMinimalAgeGate: 2d

README.md

@@ -28,7 +28,6 @@ ___
   * [Set scopes for the authentication token](#set-scopes-for-the-authentication-token)
 * [Customizing](#customizing)
   * [inputs](#inputs)
-  * [environment variables](#environment-variables)
 * [Contributing](#contributing)
 
 ## Usage
@@ -58,36 +57,6 @@ jobs:
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 ```
 
-You can also [authenticate to Docker Hub with OpenID Connect](https://docs.docker.com/enterprise/security/oidc-connections/)
-when your Docker Hub organization has an OIDC connection configured. The
-workflow must grant the `id-token: write` permission, pass the Docker Hub
-organization name as `username`, omit `password`, and set the OIDC connection
-ID in `DOCKERHUB_OIDC_CONNECTIONID` environment variable.
-
-```yaml
-name: ci
-
-on:
-  push:
-    branches: main
-
-permissions:
-  contents: read
-  id-token: write
-
-jobs:
-  login:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Login to Docker Hub
-        uses: docker/login-action@v4
-        env:
-          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
-        with:
-          username: ${{ vars.DOCKERHUB_ORGANIZATION }}
-```
-
 ### GitHub Container Registry
 
 To authenticate to the [GitHub Container Registry](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry),
@@ -148,8 +117,6 @@ instead of a password.
 
 ### Azure Container Registry (ACR)
 
-#### Service principal
-
 [Create a service principal](https://docs.microsoft.com/en-us/azure/container-registry/container-registry-auth-service-principal#create-a-service-principal)
 with access to your container registry through the [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli)
 and take note of the generated service principal's ID (also called _client ID_)
@@ -175,60 +142,10 @@ jobs:
           password: ${{ secrets.AZURE_CLIENT_SECRET }}
 ```
 
-> [!NOTE]
-> Replace `<registry-name>` with the name of your registry.
-
-#### OpenID Connect (OIDC)
-
-To authenticate with OpenID Connect, configure a federated identity credential
-for GitHub Actions and use the [Azure Login](https://github.com/Azure/login)
-action to sign in to Azure. Then expose an ACR access token and pass it to this
-action as the password.
-
-```yaml
-name: ci
-
-on:
-  push:
-    branches: main
-
-permissions:
-  contents: read
-  id-token: write
-
-jobs:
-  login:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Login to Azure
-        uses: azure/login@v3
-        with:
-          client-id: ${{ vars.AZURE_CLIENT_ID }}
-          tenant-id: ${{ vars.AZURE_TENANT_ID }}
-          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
-      -
-        name: Get ACR access token
-        id: acr-token
-        run: |
-          ACR_TOKEN=$(az acr login --name <registry-name> --expose-token --output tsv --query accessToken)
-          echo "::add-mask::$ACR_TOKEN" # mask the token in workflow logs
-          echo "token=$ACR_TOKEN" >> "$GITHUB_OUTPUT"
-      -
-        name: Login to ACR
-        uses: docker/login-action@v4
-        with:
-          registry: <registry-name>.azurecr.io
-          username: 00000000-0000-0000-0000-000000000000
-          password: ${{ steps.acr-token.outputs.token }}
-```
-
-> [!NOTE]
 > Replace `<registry-name>` with the name of your registry.
 
 ### Google Container Registry (GCR)
 
-> [!NOTE]
 > [Google Artifact Registry](#google-artifact-registry-gar) is the evolution of
 > Google Container Registry. As a fully-managed service with support for both
 > container images and non-container artifacts. If you currently use Google
@@ -259,7 +176,7 @@ jobs:
     -
       name: Authenticate to Google Cloud
       id: auth
-      uses: google-github-actions/auth@v3
+      uses: google-github-actions/auth@v1
       with:
         token_format: access_token
         workload_identity_provider: <workload_identity_provider>
@@ -273,10 +190,9 @@ jobs:
         password: ${{ steps.auth.outputs.access_token }}
 ```
 
-> [!NOTE]
 > Replace `<workload_identity_provider>` with configured workload identity
 > provider. For steps to configure, [see here](https://github.com/google-github-actions/auth#setting-up-workload-identity-federation).
->
+
 > Replace `<service_account>` with configured service account in workload
 > identity provider which has access to push to GCR
 
@@ -331,7 +247,7 @@ jobs:
       -
         name: Authenticate to Google Cloud
         id: auth
-        uses: google-github-actions/auth@v3
+        uses: google-github-actions/auth@v1
         with:
           token_format: access_token
           workload_identity_provider: <workload_identity_provider>
@@ -345,13 +261,12 @@ jobs:
           password: ${{ steps.auth.outputs.access_token }}
 ```
 
-> [!NOTE]
 > Replace `<workload_identity_provider>` with configured workload identity
 > provider
->
+
 > Replace `<service_account>` with configured service account in workload
 > identity provider which has access to push to GCR
->
+
 > Replace `<location>` with the regional or multi-regional [location](https://cloud.google.com/artifact-registry/docs/repo-organize#locations)
 > of the repository where the image is stored.
 
@@ -383,7 +298,6 @@ jobs:
           password: ${{ secrets.GAR_JSON_KEY }}
 ```
 
-> [!NOTE]
 > Replace `<location>` with the regional or multi-regional [location](https://cloud.google.com/artifact-registry/docs/repo-organize#locations)
 > of the repository where the image is stored.
 
@@ -438,7 +352,6 @@ jobs:
           AWS_ACCOUNT_IDS: 012345678910,023456789012
 ```
 
-> [!NOTE]
 > Only available with [AWS CLI version 1](https://docs.aws.amazon.com/cli/latest/reference/ecr/get-login.html)
 
 You can also use the [Configure AWS Credentials](https://github.com/aws-actions/configure-aws-credentials)
@@ -457,7 +370,7 @@ jobs:
     steps:
       -
         name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-access-key-id: ${{ vars.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -469,7 +382,6 @@ jobs:
           registry: <aws-account-number>.dkr.ecr.<region>.amazonaws.com
 ```
 
-> [!NOTE]
 > Replace `<aws-account-number>` and `<region>` with their respective values.
 
 ### AWS Public Elastic Container Registry (ECR)
@@ -501,7 +413,6 @@ jobs:
           AWS_REGION: <region>
 ```
 
-> [!NOTE]
 > Replace `<region>` with its respective value (default `us-east-1`).
 
 ### OCI Oracle Cloud Infrastructure Registry (OCIR)
@@ -534,7 +445,6 @@ jobs:
           password: ${{ secrets.OCI_TOKEN }}
 ```
 
-> [!NOTE]
 > Replace `<region>` with their respective values from [availability regions](https://docs.cloud.oracle.com/iaas/Content/Registry/Concepts/registryprerequisites.htm#Availab)
 
 ### Quay.io
@@ -648,38 +558,6 @@ jobs:
               password: ${{ secrets.GITHUB_TOKEN }}
 ```
 
-Docker Hub OIDC can also be used with `registry-auth`. Grant `id-token: write`,
-set `DOCKERHUB_OIDC_CONNECTIONID`, pass the Docker Hub organization name as
-`username`, and omit `password` for the Docker Hub object:
-
-```yaml
-name: ci
-
-on:
-  push:
-    branches: main
-
-permissions:
-  contents: read
-  id-token: write
-
-jobs:
-  login:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Login to registries
-        uses: docker/login-action@v4
-        env:
-          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
-        with:
-          registry-auth: |
-            - username: ${{ vars.DOCKERHUB_ORGANIZATION }}
-            - registry: ghcr.io
-              username: ${{ github.actor }}
-              password: ${{ secrets.GITHUB_TOKEN }}
-```
-
 ### Set scopes for the authentication token
 
 The `scope` input allows limiting registry credentials to a specific repository
@@ -725,7 +603,7 @@ jobs:
           scope: 'myorg/myimage@push'
       -
         name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
         with:
           push: true
           tags: myorg/myimage:latest
@@ -753,15 +631,6 @@ The following inputs can be used as `step.with` keys:
 > [!NOTE]
 > The `registry-auth` input cannot be used with other inputs except `logout`.
 
-### environment variables
-
-The following environment variables can be set as `step.env` keys:
-
-| Name                          | Type   | Default | Description                                                                 |
-|-------------------------------|--------|---------|-----------------------------------------------------------------------------|
-| `DOCKERHUB_OIDC_CONNECTIONID` | String |         | Docker Hub OIDC connection ID. Required for Docker Hub OIDC login           |
-| `DOCKERHUB_OIDC_EXPIREIN`     | Number | `300`   | Docker Hub OIDC token lifetime in seconds. Must be between `300` and `3600` |
-
 ## Contributing
 
 Want to contribute? Awesome! You can find information about contributing to

__tests__/context.test.ts

@@ -1,4 +1,4 @@
-import {afterEach, expect, test, vi} from 'vitest';
+import {afterEach, expect, test} from 'vitest';
 import * as path from 'path';
 
 import {Buildx} from '@docker/actions-toolkit/lib/buildx/buildx.js';
@@ -6,7 +6,6 @@ import {Buildx} from '@docker/actions-toolkit/lib/buildx/buildx.js';
 import {getAuthList, getInputs} from '../src/context.js';
 
 afterEach(() => {
-  vi.restoreAllMocks();
   for (const key of Object.keys(process.env)) {
     if (key.startsWith('INPUT_')) {
       delete process.env[key];
@@ -34,137 +33,3 @@ test('getAuthList uses the default Docker Hub registry when computing scoped con
     configDir: path.join(Buildx.configDir, 'config', 'registry-1.docker.io', 'myscope')
   });
 });
-
-test('getAuthList supports @ scopes appended to the registry config dir', async () => {
-  process.env['INPUT_USERNAME'] = 'dbowie';
-  process.env['INPUT_PASSWORD'] = 'groundcontrol';
-  process.env['INPUT_SCOPE'] = '@push';
-  process.env['INPUT_LOGOUT'] = 'false';
-  const [auth] = getAuthList(getInputs());
-  expect(auth).toMatchObject({
-    configDir: path.join(Buildx.configDir, 'config', 'registry-1.docker.io') + '@push'
-  });
-});
-
-test('getAuthList supports repository scopes with appended actions', async () => {
-  process.env['INPUT_USERNAME'] = 'dbowie';
-  process.env['INPUT_PASSWORD'] = 'groundcontrol';
-  process.env['INPUT_SCOPE'] = 'docker/buildx-bin@push';
-  process.env['INPUT_LOGOUT'] = 'false';
-  const [auth] = getAuthList(getInputs());
-  expect(auth).toMatchObject({
-    configDir: path.join(Buildx.configDir, 'config', 'registry-1.docker.io', 'docker', 'buildx-bin@push')
-  });
-});
-
-test('getAuthList supports comma-separated scope actions', async () => {
-  process.env['INPUT_USERNAME'] = 'dbowie';
-  process.env['INPUT_PASSWORD'] = 'groundcontrol';
-  process.env['INPUT_SCOPE'] = 'docker/buildx-bin@pull,push';
-  process.env['INPUT_LOGOUT'] = 'false';
-  const [auth] = getAuthList(getInputs());
-  expect(auth).toMatchObject({
-    configDir: path.join(Buildx.configDir, 'config', 'registry-1.docker.io', 'docker', 'buildx-bin@pull,push')
-  });
-});
-
-// prettier-ignore
-test.each([
-  '../../../../work/leaked',
-  '..',
-  'foo/../../../../etc',
-  '@../../../leaked',
-  'foo/bar@../../../leaked',
-  '@push@pull',
-  'foo/bar@push@pull',
-  '@push,',
-  '@,push',
-  '@pull,,push',
-  '@Push',
-  path.join(path.parse(Buildx.configDir).root, 'work', 'leaked')
-])('getAuthList rejects unsafe or unsupported scope path: %s', async scope => {
-  expect(() => {
-    getAuthList({
-      registry: '',
-      username: 'dbowie',
-      password: 'groundcontrol',
-      scope,
-      ecr: '',
-      logout: false,
-      registryAuth: ''
-    });
-  }).toThrow(/Invalid scope/);
-});
-
-// prettier-ignore
-test.each([
-  '../../../../work/leaked',
-  '..',
-  'foo/../../../../etc',
-  path.join(path.parse(Buildx.configDir).root, 'work', 'leaked')
-])('getAuthList rejects unsafe registry path: %s', async registry => {
-  expect(() => {
-    getAuthList({
-      registry,
-      username: 'dbowie',
-      password: 'groundcontrol',
-      scope: '@push',
-      ecr: '',
-      logout: false,
-      registryAuth: ''
-    });
-  }).toThrow(/Invalid registry/);
-});
-
-test('getAuthList skips secret masking when registry-auth password is absent', async () => {
-  const stdoutWriteSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
-  const [auth] = getAuthList({
-    registry: '',
-    username: '',
-    password: '',
-    scope: '',
-    ecr: '',
-    logout: true,
-    registryAuth: '- registry: public.ecr.aws\n'
-  });
-
-  expect(stdoutWriteSpy.mock.calls.map(call => call[0]).join('')).not.toContain('::add-mask::');
-  expect(auth).toMatchObject({
-    registry: 'public.ecr.aws',
-    ecr: 'auto'
-  });
-});
-
-test('getAuthList supports password-less Docker Hub registry-auth for OIDC', async () => {
-  const [auth] = getAuthList({
-    registry: '',
-    username: '',
-    password: '',
-    scope: '',
-    ecr: '',
-    logout: true,
-    registryAuth: '- username: docker-org\n'
-  });
-
-  expect(auth).toMatchObject({
-    registry: 'docker.io',
-    username: 'docker-org',
-    password: undefined,
-    ecr: 'auto'
-  });
-});
-
-test('getAuthList masks registry-auth password when present', async () => {
-  const stdoutWriteSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
-  getAuthList({
-    registry: '',
-    username: '',
-    password: '',
-    scope: '',
-    ecr: '',
-    logout: true,
-    registryAuth: '- registry: ghcr.io\n  username: dbowie\n  password: groundcontrol\n'
-  });
-
-  expect(stdoutWriteSpy.mock.calls.map(call => call[0]).join('')).toContain('::add-mask::groundcontrol');
-});

__tests__/docker.test.ts

@@ -1,14 +1,8 @@
-import {afterEach, expect, test, vi} from 'vitest';
+import {expect, test, vi} from 'vitest';
 
 import {Docker} from '@docker/actions-toolkit/lib/docker/docker.js';
 
-import {login, loginStandard, logout} from '../src/docker.js';
+import {loginStandard, logout} from '../src/docker.js';
-import * as dockerhub from '../src/dockerhub.js';
-
-afterEach(() => {
-  vi.restoreAllMocks();
-  delete process.env.DOCKERHUB_OIDC_CONNECTIONID;
-});
 
 test('loginStandard calls exec', async () => {
   const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
@@ -38,37 +32,6 @@ test('loginStandard calls exec', async () => {
   });
 });
 
-test('login exchanges Docker Hub OIDC token for password-less auth', async () => {
-  process.env.DOCKERHUB_OIDC_CONNECTIONID = '123e4567-e89b-42d3-a456-426614174000';
-  const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
-    return {
-      exitCode: 0,
-      stdout: '',
-      stderr: ''
-    };
-  });
-  const oidcSpy = vi.spyOn(dockerhub, 'getOIDCToken').mockResolvedValue({
-    username: 'docker-org',
-    token: 'hub-token'
-  });
-
-  await login({
-    registry: 'docker.io',
-    username: 'docker-org',
-    password: '',
-    scope: '',
-    ecr: 'auto',
-    configDir: ''
-  });
-
-  expect(oidcSpy).toHaveBeenCalledWith('docker.io', 'docker-org');
-  expect(execSpy).toHaveBeenCalledWith(['login', '--password-stdin', '--username', 'docker-org', 'docker.io'], {
-    input: Buffer.from('hub-token'),
-    silent: true,
-    ignoreReturnCode: true
-  });
-});
-
 test('logout calls exec', async () => {
   const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
     return {

__tests__/dockerhub.test.ts

@@ -1,139 +0,0 @@
-import * as core from '@actions/core';
-import * as httpm from '@actions/http-client';
-import {beforeEach, describe, expect, test, vi} from 'vitest';
-
-import * as dockerhub from '../src/dockerhub.js';
-
-vi.mock('@actions/core', () => ({
-  getIDToken: vi.fn(),
-  info: vi.fn(),
-  setSecret: vi.fn()
-}));
-
-const validConnectionID = '123e4567-e89b-42d3-a456-426614174000';
-
-const httpResponse = (statusCode: number, body: string, headers: Record<string, string> = {}): httpm.HttpClientResponse => {
-  return {
-    message: {
-      statusCode,
-      headers
-    },
-    readBody: vi.fn(async () => body)
-  } as unknown as httpm.HttpClientResponse;
-};
-
-describe('isDockerHubOIDC', () => {
-  beforeEach(() => {
-    delete process.env.DOCKERHUB_OIDC_CONNECTIONID;
-  });
-
-  test.each(['', 'docker.io', 'registry-1.docker.io', 'registry-1-stage.docker.io'])('detects Docker Hub registry %p with empty password', registry => {
-    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
-    expect(dockerhub.isDockerHubOIDC(registry, '')).toBe(true);
-  });
-
-  test('requires connection ID env var', () => {
-    expect(dockerhub.isDockerHubOIDC('docker.io', '')).toBe(false);
-  });
-
-  test('requires empty password', () => {
-    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
-    expect(dockerhub.isDockerHubOIDC('docker.io', 'groundcontrol')).toBe(false);
-  });
-
-  test('ignores non-Docker Hub registries', () => {
-    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
-    expect(dockerhub.isDockerHubOIDC('ghcr.io', '')).toBe(false);
-  });
-});
-
-describe('getOIDCToken', () => {
-  const getIDTokenMock = vi.mocked(core.getIDToken);
-  const setSecretMock = vi.mocked(core.setSecret);
-  let postSpy: ReturnType<typeof vi.spyOn>;
-
-  beforeEach(() => {
-    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
-    delete process.env.DOCKERHUB_OIDC_EXPIREIN;
-    getIDTokenMock.mockResolvedValue('github-id-token');
-    postSpy = vi.spyOn(httpm.HttpClient.prototype, 'post').mockResolvedValue(httpResponse(200, JSON.stringify({access_token: 'hub-token'})));
-  });
-
-  test('exchanges GitHub OIDC token for Docker Hub token', async () => {
-    const credentials = await dockerhub.getOIDCToken('docker.io', 'dbowie');
-
-    expect(credentials).toEqual({
-      username: 'dbowie',
-      token: 'hub-token'
-    });
-    expect(getIDTokenMock).toHaveBeenCalledWith('https://identity.docker.com');
-    expect(postSpy).toHaveBeenCalledTimes(1);
-    expect(postSpy.mock.calls[0][0]).toBe('https://identity.docker.com/oauth/token');
-
-    const http = postSpy.mock.contexts[0] as httpm.HttpClient;
-    expect(http.userAgent).toBe('github.com/docker/login-action');
-    expect(http.requestOptions?.headers).toEqual({
-      'Content-Type': 'application/x-www-form-urlencoded'
-    });
-
-    const body = new URLSearchParams(postSpy.mock.calls[0][1]);
-    expect(body.get('grant_type')).toBe('urn:ietf:params:oauth:grant-type:token-exchange');
-    expect(body.get('subject_token_type')).toBe('urn:ietf:params:oauth:token-type:id_token');
-    expect(body.get('subject_token')).toBe('github-id-token');
-    expect(body.get('connection_id')).toBe(validConnectionID);
-    expect(body.get('expires_in')).toBe('300');
-    expect(setSecretMock).toHaveBeenCalledWith('hub-token');
-  });
-
-  test('uses custom token expiration', async () => {
-    process.env.DOCKERHUB_OIDC_EXPIREIN = '900';
-    await dockerhub.getOIDCToken('docker.io', 'dbowie');
-    const body = new URLSearchParams(postSpy.mock.calls[0][1]);
-    expect(body.get('expires_in')).toBe('900');
-  });
-
-  test('uses stage identity host for stage registry', async () => {
-    await dockerhub.getOIDCToken('registry-1-stage.docker.io', 'dbowie');
-    expect(getIDTokenMock).toHaveBeenCalledWith('https://identity-stage.docker.com');
-    expect(postSpy.mock.calls[0][0]).toBe('https://identity-stage.docker.com/oauth/token');
-  });
-
-  test('requires connection ID env var', async () => {
-    delete process.env.DOCKERHUB_OIDC_CONNECTIONID;
-    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('DOCKERHUB_OIDC_CONNECTIONID is required for Docker Hub OIDC login');
-    expect(getIDTokenMock).not.toHaveBeenCalled();
-    expect(postSpy).not.toHaveBeenCalled();
-  });
-
-  test('validates connection ID', async () => {
-    process.env.DOCKERHUB_OIDC_CONNECTIONID = 'not-a-uuid';
-    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('Invalid DOCKERHUB_OIDC_CONNECTIONID. Must be a valid UUID.');
-    expect(getIDTokenMock).not.toHaveBeenCalled();
-    expect(postSpy).not.toHaveBeenCalled();
-  });
-
-  test.each(['not-a-number', '299', '3601'])('validates token expiration %p', async expiresIn => {
-    process.env.DOCKERHUB_OIDC_EXPIREIN = expiresIn;
-    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow(`Invalid DOCKERHUB_OIDC_EXPIREIN: ${expiresIn}. Must be between 300 and 3600`);
-    expect(getIDTokenMock).not.toHaveBeenCalled();
-    expect(postSpy).not.toHaveBeenCalled();
-  });
-
-  test('retries rate limited token requests with Retry-After', async () => {
-    postSpy.mockResolvedValueOnce(httpResponse(429, '', {'retry-after': '0'})).mockResolvedValueOnce(httpResponse(200, JSON.stringify({access_token: 'hub-token'})));
-    await dockerhub.getOIDCToken('docker.io', 'dbowie');
-    expect(postSpy).toHaveBeenCalledTimes(2);
-    expect(core.info).toHaveBeenCalledWith('Docker Hub OIDC token request rate limited, retrying in 0ms (attempt 1/5)');
-  });
-
-  test('throws Docker Hub OIDC error responses', async () => {
-    postSpy.mockResolvedValue(httpResponse(400, JSON.stringify({error: 'invalid_request', error_description: 'bad connection', error_uri: 'https://docs.docker.com'})));
-    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('Docker Hub API: bad status code 400: {"error":"invalid_request","error_description":"bad connection","error_uri":"https://docs.docker.com"}');
-  });
-
-  test('throws rate limited Docker Hub OIDC error response after retries', async () => {
-    postSpy.mockResolvedValue(httpResponse(429, JSON.stringify({error: 'rate_limited', error_description: 'slow down'}), {'retry-after': '0'}));
-    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('Docker Hub API: bad status code 429: {"error":"rate_limited","error_description":"slow down"}');
-    expect(postSpy).toHaveBeenCalledTimes(6);
-  });
-});

dev.Dockerfile

@@ -17,7 +17,7 @@ FROM base AS deps
 RUN --mount=type=bind,target=.,rw \
   --mount=type=cache,target=/src/.yarn/cache \
   --mount=type=cache,target=/src/node_modules \
-  yarn install --immutable && mkdir /vendor && cp yarn.lock /vendor
+  yarn install && mkdir /vendor && cp yarn.lock /vendor
 
 FROM scratch AS vendor-update
 COPY --from=deps /vendor /

package.json

@@ -4,7 +4,7 @@
   "type": "module",
   "main": "src/main.ts",
   "scripts": {
-    "build": "esbuild src/main.ts --bundle --platform=node --target=node24 --format=cjs --outfile=dist/index.cjs --sourcemap --minify --keep-names && yarn run license",
+    "build": "esbuild src/main.ts --bundle --platform=node --target=node24 --format=cjs --outfile=dist/index.cjs --sourcemap --minify && yarn run license",
     "lint": "eslint --max-warnings=0 .",
     "format": "eslint --fix .",
     "test": "vitest run",
@@ -21,17 +21,15 @@
   ],
   "author": "Docker Inc.",
   "license": "Apache-2.0",
-  "packageManager": "yarn@4.15.0",
+  "packageManager": "yarn@4.9.2",
   "dependencies": {
     "@actions/core": "^3.0.1",
-    "@actions/http-client": "^4.0.1",
+    "@aws-sdk/client-ecr": "^3.1050.0",
-    "@aws-sdk/client-ecr": "^3.1095.0",
+    "@aws-sdk/client-ecr-public": "^3.1050.0",
-    "@aws-sdk/client-ecr-public": "^3.1095.0",
+    "@docker/actions-toolkit": "^0.90.0",
-    "@docker/actions-toolkit": "^0.94.0",
+    "http-proxy-agent": "^9.0.0",
-    "http-proxy-agent": "^9.1.0",
+    "https-proxy-agent": "^9.0.0",
-    "https-proxy-agent": "^9.1.0",
+    "js-yaml": "^4.1.1"
-    "js-yaml": "^5.2.2",
-    "uuid": "^14.0.1"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.3",

src/context.ts

@@ -53,9 +53,7 @@ export function getAuthList(inputs: Inputs): Array<Auth> {
     });
   } else {
     auths = (yaml.load(inputs.registryAuth) as Array<Auth>).map(auth => {
-      if (auth.password) {
       core.setSecret(auth.password); // redacted in workflow logs
-      }
       const registry = auth.registry || 'docker.io';
       return {
         registry,
@@ -77,33 +75,13 @@ export function scopeToConfigDir(registry: string, scope?: string): string {
   if (scopeDisabled() || !scope || scope === '') {
     return '';
   }
-  const configRoot = path.resolve(Buildx.configDir, 'config');
+  let configDir = path.join(Buildx.configDir, 'config', registry === 'docker.io' ? 'registry-1.docker.io' : registry);
-  const registryDir = path.resolve(configRoot, registry === 'docker.io' ? 'registry-1.docker.io' : registry);
+  if (scope.startsWith('@')) {
-  if (!isChildPath(configRoot, registryDir)) {
+    configDir += scope;
-    throw new Error(`Invalid registry '${registry}': resolved config path escapes the Buildx config directory`);
+  } else {
+    configDir = path.join(configDir, scope);
   }
-  const scopeParts = scope.split('@');
+  return configDir;
-  if (scopeParts.length > 2) {
-    throw new Error(`Invalid scope '${scope}': scope can contain at most one @ separator`);
-  }
-  const [scopePath, scopeActions] = scopeParts;
-  if (scopeActions !== undefined && !/^[a-z]+(,[a-z]+)*$/.test(scopeActions)) {
-    throw new Error(`Invalid scope '${scope}': scope actions must be lowercase names separated by commas`);
-  }
-  const scopeSuffix = scopeActions === undefined ? '' : `@${scopeActions}`;
-  if (scopePath === '') {
-    return `${registryDir}${scopeSuffix}`;
-  }
-  const configDir = path.resolve(registryDir, scopePath);
-  if (!isChildPath(registryDir, configDir)) {
-    throw new Error(`Invalid scope '${scope}': resolved config path escapes the Buildx config directory`);
-  }
-  return `${configDir}${scopeSuffix}`;
-}
-
-function isChildPath(parent: string, child: string): boolean {
-  const relativePath = path.relative(parent, child);
-  return relativePath !== '' && relativePath !== '..' && !relativePath.startsWith(`..${path.sep}`) && !path.isAbsolute(relativePath);
 }
 
 function scopeDisabled(): boolean {

src/docker.ts

@@ -4,20 +4,12 @@ import {Docker} from '@docker/actions-toolkit/lib/docker/docker.js';
 
 import * as aws from './aws.js';
 import * as context from './context.js';
-import * as dockerhub from './dockerhub.js';
 
 export async function login(auth: context.Auth): Promise<void> {
   if (/true/i.test(auth.ecr) || (auth.ecr == 'auto' && aws.isECR(auth.registry))) {
     await loginECR(auth.registry, auth.username, auth.password, auth.scope);
   } else {
-    let username = auth.username;
+    await loginStandard(auth.registry, auth.username, auth.password, auth.scope);
-    let password = auth.password;
-    if (dockerhub.isDockerHubOIDC(auth.registry, password)) {
-      const credentials = await dockerhub.getOIDCToken(auth.registry, username);
-      username = credentials.username;
-      password = credentials.token;
-    }
-    await loginStandard(auth.registry, username, password, auth.scope);
   }
 }
 

src/dockerhub.ts

@@ -1,126 +0,0 @@
-import * as core from '@actions/core';
-import * as httpm from '@actions/http-client';
-import {HttpCodes} from '@actions/http-client';
-import {validate as uuidValidate} from 'uuid';
-
-export interface LoginCredentials {
-  username: string;
-  token: string;
-}
-
-interface OIDCTokenResponse {
-  access_token: string;
-}
-
-const registries = new Set(['', 'docker.io', 'registry-1.docker.io', 'registry-1-stage.docker.io', 'dhi.io']);
-const defaultExpiresIn = 300;
-const minExpiresIn = 300;
-const maxExpiresIn = 3600;
-const maxRetries = 5;
-
-export const isDockerHubOIDC = (registry: string, password: string): boolean => {
-  return process.env.DOCKERHUB_OIDC_CONNECTIONID !== undefined && !password && registries.has(registry);
-};
-
-export const getOIDCToken = async (registry: string, username: string): Promise<LoginCredentials> => {
-  const connectionID = process.env.DOCKERHUB_OIDC_CONNECTIONID?.trim();
-  if (!connectionID) {
-    throw new Error('DOCKERHUB_OIDC_CONNECTIONID is required for Docker Hub OIDC login');
-  }
-
-  if (!uuidValidate(connectionID)) {
-    throw new Error('Invalid DOCKERHUB_OIDC_CONNECTIONID. Must be a valid UUID.');
-  }
-
-  const expiresIn = getExpiresIn();
-  const identityHost = registry === 'registry-1-stage.docker.io' ? 'identity-stage.docker.com' : 'identity.docker.com';
-  const audience = `https://${identityHost}`;
-  const idToken = await core.getIDToken(audience);
-  const http: httpm.HttpClient = new httpm.HttpClient('github.com/docker/login-action', [], {
-    headers: {
-      'Content-Type': 'application/x-www-form-urlencoded'
-    }
-  });
-
-  const data = new URLSearchParams();
-  data.set('grant_type', 'urn:ietf:params:oauth:grant-type:token-exchange');
-  data.set('subject_token_type', 'urn:ietf:params:oauth:token-type:id_token');
-  data.set('subject_token', idToken);
-  data.set('connection_id', connectionID);
-  data.set('expires_in', expiresIn.toString());
-
-  const resp = await postWithRetry(http, `https://${identityHost}/oauth/token`, data.toString());
-
-  const tokenResp = <OIDCTokenResponse>JSON.parse(await handleResponse(resp));
-  core.setSecret(tokenResp.access_token);
-
-  return {
-    username,
-    token: tokenResp.access_token
-  };
-};
-
-const getExpiresIn = (): number => {
-  const expiresInInput = process.env.DOCKERHUB_OIDC_EXPIREIN?.trim() || defaultExpiresIn.toString();
-  const expiresIn = Number(expiresInInput);
-  if (isNaN(expiresIn) || expiresIn < minExpiresIn || expiresIn > maxExpiresIn) {
-    throw new Error(`Invalid DOCKERHUB_OIDC_EXPIREIN: ${expiresInInput}. Must be between ${minExpiresIn} and ${maxExpiresIn}`);
-  }
-  return expiresIn;
-};
-
-const postWithRetry = async (http: httpm.HttpClient, url: string, data: string): Promise<httpm.HttpClientResponse> => {
-  let resp = await http.post(url, data);
-  for (let attempt = 0; (resp.message.statusCode || HttpCodes.InternalServerError) === HttpCodes.TooManyRequests && attempt < maxRetries; attempt++) {
-    const delay = parseRetryAfter(resp.message.headers['retry-after']);
-    if (delay === null) {
-      break;
-    }
-    await resp.readBody();
-    core.info(`Docker Hub OIDC token request rate limited, retrying in ${delay}ms (attempt ${attempt + 1}/${maxRetries})`);
-    await new Promise(resolve => setTimeout(resolve, delay));
-    resp = await http.post(url, data);
-  }
-  return resp;
-};
-
-const parseRetryAfter = (value: string | string[] | undefined): number | null => {
-  if (value === undefined) {
-    return null;
-  }
-  if (Array.isArray(value)) {
-    value = value[0];
-  }
-  const seconds = Number(value);
-  if (isNaN(seconds)) {
-    return null;
-  }
-  return Math.max(0, seconds * 1000);
-};
-
-const handleResponse = async (resp: httpm.HttpClientResponse): Promise<string> => {
-  const body = await resp.readBody();
-  const statusCode = resp.message.statusCode || HttpCodes.InternalServerError;
-  if (statusCode < HttpCodes.OK || statusCode >= HttpCodes.MultipleChoices) {
-    throw parseError(statusCode, body);
-  }
-  return body;
-};
-
-const parseError = (statusCode: number, body: string): Error => {
-  if (body) {
-    let errResp: unknown;
-    try {
-      errResp = JSON.parse(body);
-    } catch {
-      errResp = undefined;
-    }
-    if (errResp !== undefined) {
-      throw new Error(`Docker Hub API: bad status code ${statusCode}: ${JSON.stringify(errResp)}`);
-    }
-  }
-  if (statusCode === 401) {
-    throw new Error(`Docker Hub API: operation not permitted`);
-  }
-  throw new Error(`Docker Hub API: bad status code ${statusCode}`);
-};