Skip to content

Commit fbd06a4

Browse files
crazy-maxcrazy-max
committed
build/bake: support registry identities
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
1 parent 950f1dd commit fbd06a4

3 files changed

Lines changed: 163 additions & 6 deletions

File tree

‎.github/workflows/bake.yml‎

Lines changed: 60 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,10 @@ on:
9191
type: string
9292
description: "Variables to set in the Bake definition as list of key-value pair"
9393
required: false
94+
registry-identities:
95+
type: string
96+
description: "Keyless registry identity configuration as YAML objects"
97+
required: false
9498
# docker/metadata-action
9599
set-meta-annotations:
96100
type: boolean
@@ -179,8 +183,15 @@ env:
179183
NPM_CONFIG_FETCH_RETRIES: "5"
180184

181185
jobs:
186+
setup-registry-identities:
187+
uses: ./.github/workflows/setup-registry-identities.yml
188+
with:
189+
registry-identities: ${{ inputs.registry-identities }}
190+
182191
prepare:
183192
runs-on: ubuntu-24.04
193+
needs:
194+
- setup-registry-identities
184195
outputs:
185196
includes: ${{ steps.set.outputs.includes }}
186197
metaImages: ${{ steps.set.outputs.metaImages }}
@@ -571,6 +582,7 @@ jobs:
571582
build:
572583
runs-on: ${{ matrix.runner }}
573584
needs:
585+
- setup-registry-identities
574586
- prepare
575587
strategy:
576588
fail-fast: ${{ inputs.fail-fast }}
@@ -953,9 +965,31 @@ jobs:
953965
core.info(JSON.stringify(bakeOverrides, null, 2));
954966
core.setOutput('overrides', bakeOverrides.join(os.EOL));
955967
});
968+
-
969+
name: Check registry auths
970+
id: registry-auths
971+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
972+
env:
973+
INPUT_REGISTRY-AUTHS: ${{ secrets.registry-auths }}
974+
with:
975+
script: |
976+
core.setOutput('present', core.getInput('registry-auths') ? 'true' : 'false');
977+
-
978+
name: Configure AWS credentials
979+
if: ${{ needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
980+
uses: aws-actions/configure-aws-credentials@99214aa6889fcddfa57764031d71add364327e59 # v6.1.3
981+
with:
982+
role-to-assume: ${{ needs.registry-identities.outputs.aws-ecr-role-to-assume }}
983+
aws-region: ${{ needs.registry-identities.outputs.aws-ecr-region }}
984+
-
985+
name: Login to Amazon ECR
986+
if: ${{ needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
987+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
988+
with:
989+
registry-auth: ${{ needs.registry-identities.outputs.aws-ecr-registry-auth }}
956990
-
957991
name: Login to registry
958-
if: ${{ inputs.push && inputs.output == 'image' }}
992+
if: ${{ inputs.push && inputs.output == 'image' && steps.registry-auths.outputs.present == 'true' }}
959993
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
960994
with:
961995
registry-auth: ${{ secrets.registry-auths }}
@@ -987,7 +1021,7 @@ jobs:
9871021
core.setOutput('digest', imageDigest);
9881022
-
9891023
name: Login to registry for signing
990-
if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' }}
1024+
if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' && steps.registry-auths.outputs.present == 'true' }}
9911025
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
9921026
with:
9931027
registry-auth: ${{ secrets.registry-auths }}
@@ -1114,6 +1148,7 @@ jobs:
11141148
output-type: ${{ inputs.output }}
11151149
signed: ${{ needs.prepare.outputs.sign }}
11161150
needs:
1151+
- registry-identities
11171152
- prepare
11181153
- build
11191154
steps:
@@ -1152,9 +1187,31 @@ jobs:
11521187
labels: ${{ inputs.meta-labels }}
11531188
annotations: ${{ inputs.meta-annotations }}
11541189
bake-target: ${{ inputs.meta-bake-target }}
1190+
-
1191+
name: Check registry auths
1192+
id: registry-auths
1193+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
1194+
env:
1195+
INPUT_REGISTRY-AUTHS: ${{ secrets.registry-auths }}
1196+
with:
1197+
script: |
1198+
core.setOutput('present', core.getInput('registry-auths') ? 'true' : 'false');
1199+
-
1200+
name: Configure AWS credentials
1201+
if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
1202+
uses: aws-actions/configure-aws-credentials@99214aa6889fcddfa57764031d71add364327e59 # v6.1.3
1203+
with:
1204+
role-to-assume: ${{ needs.registry-identities.outputs.aws-ecr-role-to-assume }}
1205+
aws-region: ${{ needs.registry-identities.outputs.aws-ecr-region }}
1206+
-
1207+
name: Login to Amazon ECR
1208+
if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
1209+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
1210+
with:
1211+
registry-auth: ${{ needs.registry-identities.outputs.aws-ecr-registry-auth }}
11551212
-
11561213
name: Login to registry
1157-
if: ${{ inputs.push && inputs.output == 'image' }}
1214+
if: ${{ inputs.push && inputs.output == 'image' && steps.registry-auths.outputs.present == 'true' }}
11581215
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
11591216
with:
11601217
registry-auth: ${{ secrets.registry-auths }}

‎.github/workflows/build.yml‎

Lines changed: 60 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,10 @@ on:
106106
type: string
107107
description: "Ulimit options (e.g., nofile=1024:1024)"
108108
required: false
109+
registry-identities:
110+
type: string
111+
description: "Keyless registry identity configuration as YAML objects"
112+
required: false
109113
# docker/metadata-action
110114
set-meta-annotations:
111115
type: boolean
@@ -182,8 +186,15 @@ env:
182186
NPM_CONFIG_FETCH_RETRIES: "5"
183187

184188
jobs:
189+
setup-registry-identities:
190+
uses: ./.github/workflows/setup-registry-identities.yml
191+
with:
192+
registry-identities: ${{ inputs.registry-identities }}
193+
185194
prepare:
186195
runs-on: ubuntu-24.04
196+
needs:
197+
- setup-registry-identities
187198
outputs:
188199
includes: ${{ steps.set.outputs.includes }}
189200
metaImages: ${{ steps.set.outputs.metaImages }}
@@ -463,6 +474,7 @@ jobs:
463474
build:
464475
runs-on: ${{ matrix.runner }}
465476
needs:
477+
- setup-registry-identities
466478
- prepare
467479
strategy:
468480
fail-fast: ${{ inputs.fail-fast }}
@@ -811,9 +823,31 @@ jobs:
811823
// for a public repository, we set max provenance mode
812824
core.setOutput('provenance', Build.resolveProvenanceAttrs(`mode=max,version=v1`));
813825
}
826+
-
827+
name: Check registry auths
828+
id: registry-auths
829+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
830+
env:
831+
INPUT_REGISTRY-AUTHS: ${{ secrets.registry-auths }}
832+
with:
833+
script: |
834+
core.setOutput('present', core.getInput('registry-auths') ? 'true' : 'false');
835+
-
836+
name: Configure AWS credentials
837+
if: ${{ needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
838+
uses: aws-actions/configure-aws-credentials@99214aa6889fcddfa57764031d71add364327e59 # v6.1.3
839+
with:
840+
role-to-assume: ${{ needs.registry-identities.outputs.aws-ecr-role-to-assume }}
841+
aws-region: ${{ needs.registry-identities.outputs.aws-ecr-region }}
842+
-
843+
name: Login to Amazon ECR
844+
if: ${{ needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
845+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
846+
with:
847+
registry-auth: ${{ needs.registry-identities.outputs.aws-ecr-registry-auth }}
814848
-
815849
name: Login to registry
816-
if: ${{ inputs.push && inputs.output == 'image' }}
850+
if: ${{ inputs.push && inputs.output == 'image' && steps.registry-auths.outputs.present == 'true' }}
817851
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
818852
with:
819853
registry-auth: ${{ secrets.registry-auths }}
@@ -842,7 +876,7 @@ jobs:
842876
GIT_AUTH_TOKEN: ${{ secrets.github-token || github.token }}
843877
-
844878
name: Login to registry for signing
845-
if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' }}
879+
if: ${{ needs.prepare.outputs.sign == 'true' && inputs.output == 'image' && steps.registry-auths.outputs.present == 'true' }}
846880
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
847881
with:
848882
registry-auth: ${{ secrets.registry-auths }}
@@ -969,6 +1003,7 @@ jobs:
9691003
output-type: ${{ inputs.output }}
9701004
signed: ${{ needs.prepare.outputs.sign }}
9711005
needs:
1006+
- registry-identities
9721007
- prepare
9731008
- build
9741009
steps:
@@ -1006,9 +1041,31 @@ jobs:
10061041
flavor: ${{ inputs.meta-flavor }}
10071042
labels: ${{ inputs.meta-labels }}
10081043
annotations: ${{ inputs.meta-annotations }}
1044+
-
1045+
name: Check registry auths
1046+
id: registry-auths
1047+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
1048+
env:
1049+
INPUT_REGISTRY-AUTHS: ${{ secrets.registry-auths }}
1050+
with:
1051+
script: |
1052+
core.setOutput('present', core.getInput('registry-auths') ? 'true' : 'false');
1053+
-
1054+
name: Configure AWS credentials
1055+
if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
1056+
uses: aws-actions/configure-aws-credentials@99214aa6889fcddfa57764031d71add364327e59 # v6.1.3
1057+
with:
1058+
role-to-assume: ${{ needs.registry-identities.outputs.aws-ecr-role-to-assume }}
1059+
aws-region: ${{ needs.registry-identities.outputs.aws-ecr-region }}
1060+
-
1061+
name: Login to Amazon ECR
1062+
if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
1063+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
1064+
with:
1065+
registry-auth: ${{ needs.registry-identities.outputs.aws-ecr-registry-auth }}
10091066
-
10101067
name: Login to registry
1011-
if: ${{ inputs.push && inputs.output == 'image' }}
1068+
if: ${{ inputs.push && inputs.output == 'image' && steps.registry-auths.outputs.present == 'true' }}
10121069
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
10131070
with:
10141071
registry-auth: ${{ secrets.registry-auths }}

‎README.md‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ ___
1818
* [Outputs](#outputs-1)
1919
* [Notes](#notes)
2020
* [Signed GitHub Actions cache](#signed-github-actions-cache)
21+
* [Registry identities](#registry-identities)
2122
* [Runner mapping](#runner-mapping)
2223
* [Metadata templates](#metadata-templates)
2324

@@ -233,6 +234,7 @@ jobs:
233234
| `output` | String | | Build output destination (one of [`image`](https://docs.docker.com/build/exporters/image-registry/) or [`local`](https://docs.docker.com/build/exporters/local-tar/)). Unlike the `build-push-action`, it only accepts `image` or `local`. The reusable workflow takes care of setting the `outputs` attribute |
234235
| `platforms` | List/CSV | | List of [target platforms](https://docs.docker.com/engine/reference/commandline/buildx_build/#platform) to build |
235236
| `push` | Bool | `false` | [Push](https://docs.docker.com/engine/reference/commandline/buildx_build/#push) image to the registry (for `image` output) |
237+
| `registry-identities` | YAML | | Keyless registry identity configuration. See [Registry identities](#registry-identities). |
236238
| `sbom` | Bool | `false` | Generate [SBOM](https://docs.docker.com/build/attestations/sbom/) attestation for the build |
237239
| `shm-size` | String | | Size of [`/dev/shm`](https://docs.docker.com/engine/reference/commandline/buildx_build/#shm-size) (e.g., `2g`) |
238240
| `sign` | String | `auto` | Sign attestation manifest for `image` output or artifacts for `local` output, can be one of `auto`, `true` or `false`. The `auto` mode will enable signing if `push` is enabled for pushing the `image` or if `artifact-upload` is enabled for uploading the `local` build output as GitHub Artifact |
@@ -340,6 +342,7 @@ jobs:
340342
| `files` | List | `{context}/docker-bake.hcl` | List of bake definition files |
341343
| `output` | String | | Build output destination (one of [`image`](https://docs.docker.com/build/exporters/image-registry/) or [`local`](https://docs.docker.com/build/exporters/local-tar/)). |
342344
| `push` | Bool | `false` | Push image to the registry (for `image` output) |
345+
| `registry-identities` | YAML | | Keyless registry identity configuration. See [Registry identities](#registry-identities). |
343346
| `sbom` | Bool | `false` | Generate [SBOM](https://docs.docker.com/build/attestations/sbom/) attestation for the build |
344347
| `set` | List | | List of [target values to override](https://docs.docker.com/engine/reference/commandline/buildx_bake/#set) (e.g., `targetpattern.key=value`) |
345348
| `sign` | String | `auto` | Sign attestation manifest for `image` output or artifacts for `local` output, can be one of `auto`, `true` or `false`. The `auto` mode will enable signing if `push` is enabled for pushing the `image` or if `artifact-upload` is enabled for uploading the `local` build output as GitHub Artifact |
@@ -391,6 +394,46 @@ Without verification, a poisoned BuildKit cache could influence a later trusted
391394
build, which is the SLSA isolation concern described in
392395
[docker/github-builder#56](https://github.com/docker/github-builder/issues/56).
393396

397+
### Registry identities
398+
399+
The `registry-identities` input configures keyless registry authentication from
400+
non-secret identity metadata. Do not put passwords, tokens, client secrets,
401+
private keys, raw cloud credential JSON, or other secret values in this input.
402+
The workflow validates the YAML before any build work starts.
403+
404+
`registry-identities` can be combined with the existing `registry-auths`
405+
secret. Provider-specific authentication steps are pinned in these reusable
406+
workflows; callers can only select supported provider types and pass identity
407+
configuration.
408+
409+
Amazon ECR private registry authentication is configured with `type: aws-ecr`.
410+
Callers must grant `id-token: write` so the AWS credential step can assume the
411+
role through GitHub OIDC:
412+
413+
```yaml
414+
permissions:
415+
contents: read
416+
id-token: write
417+
418+
jobs:
419+
build:
420+
uses: docker/github-builder/.github/workflows/build.yml@main
421+
with:
422+
push: true
423+
registry-identities: |
424+
- type: aws-ecr
425+
aws-region: us-east-1
426+
role-to-assume: arn:aws:iam::123456789012:role/github-builder
427+
registries: "123456789012"
428+
```
429+
430+
The `registries` value is required for AWS ECR. It accepts either a
431+
comma-delimited string or a YAML list. Account IDs are expanded with
432+
`aws-region` into private ECR registry hosts, and full registry hostnames are
433+
normalized to the registry server before login. Public ECR repository names,
434+
such as `public.ecr.aws/q3b5f1u4/test-docker-action`, are normalized to
435+
`public.ecr.aws` for authentication.
436+
394437
### Runner mapping
395438

396439
The `runner` input accepts either a single GitHub-hosted Linux runner label or a

0 commit comments

Comments
 (0)