Skip to content

authentication token scopes support #73

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
crazy-max wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

authentication token scopes support #73

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
84 changes: 84 additions & 0 deletions .github/workflows/.test-bake.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,6 +179,55 @@ jobs:
const builderOutputs = JSON.parse(core.getInput('builder-outputs'));
core.info(JSON.stringify(builderOutputs, null, 2));

bake-dockerhub-stage:
uses: ./.github/workflows/bake.yml
permissions:
contents: read
id-token: write
with:
context: test
output: image
push: ${{ github.event_name != 'pull_request' }}
sbom: true
target: hello-cross
meta-images: |
registry-1-stage.docker.io/docker/github-builder-test
meta-tags: |
type=raw,value=bake-ghbuilder-${{ github.run_id }}
secrets:
registry-auths: |
- registry: registry-1-stage.docker.io
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}

bake-dockerhub-stage-verify:
uses: ./.github/workflows/verify.yml
if: ${{ github.event_name != 'pull_request' }}
needs:
- bake-dockerhub-stage
with:
builder-outputs: ${{ toJSON(needs.bake-dockerhub-stage.outputs) }}
secrets:
registry-auths: |
- registry: registry-1-stage.docker.io
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}

bake-dockerhub-stage-outputs:
runs-on: ubuntu-24.04
needs:
- bake-dockerhub-stage
steps:
-
name: Builder outputs
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
env:
INPUT_BUILDER-OUTPUTS: ${{ toJSON(needs.bake-dockerhub-stage.outputs) }}
with:
script: |
const builderOutputs = JSON.parse(core.getInput('builder-outputs'));
core.info(JSON.stringify(builderOutputs, null, 2));

bake-ghcr-and-aws:
uses: ./.github/workflows/bake.yml
permissions:
Expand Down Expand Up @@ -395,3 +444,38 @@ jobs:
public.ecr.aws/q3b5f1u4/test-docker-action
meta-tags: |
type=raw,value=bake-ghbuilder-${{ github.run_id }}

bake-auth-scope:
uses: ./.github/workflows/bake.yml
permissions:
contents: read
id-token: write
with:
context: test
output: image
push: ${{ github.event_name != 'pull_request' }}
sbom: true
target: hello-cross
meta-images: |
registry-1-stage.docker.io/docker/github-builder-test
meta-tags: |
type=raw,value=bake-ghbuilder-scope-${{ github.run_id }}
secrets:
registry-auths: |
- registry: registry-1-stage.docker.io
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
scope: '@push'

bake-auth-scope-verify:
uses: ./.github/workflows/verify.yml
if: ${{ github.event_name != 'pull_request' }}
needs:
- bake-auth-scope
with:
builder-outputs: ${{ toJSON(needs.bake-auth-scope.outputs) }}
secrets:
registry-auths: |
- registry: registry-1-stage.docker.io
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
34 changes: 34 additions & 0 deletions .github/workflows/.test-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -490,3 +490,37 @@ jobs:
meta-images: ghcr.io/docker/github-builder-test
meta-tags: |
type=raw,value=build-${{ github.run_id }}

build-auth-scope:
uses: ./.github/workflows/build.yml
permissions:
contents: read
id-token: write
with:
file: test/hello.Dockerfile
output: image
platforms: linux/amd64,linux/arm64
push: ${{ github.event_name != 'pull_request' }}
sbom: true
meta-images: registry-1-stage.docker.io/docker/github-builder-test
meta-tags: |
type=raw,value=build-scope-${{ github.run_id }}
secrets:
registry-auths: |
- registry: registry-1-stage.docker.io
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
scope: '@push'

build-auth-scope-verify:
uses: ./.github/workflows/verify.yml
if: ${{ github.event_name != 'pull_request' }}
needs:
- build-auth-scope
with:
builder-outputs: ${{ toJSON(needs.build-auth-scope.outputs) }}
secrets:
registry-auths: |
- registry: registry-1-stage.docker.io
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
18 changes: 13 additions & 5 deletions .github/workflows/bake.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,7 +137,7 @@ on:
value: ${{ jobs.finalize.outputs.signed }}

env:
BUILDX_VERSION: "v0.30.1"
BUILDX_VERSION: "https://github.com/docker/buildx.git#8037f199dbf353dd0bc51b6d4f4cec64544dbcdd" # TODO: pin to a specific version when scope feature is available
BUILDKIT_IMAGE: "moby/buildkit:master@sha256:bdefeba47634c596286beabe68219708ed364c4f1a5e4e9a2e160274712a0e89" # TODO: pin to a specific version when signed gha cache feature is available
DOCKER_ACTIONS_TOOLKIT_MODULE: "@docker/[email protected]"
COSIGN_VERSION: "v3.0.2"
Expand Down Expand Up @@ -358,7 +358,6 @@ jobs:
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
with:
version: ${{ env.BUILDX_VERSION }}
cache-binary: false
buildkitd-flags: --debug
driver-opts: |
image=${{ env.BUILDKIT_IMAGE }}
Expand Down Expand Up @@ -603,7 +602,7 @@ jobs:
-
name: Login to registry
if: ${{ inputs.push && inputs.output == 'image' }}
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
with:
registry-auth: ${{ secrets.registry-auths }}
-
Expand Down Expand Up @@ -634,6 +633,14 @@ jobs:
const imageDigest = inpMetadata[inpTarget]['containerimage.digest'];
core.info(imageDigest);
core.setOutput('digest', imageDigest);
-
name: Login to registry for signing
if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' }}
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
with:
registry-auth: ${{ secrets.registry-auths }}
env:
DOCKER_LOGIN_SCOPE_DISABLED: true # make sure the scope feature is disabled to avoid interfering with cosign OIDC login
Comment on lines +636 to +643
Copy link
Member Author

@crazy-max crazy-max Jan 8, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tonistiigi Needs extra login without scope after build so cosign can use auth from vanilla docker config when signing attestation manifests, otherwise it fails with: https://github.com/docker/github-builder-experimental/actions/runs/20814314320/job/59786046485#step:12:96

Error: Signing BuildKit attestation manifests failed: Cosign sign command failed with errors:
- [UNAUTHORIZED] authentication required : [object Object],[object Object]

Fyi cosign is using google/go-containerregistry to get auth: https://github.com/google/go-containerregistry/blob/e075f209120b2467fd1b7d24727f1890a0edb74a/pkg/authn/keychain.go#L87

-
name: Signing attestation manifests
id: signing-attestation-manifests
Expand Down Expand Up @@ -784,9 +791,11 @@ jobs:
-
name: Login to registry
if: ${{ inputs.push && inputs.output == 'image' }}
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
with:
registry-auth: ${{ secrets.registry-auths }}
env:
DOCKER_LOGIN_SCOPE_DISABLED: true # FIXME: scope feature is not yet supported by Buildx imagetools command
-
name: Set up Docker Buildx
if: ${{ inputs.push && inputs.output == 'image' }}
Expand All @@ -795,7 +804,6 @@ jobs:
version: ${{ env.BUILDX_VERSION }}
buildkitd-flags: --debug
driver-opts: image=${{ env.BUILDKIT_IMAGE }}
cache-binary: false
-
name: Create manifest
if: ${{ inputs.output == 'image' }}
Expand Down
18 changes: 13 additions & 5 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,7 +144,7 @@ on:
value: ${{ jobs.finalize.outputs.signed }}

env:
BUILDX_VERSION: "v0.30.1"
BUILDX_VERSION: "https://github.com/docker/buildx.git#8037f199dbf353dd0bc51b6d4f4cec64544dbcdd" # TODO: pin to a specific version when scope feature is available
BUILDKIT_IMAGE: "moby/buildkit:master@sha256:bdefeba47634c596286beabe68219708ed364c4f1a5e4e9a2e160274712a0e89" # TODO: pin to a specific version when signed gha cache feature is available
DOCKER_ACTIONS_TOOLKIT_MODULE: "@docker/[email protected]"
COSIGN_VERSION: "v3.0.2"
Expand Down Expand Up @@ -319,7 +319,6 @@ jobs:
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
with:
version: ${{ env.BUILDX_VERSION }}
cache-binary: false
buildkitd-flags: --debug
driver-opts: |
image=${{ env.BUILDKIT_IMAGE }}
Expand Down Expand Up @@ -512,7 +511,7 @@ jobs:
-
name: Login to registry
if: ${{ inputs.push && inputs.output == 'image' }}
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
with:
registry-auth: ${{ secrets.registry-auths }}
-
Expand All @@ -538,6 +537,14 @@ jobs:
env:
BUILDKIT_MULTI_PLATFORM: 1
GIT_AUTH_TOKEN: ${{ secrets.github-token || github.token }}
-
name: Login to registry for signing
if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' }}
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
with:
registry-auth: ${{ secrets.registry-auths }}
env:
DOCKER_LOGIN_SCOPE_DISABLED: true # make sure the scope feature is disabled to avoid interfering with cosign OIDC login
-
name: Signing attestation manifests
id: signing-attestation-manifests
Expand Down Expand Up @@ -687,9 +694,11 @@ jobs:
-
name: Login to registry
if: ${{ inputs.push && inputs.output == 'image' }}
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
uses: docker/login-action@scope # TODO: pin to a specific version when scope feature is supported
with:
registry-auth: ${{ secrets.registry-auths }}
env:
DOCKER_LOGIN_SCOPE_DISABLED: true # FIXME: scope feature is not yet supported by Buildx imagetools command
-
name: Set up Docker Buildx
if: ${{ inputs.push && inputs.output == 'image' }}
Expand All @@ -698,7 +707,6 @@ jobs:
version: ${{ env.BUILDX_VERSION }}
buildkitd-flags: --debug
driver-opts: image=${{ env.BUILDKIT_IMAGE }}
cache-binary: false
-
name: Create manifest
if: ${{ inputs.output == 'image' }}
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/verify.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,8 @@ jobs:
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
with:
registry-auth: ${{ secrets.registry-auths }}
env:
DOCKER_LOGIN_SCOPE_DISABLED: true # make sure the scope feature is disabled to avoid interfering with cosign OIDC login
-
name: Download artifacts
if: ${{ steps.vars.outputs.signed == 'true' && steps.vars.outputs.output-type == 'local' }}
Expand Down
Loading