Add OIDC in Docker guide for GitHub Actions deployments#45243
Open
gmondello wants to merge 5 commits into
Open
Add OIDC in Docker guide for GitHub Actions deployments#45243gmondello wants to merge 5 commits into
gmondello wants to merge 5 commits into
Conversation
Adds a new guide for configuring OpenID Connect between GitHub Actions and Docker Hub, following the same format as existing provider guides (AWS, Azure, GCP, JFrog, etc.). Docker Hub OIDC connections let workflows authenticate using short-lived tokens instead of long-lived PATs or OATs. The guide covers creating a connection in Docker Hub, configuring rulesets for claim matching, and a complete workflow example using docker/oidc-action and docker/login-action.
|
Thanks for opening this pull request! A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines. |
Contributor
How to review these changes 👓Thank you for your contribution. To review these changes, choose one of the following options: A Hubber will need to deploy your changes internally to review. Table of review linksNote: Please update the URL for your staging server or codespace. The table shows the files in the
Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server 🤖 This comment is automatically generated. |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds guidance for authenticating GitHub Actions workflows with Docker Hub using OIDC.
Changes:
- Adds Docker Hub OIDC setup, ruleset, and workflow guidance.
- Adds the guide to the security-hardening navigation.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 9 comments.
| File | Description |
|---|---|
oidc-in-docker.md |
Adds the Docker Hub OIDC guide and workflow example. |
index.md |
Registers the new guide in navigation. |
gmondello
commented
Jul 21, 2026
gmondello
commented
Jul 21, 2026
gmondello
commented
Jul 21, 2026
- Use Liquid variables instead of hardcoded product names - Add third-party actions disclaimer reusable to workflow example - Use action-checkout reusable for actions/checkout - Add note about immutable subject claim format (post July 15 2026) - Remove duplicate external links per style guide - Pin version comments to major version only (v1, v4, v6)
OIDC connections scope access to Docker Hub and Docker Build Cloud, not just Docker Hub. Keep Docker Hub only where specifically referring to registry operations.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a new guide for configuring OpenID Connect between GitHub Actions and Docker Hub, following the same format as existing provider-specific guides (AWS, Azure, GCP, HashiCorp Vault, JFrog, Octopus Deploy, PyPI).
Docker Hub recently shipped OIDC connections that let GitHub Actions workflows authenticate using short-lived tokens instead of long-lived personal access tokens (PATs) or organization access tokens (OATs). This eliminates credential rotation overhead and reduces secret sprawl in CI/CD pipelines.
Changes
New file:
content/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-docker.mddocker/oidc-action@v1anddocker/login-action@v4Updated file:
content/actions/how-tos/secure-your-work/security-harden-deployments/index.md/oidc-in-dockerto the children list (alphabetical order, between Azure and GCP)References