Compare commits

..

2 Commits

Author SHA1 Message Date
github-actions[bot] 7c34382afd [dependabot skip] chore: update generated content 2026-08-01 05:23:36 +00:00
dependabot[bot] e93e466d7b build(deps): bump brace-expansion from 1.1.16 to 1.1.17
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.16 to 1.1.17.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.16...v1.1.17)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.17
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-08-01 05:22:38 +00:00
6 changed files with 109 additions and 130 deletions
-10
View File
@@ -5,7 +5,6 @@ import {beforeEach, describe, expect, test, vi} from 'vitest';
import * as dockerhub from '../src/dockerhub.js'; import * as dockerhub from '../src/dockerhub.js';
vi.mock('@actions/core', () => ({ vi.mock('@actions/core', () => ({
debug: vi.fn(),
getIDToken: vi.fn(), getIDToken: vi.fn(),
info: vi.fn(), info: vi.fn(),
setSecret: vi.fn() setSecret: vi.fn()
@@ -84,15 +83,6 @@ describe('getOIDCToken', () => {
expect(body.get('connection_id')).toBe(validConnectionID); expect(body.get('connection_id')).toBe(validConnectionID);
expect(body.get('expires_in')).toBe('300'); expect(body.get('expires_in')).toBe('300');
expect(setSecretMock).toHaveBeenCalledWith('hub-token'); expect(setSecretMock).toHaveBeenCalledWith('hub-token');
expect(core.info).toHaveBeenCalledWith('Docker Hub OIDC detected for docker.io');
expect(core.info).toHaveBeenCalledWith('Retrieving GitHub OIDC token for Docker Hub');
expect(core.info).toHaveBeenCalledWith('Exchanging GitHub OIDC token for Docker Hub token');
expect(core.info).toHaveBeenCalledWith('Docker Hub OIDC token exchange succeeded');
expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token audience: https://identity.docker.com');
expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token expiration: 300s');
expect(core.debug).toHaveBeenCalledWith('Sending Docker Hub OIDC token request to https://identity.docker.com/oauth/token');
expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token request returned status code 200');
expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token response status code: 200');
}); });
test('uses custom token expiration', async () => { test('uses custom token expiration', async () => {
Generated Vendored
+102 -102
View File
File diff suppressed because one or more lines are too long
Generated Vendored
+3 -3
View File
File diff suppressed because one or more lines are too long
Generated Vendored
+1 -1
View File
@@ -4591,7 +4591,7 @@ USE OR OTHER DEALINGS IN THE SOFTWARE.
The following npm packages may be included in this product: The following npm packages may be included in this product:
- brace-expansion@1.1.16 - brace-expansion@1.1.17
- brace-expansion@2.0.3 - brace-expansion@2.0.3
These packages each contain the following license: These packages each contain the following license:
-11
View File
@@ -35,10 +35,6 @@ export const getOIDCToken = async (registry: string, username: string): Promise<
const expiresIn = getExpiresIn(); const expiresIn = getExpiresIn();
const identityHost = registry === 'registry-1-stage.docker.io' ? 'identity-stage.docker.com' : 'identity.docker.com'; const identityHost = registry === 'registry-1-stage.docker.io' ? 'identity-stage.docker.com' : 'identity.docker.com';
const audience = `https://${identityHost}`; const audience = `https://${identityHost}`;
core.info(`Docker Hub OIDC detected for ${registry || 'docker.io'}`);
core.debug(`Docker Hub OIDC token audience: ${audience}`);
core.debug(`Docker Hub OIDC token expiration: ${expiresIn}s`);
core.info(`Retrieving GitHub OIDC token for Docker Hub`);
const idToken = await core.getIDToken(audience); const idToken = await core.getIDToken(audience);
const http: httpm.HttpClient = new httpm.HttpClient('github.com/docker/login-action', [], { const http: httpm.HttpClient = new httpm.HttpClient('github.com/docker/login-action', [], {
headers: { headers: {
@@ -53,12 +49,10 @@ export const getOIDCToken = async (registry: string, username: string): Promise<
data.set('connection_id', connectionID); data.set('connection_id', connectionID);
data.set('expires_in', expiresIn.toString()); data.set('expires_in', expiresIn.toString());
core.info(`Exchanging GitHub OIDC token for Docker Hub token`);
const resp = await postWithRetry(http, `https://${identityHost}/oauth/token`, data.toString()); const resp = await postWithRetry(http, `https://${identityHost}/oauth/token`, data.toString());
const tokenResp = <OIDCTokenResponse>JSON.parse(await handleResponse(resp)); const tokenResp = <OIDCTokenResponse>JSON.parse(await handleResponse(resp));
core.setSecret(tokenResp.access_token); core.setSecret(tokenResp.access_token);
core.info(`Docker Hub OIDC token exchange succeeded`);
return { return {
username, username,
@@ -76,20 +70,16 @@ const getExpiresIn = (): number => {
}; };
const postWithRetry = async (http: httpm.HttpClient, url: string, data: string): Promise<httpm.HttpClientResponse> => { const postWithRetry = async (http: httpm.HttpClient, url: string, data: string): Promise<httpm.HttpClientResponse> => {
core.debug(`Sending Docker Hub OIDC token request to ${url}`);
let resp = await http.post(url, data); let resp = await http.post(url, data);
core.debug(`Docker Hub OIDC token request returned status code ${resp.message.statusCode || HttpCodes.InternalServerError}`);
for (let attempt = 0; (resp.message.statusCode || HttpCodes.InternalServerError) === HttpCodes.TooManyRequests && attempt < maxRetries; attempt++) { for (let attempt = 0; (resp.message.statusCode || HttpCodes.InternalServerError) === HttpCodes.TooManyRequests && attempt < maxRetries; attempt++) {
const delay = parseRetryAfter(resp.message.headers['retry-after']); const delay = parseRetryAfter(resp.message.headers['retry-after']);
if (delay === null) { if (delay === null) {
core.debug(`Docker Hub OIDC token request rate limited without retry-after header`);
break; break;
} }
await resp.readBody(); await resp.readBody();
core.info(`Docker Hub OIDC token request rate limited, retrying in ${delay}ms (attempt ${attempt + 1}/${maxRetries})`); core.info(`Docker Hub OIDC token request rate limited, retrying in ${delay}ms (attempt ${attempt + 1}/${maxRetries})`);
await new Promise(resolve => setTimeout(resolve, delay)); await new Promise(resolve => setTimeout(resolve, delay));
resp = await http.post(url, data); resp = await http.post(url, data);
core.debug(`Docker Hub OIDC token request returned status code ${resp.message.statusCode || HttpCodes.InternalServerError}`);
} }
return resp; return resp;
}; };
@@ -111,7 +101,6 @@ const parseRetryAfter = (value: string | string[] | undefined): number | null =>
const handleResponse = async (resp: httpm.HttpClientResponse): Promise<string> => { const handleResponse = async (resp: httpm.HttpClientResponse): Promise<string> => {
const body = await resp.readBody(); const body = await resp.readBody();
const statusCode = resp.message.statusCode || HttpCodes.InternalServerError; const statusCode = resp.message.statusCode || HttpCodes.InternalServerError;
core.debug(`Docker Hub OIDC token response status code: ${statusCode}`);
if (statusCode < HttpCodes.OK || statusCode >= HttpCodes.MultipleChoices) { if (statusCode < HttpCodes.OK || statusCode >= HttpCodes.MultipleChoices) {
throw parseError(statusCode, body); throw parseError(statusCode, body);
} }
+3 -3
View File
@@ -2762,12 +2762,12 @@ __metadata:
linkType: hard linkType: hard
"brace-expansion@npm:^1.1.7": "brace-expansion@npm:^1.1.7":
version: 1.1.16 version: 1.1.17
resolution: "brace-expansion@npm:1.1.16" resolution: "brace-expansion@npm:1.1.17"
dependencies: dependencies:
balanced-match: "npm:^1.0.0" balanced-match: "npm:^1.0.0"
concat-map: "npm:0.0.1" concat-map: "npm:0.0.1"
checksum: 10/94498bead66c51536df5b7bf1b0a0e581a5b7f86888be10481d06920c4bd9d976e003b13a3d19fddc733f21a09d162ff72f90e18b2c9d062b15121e973d0e13b checksum: 10/1e2f59433dee0a52dddb9632b15757131dcc17c7a361089ee367f92b4fd72e9417f5c383d23c000840b41fe87646923519d3ed9f1ccac92930afa1b75d88096f
languageName: node languageName: node
linkType: hard linkType: hard