AST-171789 Use Docker Hub OIDC in 2ms release workflow - #398
Open
cx-lior-poterman wants to merge 1 commit into
Open
cx-lior-poterman wants to merge 1 commit into
cx-lior-poterman wants to merge 1 commit into
Conversation
The release job's Docker Hub login referenced DOCKERHUB_USERNAME and DOCKERHUB_TOKEN secrets that no longer exist as repo, org, or environment secrets, so the login step was authenticating with empty credentials. Switch to OIDC federation like kics and ast-cli: declare the release environment (needed to resolve the environment-scoped DOCKERHUB_OIDC_CONNECTIONID secret), add the id-token: write and contents: write permissions, and bump docker-login-action to the OIDC capable version. Also drop the dead dockerhub-description step, which relied on the same removed credentials and has no OIDC equivalent, and update CODEOWNERS to the team that gates the release environment. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
cx-artur-ribeiro
approved these changes
Sep 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The release job now runs in the
releaseenvironment and authenticates to Docker Hub with OIDC instead of a static username/password, matching kics and ast-cli.This fixes a live break: the Docker Hub credentials the workflow referenced don't exist as repo, org, or environment secrets, so the login step was getting empty values. The OIDC connection id is an environment secret, so the job needs the environment declared to resolve it, plus the
id-token: writepermission it never had.Also removed the Docker Hub description-sync step (same missing credentials, no OIDC path) and pointed CODEOWNERS at
cx-maintainers-kics, the team gating the release environment.