From b04cd7ece0b46f77ceba1ac6d57b8be31a61e8db Mon Sep 17 00:00:00 2001 From: CrazyMax <1951866+crazy-max@users.noreply.github.com> Date: Fri, 22 May 2026 13:32:46 +0200 Subject: [PATCH 1/3] document ACR OIDC login with Azure Login Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com> --- README.md | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) diff --git a/README.md b/README.md index 98d0bfa..00a3a41 100644 --- a/README.md +++ b/README.md @@ -117,6 +117,8 @@ instead of a password. ### Azure Container Registry (ACR) +#### Service principal + [Create a service principal](https://docs.microsoft.com/en-us/azure/container-registry/container-registry-auth-service-principal#create-a-service-principal) with access to your container registry through the [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli) and take note of the generated service principal's ID (also called _client ID_) @@ -144,6 +146,53 @@ jobs: > Replace `` with the name of your registry. +#### OpenID Connect (OIDC) + +To authenticate with OpenID Connect, configure a federated identity credential +for GitHub Actions and use the [Azure Login](https://github.com/Azure/login) +action to sign in to Azure. Then expose an ACR access token and pass it to this +action as the password. + +```yaml +name: ci + +on: + push: + branches: main + +permissions: + contents: read + id-token: write + +jobs: + login: + runs-on: ubuntu-latest + steps: + - + name: Login to Azure + uses: azure/login@v3 + with: + client-id: ${{ vars.AZURE_CLIENT_ID }} + tenant-id: ${{ vars.AZURE_TENANT_ID }} + subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }} + - + name: Get ACR access token + id: acr-token + run: | + ACR_TOKEN=$(az acr login --name --expose-token --output tsv --query accessToken) + echo "::add-mask::$ACR_TOKEN" # mask the token in workflow logs + echo "token=$ACR_TOKEN" >> "$GITHUB_OUTPUT" + - + name: Login to ACR + uses: docker/login-action@v4 + with: + registry: .azurecr.io + username: 00000000-0000-0000-0000-000000000000 + password: ${{ steps.acr-token.outputs.token }} +``` + +> Replace `` with the name of your registry. + ### Google Container Registry (GCR) > [Google Artifact Registry](#google-artifact-registry-gar) is the evolution of From 9720944471b1e56bfcc291a7da8a43bfaaba92d4 Mon Sep 17 00:00:00 2001 From: CrazyMax <1951866+crazy-max@users.noreply.github.com> Date: Fri, 22 May 2026 13:36:09 +0200 Subject: [PATCH 2/3] use GitHub alerts for README notes Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com> --- README.md | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 00a3a41..bc46217 100644 --- a/README.md +++ b/README.md @@ -144,6 +144,7 @@ jobs: password: ${{ secrets.AZURE_CLIENT_SECRET }} ``` +> [!NOTE] > Replace `` with the name of your registry. #### OpenID Connect (OIDC) @@ -191,10 +192,12 @@ jobs: password: ${{ steps.acr-token.outputs.token }} ``` +> [!NOTE] > Replace `` with the name of your registry. ### Google Container Registry (GCR) +> [!NOTE] > [Google Artifact Registry](#google-artifact-registry-gar) is the evolution of > Google Container Registry. As a fully-managed service with support for both > container images and non-container artifacts. If you currently use Google @@ -239,9 +242,10 @@ jobs: password: ${{ steps.auth.outputs.access_token }} ``` +> [!NOTE] > Replace `` with configured workload identity > provider. For steps to configure, [see here](https://github.com/google-github-actions/auth#setting-up-workload-identity-federation). - +> > Replace `` with configured service account in workload > identity provider which has access to push to GCR @@ -310,12 +314,13 @@ jobs: password: ${{ steps.auth.outputs.access_token }} ``` +> [!NOTE] > Replace `` with configured workload identity > provider - +> > Replace `` with configured service account in workload > identity provider which has access to push to GCR - +> > Replace `` with the regional or multi-regional [location](https://cloud.google.com/artifact-registry/docs/repo-organize#locations) > of the repository where the image is stored. @@ -347,6 +352,7 @@ jobs: password: ${{ secrets.GAR_JSON_KEY }} ``` +> [!NOTE] > Replace `` with the regional or multi-regional [location](https://cloud.google.com/artifact-registry/docs/repo-organize#locations) > of the repository where the image is stored. @@ -401,6 +407,7 @@ jobs: AWS_ACCOUNT_IDS: 012345678910,023456789012 ``` +> [!NOTE] > Only available with [AWS CLI version 1](https://docs.aws.amazon.com/cli/latest/reference/ecr/get-login.html) You can also use the [Configure AWS Credentials](https://github.com/aws-actions/configure-aws-credentials) @@ -431,6 +438,7 @@ jobs: registry: .dkr.ecr..amazonaws.com ``` +> [!NOTE] > Replace `` and `` with their respective values. ### AWS Public Elastic Container Registry (ECR) @@ -462,6 +470,7 @@ jobs: AWS_REGION: ``` +> [!NOTE] > Replace `` with its respective value (default `us-east-1`). ### OCI Oracle Cloud Infrastructure Registry (OCIR) @@ -494,6 +503,7 @@ jobs: password: ${{ secrets.OCI_TOKEN }} ``` +> [!NOTE] > Replace `` with their respective values from [availability regions](https://docs.cloud.oracle.com/iaas/Content/Registry/Concepts/registryprerequisites.htm#Availab) ### Quay.io From 401fdfb10a4c434101732e3a60a180de2dcace98 Mon Sep 17 00:00:00 2001 From: CrazyMax <1951866+crazy-max@users.noreply.github.com> Date: Fri, 22 May 2026 13:39:30 +0200 Subject: [PATCH 3/3] update action versions in README examples Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com> --- README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index bc46217..157e8f1 100644 --- a/README.md +++ b/README.md @@ -228,7 +228,7 @@ jobs: - name: Authenticate to Google Cloud id: auth - uses: google-github-actions/auth@v1 + uses: google-github-actions/auth@v3 with: token_format: access_token workload_identity_provider: @@ -300,7 +300,7 @@ jobs: - name: Authenticate to Google Cloud id: auth - uses: google-github-actions/auth@v1 + uses: google-github-actions/auth@v3 with: token_format: access_token workload_identity_provider: @@ -426,7 +426,7 @@ jobs: steps: - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@v4 + uses: aws-actions/configure-aws-credentials@v6 with: aws-access-key-id: ${{ vars.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} @@ -662,7 +662,7 @@ jobs: scope: 'myorg/myimage@push' - name: Build and push - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: push: true tags: myorg/myimage:latest