Merge pull request #1055 from crazy-max/test-registry-auth-oidc

test: cover Docker Hub OIDC with registry-auth

.github/workflows/ci.yml

@@ -173,6 +173,27 @@ jobs:
         with:
           username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
 
+  registry-auth-oidc:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      -
+        name: Login to registries
+        uses: ./
+        env:
+          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
+        with:
+          registry-auth: |
+            - username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
+            - registry: ghcr.io
+              username: ${{ github.actor }}
+              password: ${{ secrets.GITHUB_TOKEN }}
+
   ecr:
     runs-on: ${{ matrix.os }}
     strategy:

README.md

@@ -648,6 +648,38 @@ jobs:
               password: ${{ secrets.GITHUB_TOKEN }}
 ```
 
+Docker Hub OIDC can also be used with `registry-auth`. Grant `id-token: write`,
+set `DOCKERHUB_OIDC_CONNECTIONID`, pass the Docker Hub organization name as
+`username`, and omit `password` for the Docker Hub object:
+
+```yaml
+name: ci
+
+on:
+  push:
+    branches: main
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  login:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Login to registries
+        uses: docker/login-action@v4
+        env:
+          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
+        with:
+          registry-auth: |
+            - username: ${{ vars.DOCKERHUB_ORGANIZATION }}
+            - registry: ghcr.io
+              username: ${{ github.actor }}
+              password: ${{ secrets.GITHUB_TOKEN }}
+```
+
 ### Set scopes for the authentication token
 
 The `scope` input allows limiting registry credentials to a specific repository

__tests__/context.test.ts

@@ -54,6 +54,25 @@ test('getAuthList skips secret masking when registry-auth password is absent', a
   });
 });
 
+test('getAuthList supports password-less Docker Hub registry-auth for OIDC', async () => {
+  const [auth] = getAuthList({
+    registry: '',
+    username: '',
+    password: '',
+    scope: '',
+    ecr: '',
+    logout: true,
+    registryAuth: '- username: docker-org\n'
+  });
+
+  expect(auth).toMatchObject({
+    registry: 'docker.io',
+    username: 'docker-org',
+    password: undefined,
+    ecr: 'auto'
+  });
+});
+
 test('getAuthList masks registry-auth password when present', async () => {
   const stdoutWriteSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
   getAuthList({

__tests__/docker.test.ts

@@ -1,8 +1,14 @@
-import {expect, test, vi} from 'vitest';
+import {afterEach, expect, test, vi} from 'vitest';
 
 import {Docker} from '@docker/actions-toolkit/lib/docker/docker.js';
 
-import {loginStandard, logout} from '../src/docker.js';
+import {login, loginStandard, logout} from '../src/docker.js';
+import * as dockerhub from '../src/dockerhub.js';
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  delete process.env.DOCKERHUB_OIDC_CONNECTIONID;
+});
 
 test('loginStandard calls exec', async () => {
   const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
@@ -32,6 +38,37 @@ test('loginStandard calls exec', async () => {
   });
 });
 
+test('login exchanges Docker Hub OIDC token for password-less auth', async () => {
+  process.env.DOCKERHUB_OIDC_CONNECTIONID = '123e4567-e89b-42d3-a456-426614174000';
+  const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
+    return {
+      exitCode: 0,
+      stdout: '',
+      stderr: ''
+    };
+  });
+  const oidcSpy = vi.spyOn(dockerhub, 'getOIDCToken').mockResolvedValue({
+    username: 'docker-org',
+    token: 'hub-token'
+  });
+
+  await login({
+    registry: 'docker.io',
+    username: 'docker-org',
+    password: '',
+    scope: '',
+    ecr: 'auto',
+    configDir: ''
+  });
+
+  expect(oidcSpy).toHaveBeenCalledWith('docker.io', 'docker-org');
+  expect(execSpy).toHaveBeenCalledWith(['login', '--password-stdin', '--username', 'docker-org', 'docker.io'], {
+    input: Buffer.from('hub-token'),
+    silent: true,
+    ignoreReturnCode: true
+  });
+});
+
 test('logout calls exec', async () => {
   const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
     return {

dist/licenses.txt

@@ -1913,8 +1913,8 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/client-ecr-public@3.1092.0
- - @aws-sdk/client-ecr@3.1092.0
+ - @aws-sdk/client-ecr-public@3.1091.0
+ - @aws-sdk/client-ecr@3.1091.0
 
 These packages each contain the following license:
 
@@ -3175,7 +3175,7 @@ software or this license, under any kind of legal claim.***
 
 The following npm package may be included in this product:
 
- - @aws-sdk/core@3.976.0
+ - @aws-sdk/core@3.975.3
 
 This package contains the following license:
 
@@ -3385,10 +3385,10 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-env@3.972.60
- - @aws-sdk/credential-provider-ini@3.973.5
- - @aws-sdk/credential-provider-node@3.972.71
- - @aws-sdk/token-providers@3.1092.0
+ - @aws-sdk/credential-provider-env@3.972.59
+ - @aws-sdk/credential-provider-ini@3.973.4
+ - @aws-sdk/credential-provider-node@3.972.70
+ - @aws-sdk/token-providers@3.1088.0
  - @aws-sdk/types@3.974.2
  - @aws-sdk/xml-builder@3.972.36
  - @smithy/credential-provider-imds@4.4.11
@@ -3604,9 +3604,9 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-process@3.972.60
- - @aws-sdk/credential-provider-sso@3.973.4
- - @aws-sdk/credential-provider-web-identity@3.972.66
+ - @aws-sdk/credential-provider-process@3.972.59
+ - @aws-sdk/credential-provider-sso@3.973.3
+ - @aws-sdk/credential-provider-web-identity@3.972.65
 
 These packages each contain the following license:
 
@@ -3880,9 +3880,9 @@ END OF TERMS AND CONDITIONS
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-http@3.972.62
- - @aws-sdk/credential-provider-login@3.972.67
- - @aws-sdk/nested-clients@3.997.34
+ - @aws-sdk/credential-provider-http@3.972.61
+ - @aws-sdk/credential-provider-login@3.972.66
+ - @aws-sdk/nested-clients@3.997.33
  - @sigstore/verify@4.1.0
 
 These packages each contain the following license:

package.json

@@ -25,8 +25,8 @@
   "dependencies": {
     "@actions/core": "^3.0.1",
     "@actions/http-client": "^4.0.1",
-    "@aws-sdk/client-ecr": "^3.1092.0",
-    "@aws-sdk/client-ecr-public": "^3.1092.0",
+    "@aws-sdk/client-ecr": "^3.1091.0",
+    "@aws-sdk/client-ecr-public": "^3.1091.0",
     "@docker/actions-toolkit": "^0.94.0",
     "http-proxy-agent": "^9.1.0",
     "https-proxy-agent": "^9.1.0",

src/dockerhub.ts

@@ -12,17 +12,14 @@ interface OIDCTokenResponse {
   access_token: string;
 }
 
+const registries = new Set(['', 'docker.io', 'registry-1.docker.io', 'registry-1-stage.docker.io', 'dhi.io']);
 const defaultExpiresIn = 300;
 const minExpiresIn = 300;
 const maxExpiresIn = 3600;
 const maxRetries = 5;
 
 export const isDockerHubOIDC = (registry: string, password: string): boolean => {
-  return process.env.DOCKERHUB_OIDC_CONNECTIONID !== undefined && !password && isDockerHubRegistry(registry);
-};
-
-const isDockerHubRegistry = (registry: string): boolean => {
-  return registry === '' || registry === 'docker.io' || registry === 'registry-1.docker.io' || registry === 'registry-1-stage.docker.io';
+  return process.env.DOCKERHUB_OIDC_CONNECTIONID !== undefined && !password && registries.has(registry);
 };
 
 export const getOIDCToken = async (registry: string, username: string): Promise<LoginCredentials> => {

yarn.lock

@@ -170,41 +170,41 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@aws-sdk/client-ecr-public@npm:^3.1092.0":
-  version: 3.1092.0
-  resolution: "@aws-sdk/client-ecr-public@npm:3.1092.0"
+"@aws-sdk/client-ecr-public@npm:^3.1091.0":
+  version: 3.1091.0
+  resolution: "@aws-sdk/client-ecr-public@npm:3.1091.0"
   dependencies:
-    "@aws-sdk/core": "npm:^3.976.0"
-    "@aws-sdk/credential-provider-node": "npm:^3.972.71"
+    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/credential-provider-node": "npm:^3.972.70"
     "@aws-sdk/types": "npm:^3.974.2"
     "@smithy/core": "npm:^3.29.4"
     "@smithy/fetch-http-handler": "npm:^5.6.6"
     "@smithy/node-http-handler": "npm:^4.9.6"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/63f09a879f25fac8dd874371fba5761a6bdd614962be7ddd481e76043e59187f5e01f932009d1f09db576676cb2cae44133eea81ebe6352f8d7f9b6c301e94a3
+  checksum: 10/70da99ae235bfeb22ae8018860ae587ad77b0a17b89393a893f4a90625513ba0c69ab1f560ea0addae57361abb8f799a534b326fe58e741642049bfcf137cf25
   languageName: node
   linkType: hard
 
-"@aws-sdk/client-ecr@npm:^3.1092.0":
-  version: 3.1092.0
-  resolution: "@aws-sdk/client-ecr@npm:3.1092.0"
+"@aws-sdk/client-ecr@npm:^3.1091.0":
+  version: 3.1091.0
+  resolution: "@aws-sdk/client-ecr@npm:3.1091.0"
   dependencies:
-    "@aws-sdk/core": "npm:^3.976.0"
-    "@aws-sdk/credential-provider-node": "npm:^3.972.71"
+    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/credential-provider-node": "npm:^3.972.70"
     "@aws-sdk/types": "npm:^3.974.2"
     "@smithy/core": "npm:^3.29.4"
     "@smithy/fetch-http-handler": "npm:^5.6.6"
     "@smithy/node-http-handler": "npm:^4.9.6"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/9f86cafcf2663cb2f3752883fc97ace5b1a3acfa381ab58d2c9eb651a10d7193df84a23a9614c991b55d212cf9977eb18e88fbc2f2acd8adf2182ace52728d14
+  checksum: 10/622dce201f147c99017945ed479fac1ab12485c6612c4b7cd76eb1885965639073517d392b56c05ca6d88a1104c662608edd26c44930a0ee47f6bd6dc8d5956e
   languageName: node
   linkType: hard
 
-"@aws-sdk/core@npm:^3.976.0":
-  version: 3.976.0
-  resolution: "@aws-sdk/core@npm:3.976.0"
+"@aws-sdk/core@npm:^3.975.3":
+  version: 3.975.3
+  resolution: "@aws-sdk/core@npm:3.975.3"
   dependencies:
     "@aws-sdk/types": "npm:^3.974.2"
     "@aws-sdk/xml-builder": "npm:^3.972.36"
@@ -214,139 +214,139 @@ __metadata:
     "@smithy/types": "npm:^4.16.1"
     bowser: "npm:^2.11.0"
     tslib: "npm:^2.6.2"
-  checksum: 10/c2f34812e7fe3d80d4778a570bd17018251fe935a83cd47e0d0166be4b696aff1b114ade47b00235d8a7eebe36ce573e0e71a5c636a51681f787f84b3a353820
+  checksum: 10/a4be9e91891f6f2169cc694e8d4abe1a0bd83ed257af688d83617c428d54ad34516ccd4ed51854b4df9b81e585d30dfa9618cec75d2dfa6a8b7f5239d01913d4
   languageName: node
   linkType: hard
 
-"@aws-sdk/credential-provider-env@npm:^3.972.60":
-  version: 3.972.60
-  resolution: "@aws-sdk/credential-provider-env@npm:3.972.60"
+"@aws-sdk/credential-provider-env@npm:^3.972.59":
+  version: 3.972.59
+  resolution: "@aws-sdk/credential-provider-env@npm:3.972.59"
   dependencies:
-    "@aws-sdk/core": "npm:^3.976.0"
+    "@aws-sdk/core": "npm:^3.975.3"
     "@aws-sdk/types": "npm:^3.974.2"
     "@smithy/core": "npm:^3.29.4"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/900a8fbbb850cf93344bbf05ac697d8643f9091e5551a759da8383b88347fa2720a768df3abd7fa72ce943453082555e96f44f2eb1bae33fd498994b64996be1
+  checksum: 10/e9456725b6e1ad9c28f1901fa4275261821d8590e396c40f331d3bc59712533c7950216938260adb2fc63f72721a17f0b1acb36093a2c2242147039f00180fec
   languageName: node
   linkType: hard
 
-"@aws-sdk/credential-provider-http@npm:^3.972.62":
-  version: 3.972.62
-  resolution: "@aws-sdk/credential-provider-http@npm:3.972.62"
+"@aws-sdk/credential-provider-http@npm:^3.972.61":
+  version: 3.972.61
+  resolution: "@aws-sdk/credential-provider-http@npm:3.972.61"
   dependencies:
-    "@aws-sdk/core": "npm:^3.976.0"
+    "@aws-sdk/core": "npm:^3.975.3"
     "@aws-sdk/types": "npm:^3.974.2"
     "@smithy/core": "npm:^3.29.4"
     "@smithy/fetch-http-handler": "npm:^5.6.6"
     "@smithy/node-http-handler": "npm:^4.9.6"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/b991a796215b529df29b691c663cfd4d00fdf267ada6ebedf7422d4cfab90d7419f619d1b6633add5c3030a1d543c8fa2e697f2510785288370cc0e04c622ff3
+  checksum: 10/c8d8dba6bb6ae8816ac2ccad8cb661d30a73c8414abc73972c74ef0a50ccadfaaef59b051832648b57852934dc3051d0218bd805e6beff35537f3b8a00d881fb
   languageName: node
   linkType: hard
 
-"@aws-sdk/credential-provider-ini@npm:^3.973.5":
-  version: 3.973.5
-  resolution: "@aws-sdk/credential-provider-ini@npm:3.973.5"
-  dependencies:
-    "@aws-sdk/core": "npm:^3.976.0"
-    "@aws-sdk/credential-provider-env": "npm:^3.972.60"
-    "@aws-sdk/credential-provider-http": "npm:^3.972.62"
-    "@aws-sdk/credential-provider-login": "npm:^3.972.67"
-    "@aws-sdk/credential-provider-process": "npm:^3.972.60"
-    "@aws-sdk/credential-provider-sso": "npm:^3.973.4"
-    "@aws-sdk/credential-provider-web-identity": "npm:^3.972.66"
-    "@aws-sdk/nested-clients": "npm:^3.997.34"
-    "@aws-sdk/types": "npm:^3.974.2"
-    "@smithy/core": "npm:^3.29.4"
-    "@smithy/credential-provider-imds": "npm:^4.4.9"
-    "@smithy/types": "npm:^4.16.1"
-    tslib: "npm:^2.6.2"
-  checksum: 10/f0d1a01d6e1c51f312fb63be4416e2139680f61bd5f1ab7dfd30c9db5d5308c1e7e125064f97cea0b3d53ede71443b433cc52e8813e0ffd110dc7c122750f167
-  languageName: node
-  linkType: hard
-
-"@aws-sdk/credential-provider-login@npm:^3.972.67":
-  version: 3.972.67
-  resolution: "@aws-sdk/credential-provider-login@npm:3.972.67"
-  dependencies:
-    "@aws-sdk/core": "npm:^3.976.0"
-    "@aws-sdk/nested-clients": "npm:^3.997.34"
-    "@aws-sdk/types": "npm:^3.974.2"
-    "@smithy/core": "npm:^3.29.4"
-    "@smithy/types": "npm:^4.16.1"
-    tslib: "npm:^2.6.2"
-  checksum: 10/8597c0c39c7a37101c2ca25f9d077003ebdf90939df78d17a65e1388743df14962e1f3cc77961be47d541b7ed12ab6deff2b2727802453877f337cfafc805e78
-  languageName: node
-  linkType: hard
-
-"@aws-sdk/credential-provider-node@npm:^3.972.71":
-  version: 3.972.71
-  resolution: "@aws-sdk/credential-provider-node@npm:3.972.71"
-  dependencies:
-    "@aws-sdk/credential-provider-env": "npm:^3.972.60"
-    "@aws-sdk/credential-provider-http": "npm:^3.972.62"
-    "@aws-sdk/credential-provider-ini": "npm:^3.973.5"
-    "@aws-sdk/credential-provider-process": "npm:^3.972.60"
-    "@aws-sdk/credential-provider-sso": "npm:^3.973.4"
-    "@aws-sdk/credential-provider-web-identity": "npm:^3.972.66"
-    "@aws-sdk/types": "npm:^3.974.2"
-    "@smithy/core": "npm:^3.29.4"
-    "@smithy/credential-provider-imds": "npm:^4.4.9"
-    "@smithy/types": "npm:^4.16.1"
-    tslib: "npm:^2.6.2"
-  checksum: 10/3516c7ef2937b9fc02558c060118248ebfa819ea560aac96f9645bf6a11230b4f0171d5b3f676752e31ff54a0cc21d919ac342a5e41798daeb3696ee3c0eeadd
-  languageName: node
-  linkType: hard
-
-"@aws-sdk/credential-provider-process@npm:^3.972.60":
-  version: 3.972.60
-  resolution: "@aws-sdk/credential-provider-process@npm:3.972.60"
-  dependencies:
-    "@aws-sdk/core": "npm:^3.976.0"
-    "@aws-sdk/types": "npm:^3.974.2"
-    "@smithy/core": "npm:^3.29.4"
-    "@smithy/types": "npm:^4.16.1"
-    tslib: "npm:^2.6.2"
-  checksum: 10/092136d95f4293d44cd18e16759f87b172c5d0eb9413aed04bce0bc240d28709f4bf67d04497dc08a2f47672ebf27818b15ad4798240f5aaf6c4f082adc10ba5
-  languageName: node
-  linkType: hard
-
-"@aws-sdk/credential-provider-sso@npm:^3.973.4":
+"@aws-sdk/credential-provider-ini@npm:^3.973.4":
   version: 3.973.4
-  resolution: "@aws-sdk/credential-provider-sso@npm:3.973.4"
+  resolution: "@aws-sdk/credential-provider-ini@npm:3.973.4"
   dependencies:
-    "@aws-sdk/core": "npm:^3.976.0"
-    "@aws-sdk/nested-clients": "npm:^3.997.34"
-    "@aws-sdk/token-providers": "npm:3.1092.0"
+    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/credential-provider-env": "npm:^3.972.59"
+    "@aws-sdk/credential-provider-http": "npm:^3.972.61"
+    "@aws-sdk/credential-provider-login": "npm:^3.972.66"
+    "@aws-sdk/credential-provider-process": "npm:^3.972.59"
+    "@aws-sdk/credential-provider-sso": "npm:^3.973.3"
+    "@aws-sdk/credential-provider-web-identity": "npm:^3.972.65"
+    "@aws-sdk/nested-clients": "npm:^3.997.33"
     "@aws-sdk/types": "npm:^3.974.2"
     "@smithy/core": "npm:^3.29.4"
+    "@smithy/credential-provider-imds": "npm:^4.4.9"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/9d942ad7260c5633e47c6d3342fd9ebbc378edf4a451ac1a86ce88780ae59827156edcb38e91406f163c7f9228361a6ade500165cd232612722ed9abf72d2467
+  checksum: 10/4c0e53c8abfb10184984a2bd975d03bb850c0ff7a3d2a2e7c20413177cf1ac47869cc3f619084886bf933f96a36376896e0800c3ffe170ef470fedbdb114ead0
   languageName: node
   linkType: hard
 
-"@aws-sdk/credential-provider-web-identity@npm:^3.972.66":
+"@aws-sdk/credential-provider-login@npm:^3.972.66":
   version: 3.972.66
-  resolution: "@aws-sdk/credential-provider-web-identity@npm:3.972.66"
+  resolution: "@aws-sdk/credential-provider-login@npm:3.972.66"
   dependencies:
-    "@aws-sdk/core": "npm:^3.976.0"
-    "@aws-sdk/nested-clients": "npm:^3.997.34"
+    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/nested-clients": "npm:^3.997.33"
     "@aws-sdk/types": "npm:^3.974.2"
     "@smithy/core": "npm:^3.29.4"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/b721b6e291d1e2fbb35a9be978c3cb304f29e83c284358c72265def967f2e282b0b8a2e10838476ad39b2fe46becb6caec62eecc3782a2304161bd86571d5e2a
+  checksum: 10/c9a4a5aab4f7de83c35f22c8fec13661e13939634a94c298ab1895b53a0ee477d4667ac1632007bc87daedbd3789742285e1b5882567497d7fe16a961f0afe95
   languageName: node
   linkType: hard
 
-"@aws-sdk/nested-clients@npm:^3.997.34":
-  version: 3.997.34
-  resolution: "@aws-sdk/nested-clients@npm:3.997.34"
+"@aws-sdk/credential-provider-node@npm:^3.972.70":
+  version: 3.972.70
+  resolution: "@aws-sdk/credential-provider-node@npm:3.972.70"
   dependencies:
-    "@aws-sdk/core": "npm:^3.976.0"
+    "@aws-sdk/credential-provider-env": "npm:^3.972.59"
+    "@aws-sdk/credential-provider-http": "npm:^3.972.61"
+    "@aws-sdk/credential-provider-ini": "npm:^3.973.4"
+    "@aws-sdk/credential-provider-process": "npm:^3.972.59"
+    "@aws-sdk/credential-provider-sso": "npm:^3.973.3"
+    "@aws-sdk/credential-provider-web-identity": "npm:^3.972.65"
+    "@aws-sdk/types": "npm:^3.974.2"
+    "@smithy/core": "npm:^3.29.4"
+    "@smithy/credential-provider-imds": "npm:^4.4.9"
+    "@smithy/types": "npm:^4.16.1"
+    tslib: "npm:^2.6.2"
+  checksum: 10/302b7e3776429c61f89f863fcc14ac866d13bd6513e8f15a09d5c56bc5e619a3b0461a680fedad97dcd3cc000ed8a3522d776b9b2ff326505e1fd1d872a96adf
+  languageName: node
+  linkType: hard
+
+"@aws-sdk/credential-provider-process@npm:^3.972.59":
+  version: 3.972.59
+  resolution: "@aws-sdk/credential-provider-process@npm:3.972.59"
+  dependencies:
+    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/types": "npm:^3.974.2"
+    "@smithy/core": "npm:^3.29.4"
+    "@smithy/types": "npm:^4.16.1"
+    tslib: "npm:^2.6.2"
+  checksum: 10/91bdaea2ff81b054ce8e508d83d5efd825a87f22ac74ac2a9f41d8310cb1211a4be7b6f33b505da2e3570b163e22faa5dfc7acd9afc73e61b98a3afb5621891e
+  languageName: node
+  linkType: hard
+
+"@aws-sdk/credential-provider-sso@npm:^3.973.3":
+  version: 3.973.3
+  resolution: "@aws-sdk/credential-provider-sso@npm:3.973.3"
+  dependencies:
+    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/nested-clients": "npm:^3.997.33"
+    "@aws-sdk/token-providers": "npm:3.1088.0"
+    "@aws-sdk/types": "npm:^3.974.2"
+    "@smithy/core": "npm:^3.29.4"
+    "@smithy/types": "npm:^4.16.1"
+    tslib: "npm:^2.6.2"
+  checksum: 10/c5194138240365f799c65c2e6daac956342e45bd2877615c959f62f1d378193509699d2480814aebdd07ce6440af05500df0aa54397d7b097371db423c0c4543
+  languageName: node
+  linkType: hard
+
+"@aws-sdk/credential-provider-web-identity@npm:^3.972.65":
+  version: 3.972.65
+  resolution: "@aws-sdk/credential-provider-web-identity@npm:3.972.65"
+  dependencies:
+    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/nested-clients": "npm:^3.997.33"
+    "@aws-sdk/types": "npm:^3.974.2"
+    "@smithy/core": "npm:^3.29.4"
+    "@smithy/types": "npm:^4.16.1"
+    tslib: "npm:^2.6.2"
+  checksum: 10/9a0f2aec505420929ea78d414e8561691d6fdc0de21f7d947dbb56269236ef16d11d518f31bb0b0ff154fb92039f94211440d113ed09af9965bd5c6d5be1f9cd
+  languageName: node
+  linkType: hard
+
+"@aws-sdk/nested-clients@npm:^3.997.33":
+  version: 3.997.33
+  resolution: "@aws-sdk/nested-clients@npm:3.997.33"
+  dependencies:
+    "@aws-sdk/core": "npm:^3.975.3"
     "@aws-sdk/signature-v4-multi-region": "npm:^3.996.41"
     "@aws-sdk/types": "npm:^3.974.2"
     "@smithy/core": "npm:^3.29.4"
@@ -354,7 +354,7 @@ __metadata:
     "@smithy/node-http-handler": "npm:^4.9.6"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/08e9a50b70c609e067e2bc9c06d7ef0a018e88f813c007cc33d2acc3c9d640b9255b6e509933b314c9823d430a70f3b225861cffd7a82c7fe2427b4a065ea580
+  checksum: 10/2a37d83609009b8b95b56658a48bb70fc56a1296d80701bfe12561aede13c6ebb9e678f3bfb20c5c4533ac6ebe63d4bec791760943c835917c95782eba0ec80c
   languageName: node
   linkType: hard
 
@@ -370,17 +370,17 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@aws-sdk/token-providers@npm:3.1092.0":
-  version: 3.1092.0
-  resolution: "@aws-sdk/token-providers@npm:3.1092.0"
+"@aws-sdk/token-providers@npm:3.1088.0":
+  version: 3.1088.0
+  resolution: "@aws-sdk/token-providers@npm:3.1088.0"
   dependencies:
-    "@aws-sdk/core": "npm:^3.976.0"
-    "@aws-sdk/nested-clients": "npm:^3.997.34"
+    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/nested-clients": "npm:^3.997.33"
     "@aws-sdk/types": "npm:^3.974.2"
     "@smithy/core": "npm:^3.29.4"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/1eac6640a6dfed54250a96c50f3489452ee8e51b846e0c59ded11a8c3155be212e2c582e1d9c728c9d143a79372ab69f960d104d0f302f9c655dca629af7d774
+  checksum: 10/ae399cc5f0589f00514079f79ab1e680fee104d433d8aed80c6f761bb4cb3c5176667a0c567726a22399242a817dfd9624094801da8fbb6f14c5c8bbb882caaf
   languageName: node
   linkType: hard
 
@@ -3156,8 +3156,8 @@ __metadata:
   dependencies:
     "@actions/core": "npm:^3.0.1"
     "@actions/http-client": "npm:^4.0.1"
-    "@aws-sdk/client-ecr": "npm:^3.1092.0"
-    "@aws-sdk/client-ecr-public": "npm:^3.1092.0"
+    "@aws-sdk/client-ecr": "npm:^3.1091.0"
+    "@aws-sdk/client-ecr-public": "npm:^3.1091.0"
     "@docker/actions-toolkit": "npm:^0.94.0"
     "@eslint/js": "npm:^9.39.3"
     "@types/js-yaml": "npm:^4.0.9"