From 1fc20650218c4d2c86315fa787ebfbc6a35b08e8 Mon Sep 17 00:00:00 2001 From: Zhiwei Liang Date: Fri, 7 Aug 2026 00:17:41 -0400 Subject: [PATCH 1/2] Upgrade GitHub actions and migrate Docker publish workflow auth to OIDC --- .github/workflows/codeql.yml | 2 +- .github/workflows/dependency-review.yml | 4 ++-- .github/workflows/labeler.yml | 2 +- .github/workflows/pull_request.yml | 2 +- .github/workflows/release.yaml | 19 +++++++++++++++---- 5 files changed, 20 insertions(+), 9 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1c2e019..6173076 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -24,7 +24,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Initialize CodeQL uses: github/codeql-action/init@v4 diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 79118fb..d1ffe7b 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -12,8 +12,8 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Checkout repository' - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: 'Dependency Review' - uses: actions/dependency-review-action@v4 + uses: actions/dependency-review-action@v5 with: comment-summary-in-pr: on-failure diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index 14e770b..394ec5d 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -18,7 +18,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Run Labeler uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml index dd46565..62f48ce 100644 --- a/.github/workflows/pull_request.yml +++ b/.github/workflows/pull_request.yml @@ -32,7 +32,7 @@ jobs: ignore-for-release env: GITHUB_TOKEN: ${{ github.token }} - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: actions/setup-go@v7 with: go-version: "stable" diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index eee28ee..add7e6f 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -3,13 +3,18 @@ on: workflow_dispatch: null release: types: [ published ] + +permissions: + contents: read + id-token: write + jobs: oci_publish: name: Build and publish the docker plugin runs-on: ubuntu-latest steps: - name: Clone Repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: setup python 3 uses: actions/setup-python@v7 @@ -17,16 +22,22 @@ jobs: python-version: '3.x' - name: Set up QEMU - uses: docker/setup-qemu-action@v2 + uses: docker/setup-qemu-action@v4 - name: Set up Docker Buildx uses: docker/setup-buildx-action@v4 + - name: OIDC connections + id: docker_oidc + uses: docker/oidc-action@v1 + with: + connection-id: ${{ vars.DOCKER_OIDC_CONNECTION_ID }} + - name: Login to Docker Hub uses: docker/login-action@v4 with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} + username: ${{ vars.DOCKERHUB_ORGANIZATION }} + password: ${{ steps.docker_oidc.outputs.token }} - name: Build and push to DockerHub run: make deploy From 09b8039b4dbefebaf063693fe15fc67a9760510b Mon Sep 17 00:00:00 2001 From: Zhiwei Liang Date: Mon, 10 Aug 2026 15:38:04 -0400 Subject: [PATCH 2/2] Increase OIDC connection expiration time to 1800 seconds --- .github/workflows/release.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index add7e6f..ccb93f1 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -32,6 +32,7 @@ jobs: uses: docker/oidc-action@v1 with: connection-id: ${{ vars.DOCKER_OIDC_CONNECTION_ID }} + expires-in: 1800 - name: Login to Docker Hub uses: docker/login-action@v4