Single step action - #25834
Conversation
login-action v4.5.0+ exchanges the GitHub OIDC token and signs in to Docker Hub in one step. Co-authored-by: Cursor <cursoragent@cursor.com>
✅ Deploy Preview for docsdocker ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟡 NEEDS ATTENTION
| uses: docker/login-action@v4 # v4.5.0+ | ||
| with: | ||
| username: <YOUR_ORG_NAME> | ||
| env: |
There was a problem hiding this comment.
[MEDIUM] Verify that DOCKERHUB_OIDC_CONNECTIONID is consumed as an environment variable, not a with: input
The example places DOCKERHUB_OIDC_CONNECTIONID in a step-level env: block (sibling of with:), not as a named input inside with:. If docker/login-action v4.5.0+ reads the connection ID via environment variable, the YAML is correct. But if the action expects it as a with: input (e.g., oidc_connection_id:), users following this example will get silent authentication failures.
The PR description and front-matter keywords both reference DOCKERHUB_OIDC_CONNECTIONID, suggesting the env: placement is intentional — but it's worth confirming against the action's v4.5.0 release notes or README before this ships, since users in a security-sensitive OIDC flow will copy-paste this YAML exactly.
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
The changes correctly document the new single-step OIDC login flow using docker/login-action v4.5.0+. The prose is clear and direct, the YAML snippet is well-formed, and no style guide violations (hedge words, meta-commentary, or "allows you to" patterns) were found in the added lines.
The use of docker/login-action@v4 (floating major-version tag) with a # v4.5.0+ inline comment is standard GitHub Actions documentation practice and is supported by the prose that explicitly states "version 4.5.0 or later".
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟡 NEEDS ATTENTION
One medium finding and one low/style finding in the new content. The overall restructuring and documentation of the single-step OIDC login flow is clear and well-written.
| with: | ||
| username: <YOUR_ORGANIZATION_NAME> | ||
| password: ${{ steps.docker_oidc.outputs.token }} | ||
| steps: |
There was a problem hiding this comment.
[MEDIUM] YAML snippet shows permissions and steps as peer keys — missing jobs: context
The example places permissions: and steps: at the same indentation level with no enclosing job block. In a real GitHub Actions workflow, steps: must live inside a named job under jobs:, not as a top-level or sibling key. A user copying this snippet verbatim and adding it as top-level YAML would produce an invalid workflow file.
Consider showing the full minimal job context:
permissions:
contents: read
id-token: write
jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Docker login
uses: docker/login-action@v4 # v4.5.0+
with:
username: <YOUR_ORG_NAME>
env:
DOCKERHUB_OIDC_CONNECTIONID: <YOUR_CONNECTION_ID>Or, if a partial snippet is intentional, add a note such as "Add permissions at the workflow level and the step inside your existing job's steps: list."
|
|
||
| 1. Run your GitHub Action and verify the workflow can sign in to Docker. | ||
| The `username` value must be a Docker organization name. Personal | ||
| accounts are not supported. |
There was a problem hiding this comment.
[LOW] Negative framing — style guide prefers positive language
"Personal accounts are not supported." states what users cannot do. The Docker style guide recommends emphasizing what users can do. Consider:
The
usernamevalue must be a Docker organization name. Only organization accounts can sign in using OIDC.
2 participants
login-action v4.5.0+ exchanges the GitHub OIDC token and signs in to Docker Hub in one step.