chore: update generated content

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

.eslintignore

@@ -0,0 +1,3 @@
+/dist/**
+/coverage/**
+/node_modules/**

.eslintrc.json

@@ -0,0 +1,24 @@
+{
+  "env": {
+    "node": true,
+    "es6": true,
+    "jest": true
+  },
+  "extends": [
+    "eslint:recommended",
+    "plugin:@typescript-eslint/eslint-recommended",
+    "plugin:@typescript-eslint/recommended",
+    "plugin:jest/recommended",
+    "plugin:prettier/recommended"
+  ],
+  "parser": "@typescript-eslint/parser",
+  "parserOptions": {
+    "ecmaVersion": "latest",
+    "sourceType": "module"
+  },
+  "plugins": [
+    "@typescript-eslint",
+    "jest",
+    "prettier"
+  ]
+}

.github/actions/docker-pull/Dockerfile

@@ -1,3 +0,0 @@
-FROM docker:29.3@sha256:4d90f1f6c400315c2dba96d3ec93c01e64198395cbba04f79d12adce4f737029
-
-ENTRYPOINT ["docker"]

.github/actions/docker-pull/action.yml

@@ -1,15 +0,0 @@
-name: Pull Docker image
-
-description: Pull an image from a Docker container action
-
-inputs:
-  image:
-    description: Image reference to pull
-    required: true
-
-runs:
-  using: docker
-  image: Dockerfile
-  args:
-    - pull
-    - ${{ inputs.image }}

.github/dependabot.yml

@@ -4,15 +4,6 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
-    cooldown:
-      default-days: 2
-    groups:
-      crazy-max-dot-github:
-        patterns:
-          - "crazy-max/.github/*"
-      codeql-actions:
-        patterns:
-          - "github/codeql-action/*"
     labels:
       - "dependencies"
       - "bot"
@@ -20,10 +11,6 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
-    cooldown:
-      default-days: 2
-      exclude:
-        - "@docker/actions-toolkit"
     versioning-strategy: "increase"
     groups:
       aws-sdk-dependencies:

.github/workflows/ci.yml

@@ -1,15 +1,9 @@
 name: ci
 
-permissions:
-  contents: read
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-env:
-  GHCR_TEST_IMAGE: ghcr.io/docker/login-action-test:ci-${{ github.sha }}
-
 on:
   workflow_dispatch:
   schedule:
@@ -25,7 +19,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
       -
         name: Stop docker
         run: |
@@ -49,7 +43,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
       -
         name: Login to GitHub Container Registry
         uses: ./
@@ -59,74 +53,44 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
           logout: ${{ matrix.logout }}
 
-  push-ghcr:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      -
-        name: Login to GitHub Container Registry
-        uses: ./
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      -
-        name: Build and push test image
-        run: |
-          docker buildx build --push -t "${GHCR_TEST_IMAGE}" - <<EOF
-          FROM scratch
-          LABEL org.opencontainers.image.title="docker/login-action CI test image"
-          LABEL org.opencontainers.image.description="Empty image used by CI to verify GHCR authentication."
-          LABEL org.opencontainers.image.source="https://github.com/${GITHUB_REPOSITORY}"
-          EOF
-
   dind:
     runs-on: ubuntu-latest
-    needs:
-      - push-ghcr
-    permissions:
-      contents: read
-      packages: read
     env:
       DOCKER_CONFIG: $HOME/.docker
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
       -
         name: Login to GitHub Container Registry
         uses: ./
         with:
           registry: ghcr.io
-          username: ${{ github.actor }}
+          username: ${{ secrets.GHCR_USERNAME }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.GHCR_PAT }}
       -
-        name: Pull test image from Docker CLI container action
+        name: DinD
-        uses: ./.github/actions/docker-pull
+        uses: docker://docker
         with:
-          image: ${{ env.GHCR_TEST_IMAGE }}
+          entrypoint: docker
+          args: pull ghcr.io/docker-ghactiontest/test
       -
-        name: Pull test image
+        name: Pull private image
         run: |
           docker image prune -a -f >/dev/null 2>&1
-          docker pull "${GHCR_TEST_IMAGE}"
+          docker pull ghcr.io/docker-ghactiontest/test
 
   acr:
     runs-on: ubuntu-latest
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
       -
         name: Login to ACR
         uses: ./
         with:
-          registry: officialgithubactions.azurecr.io
+          registry: ${{ secrets.AZURE_REGISTRY_NAME }}.azurecr.io
           username: ${{ secrets.AZURE_CLIENT_ID }}
           password: ${{ secrets.AZURE_CLIENT_SECRET }}
 
@@ -141,57 +105,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
       -
         name: Login to Docker Hub
         uses: ./
         with:
-          username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-  dockerhub-oidc:
-    permissions:
-      contents: read
-      id-token: write
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - ubuntu-latest
-          - windows-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      -
-        name: Login to Docker Hub with OIDC
-        uses: ./
-        env:
-          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
-        with:
-          username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
-
-  registry-auth-oidc:
-    permissions:
-      contents: read
-      id-token: write
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      -
-        name: Login to registries
-        uses: ./
-        env:
-          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
-        with:
-          registry-auth: |
-            - username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
-            - registry: ghcr.io
-              username: ${{ github.actor }}
-              password: ${{ secrets.GITHUB_TOKEN }}
 
   ecr:
     runs-on: ${{ matrix.os }}
@@ -204,12 +124,12 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
       -
         name: Login to ECR
         uses: ./
         with:
-          registry: 175142243308.dkr.ecr.us-east-1.amazonaws.com
+          registry: ${{ secrets.AWS_ACCOUNT_NUMBER }}.dkr.ecr.us-east-1.amazonaws.com
           username: ${{ secrets.AWS_ACCESS_KEY_ID }}
           password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
 
@@ -224,10 +144,10 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
       -
         name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
+        uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -236,34 +156,7 @@ jobs:
         name: Login to ECR
         uses: ./
         with:
-          registry: 175142243308.dkr.ecr.us-east-1.amazonaws.com
+          registry: ${{ secrets.AWS_ACCOUNT_NUMBER }}.dkr.ecr.us-east-1.amazonaws.com
-
-  ecr-oidc:
-    permissions:
-      contents: read
-      id-token: write
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - ubuntu-latest
-          - windows-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      -
-        name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
-        with:
-          role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd_login_action
-          aws-region: us-east-1
-      -
-        name: Login to ECR
-        uses: ./
-        with:
-          registry: 175142243308.dkr.ecr.us-east-1.amazonaws.com
 
   ecr-public:
     runs-on: ${{ matrix.os }}
@@ -276,7 +169,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
       -
         name: Login to Public ECR
         continue-on-error: ${{ matrix.os == 'windows-latest' }}
@@ -299,10 +192,10 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
       -
         name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
+        uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -314,10 +207,7 @@ jobs:
         with:
           registry: public.ecr.aws
 
-  ecr-public-oidc:
+  github-container:
-    permissions:
-      contents: read
-      id-token: write
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -328,32 +218,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
-      -
-        name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
-        with:
-          role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd_login_action
-          aws-region: us-east-1
-      -
-        name: Login to Public ECR
-        continue-on-error: ${{ matrix.os == 'windows-latest' }}
-        uses: ./
-        with:
-          registry: public.ecr.aws
-
-  ghcr:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - ubuntu-latest
-          - windows-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to GitHub Container Registry
         uses: ./
@@ -373,7 +238,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
       -
         name: Login to GitLab
         uses: ./
@@ -393,12 +258,12 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
       -
         name: Login to Google Artifact Registry
         uses: ./
         with:
-          registry: us-east4-docker.pkg.dev
+          registry: ${{ secrets.GAR_LOCATION }}-docker.pkg.dev
           username: _json_key
           password: ${{ secrets.GAR_JSON_KEY }}
 
@@ -413,7 +278,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
       -
         name: Login to Google Container Registry
         uses: ./
@@ -422,19 +287,42 @@ jobs:
           username: _json_key
           password: ${{ secrets.GCR_JSON_KEY }}
 
-  registry-auth:
+  multi:
     runs-on: ubuntu-latest
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
       -
         name: Login to registries
         uses: ./
         with:
-          registry-auth: |
+          registry: ghcr.io
-            - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
+          username: ${{ github.actor }}
-              password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+          logins: |
+            - username: ${{ secrets.DOCKERHUB_USERNAME }}
+              password: ${{ secrets.DOCKERHUB_TOKEN }}
+            - registry: public.ecr.aws
+              username: ${{ secrets.AWS_ACCESS_KEY_ID }}
+              password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+            - registry: registry.gitlab.com
+              username: ${{ secrets.GITLAB_USERNAME }}
+              password: ${{ secrets.GITLAB_TOKEN }}
+
+  multi-logins-only:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Login to registries
+        uses: ./
+        with:
+          logins: |
+            - username: ${{ secrets.DOCKERHUB_USERNAME }}
+              password: ${{ secrets.DOCKERHUB_TOKEN }}
             - registry: ghcr.io
               username: ${{ github.actor }}
               password: ${{ secrets.GITHUB_TOKEN }}
@@ -445,17 +333,17 @@ jobs:
               username: ${{ secrets.GITLAB_USERNAME }}
               password: ${{ secrets.GITLAB_TOKEN }}
 
-  registry-auth-dup:
+  multi-dup:
     runs-on: ubuntu-latest
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
       -
         name: Login to registries
         uses: ./
         with:
-          registry-auth: |
+          logins: |
             - registry: ghcr.io
               username: ${{ github.actor }}
               password: ${{ secrets.GITHUB_TOKEN }}
@@ -465,151 +353,3 @@ jobs:
             - registry: ghcr.io
               username: ${{ github.actor }}
               password: ${{ secrets.GITHUB_TOKEN }}
-
-  registry-auth-exclusive:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      -
-        name: Login to registries
-        id: login
-        continue-on-error: true
-        uses: ./
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-          registry-auth: |
-            - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
-              password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
-      -
-        name: Check
-        run: |
-          if [ "${{ steps.login.outcome }}" != "failure" ] || [ "${{ steps.login.conclusion }}" != "success" ]; then
-            echo "::error::Should have failed"
-            exit 1
-          fi
-
-  scope-dockerhub:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - ubuntu-latest
-          - windows-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      -
-        name: Login to Docker Hub
-        uses: ./
-        with:
-          username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
-          password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
-          scope: '@push'
-      -
-        name: Print config.json files
-        shell: bash
-        run: |
-          shopt -s globstar nullglob
-          for file in ~/.docker/**/config.json; do
-            echo "## ${file}"
-            jq '(.auths[]?.auth) |= "REDACTED"' "$file"
-            echo ""
-          done
-
-  scope-dockerhub-repo:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - ubuntu-latest
-          - windows-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      -
-        name: Login to Docker Hub
-        uses: ./
-        with:
-          username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
-          password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
-          scope: 'docker/buildx-bin@push'
-      -
-        name: Print config.json files
-        shell: bash
-        run: |
-          shopt -s globstar nullglob
-          for file in ~/.docker/**/config.json; do
-            echo "## ${file}"
-            jq '(.auths[]?.auth) |= "REDACTED"' "$file"
-            echo ""
-          done
-
-  scope-ghcr:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - ubuntu-latest
-          - windows-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      -
-        name: Login to GitHub Container Registry
-        uses: ./
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-          scope: '@push'
-      -
-        name: Print config.json files
-        shell: bash
-        run: |
-          shopt -s globstar nullglob
-          for file in ~/.docker/**/config.json; do
-            echo "## ${file}"
-            jq '(.auths[]?.auth) |= "REDACTED"' "$file"
-            echo ""
-          done
-
-  scope-ghcr-repo:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - ubuntu-latest
-          - windows-latest
-    steps:
-      -
-        name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      -
-        name: Login to GitHub Container Registry
-        uses: ./
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-          scope: 'docker/login-action@push'
-      -
-        name: Print config.json files
-        shell: bash
-        run: |
-          shopt -s globstar nullglob
-          for file in ~/.docker/**/config.json; do
-            echo "## ${file}"
-            jq '(.auths[]?.auth) |= "REDACTED"' "$file"
-            echo ""
-          done

.github/workflows/codeql.yml

@@ -1,46 +1,50 @@
 name: codeql
 
-permissions:
-  contents: read
-
 on:
   push:
     branches:
       - 'master'
       - 'releases/v*'
+    paths:
+      - '.github/workflows/codeql.yml'
+      - 'dist/**'
+      - 'src/**'
   pull_request:
+    paths:
+      - '.github/workflows/codeql.yml'
+      - 'dist/**'
+      - 'src/**'
 
-env:
+permissions:
-  NODE_VERSION: "24"
+  actions: read
+  contents: read
+  security-events: write
 
 jobs:
   analyze:
     runs-on: ubuntu-latest
-    permissions:
+    strategy:
-      contents: read
+      fail-fast: false
-      security-events: write
+      matrix:
+        language:
+          - javascript-typescript
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
-      -
-        name: Enable corepack
-        run: |
-          corepack enable
-          yarn --version
-      -
-        name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: ${{ env.NODE_VERSION }}
       -
         name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@v3
         with:
-          languages: javascript-typescript
+          languages: ${{ matrix.language }}
-          build-mode: none
+          config: |
+            paths:
+              - src
+      -
+        name: Autobuild
+        uses: github/codeql-action/autobuild@v3
       -
         name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@v3
         with:
-          category: "/language:javascript-typescript"
+          category: "/language:${{matrix.language}}"

.github/workflows/pr-assign-author.yml

@@ -4,14 +4,14 @@ permissions:
   contents: read
 
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers] safe to use without checkout
+  pull_request_target:
     types:
       - opened
       - reopened
 
 jobs:
   run:
-    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@46267a6e61cd56aac2fc79943df180152f4c89d6 # v1.10.1
+    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@1b673f36fad86812f538c1df9794904038a23cbf
     permissions:
       contents: read
       pull-requests: write

.github/workflows/publish.yml

@@ -1,12 +1,5 @@
 name: publish
 
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 on:
   release:
     types:
@@ -22,7 +15,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
       -
         name: Publish
-        uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4
+        uses: actions/publish-immutable-action@v0.0.4

.github/workflows/test.yml

@@ -1,8 +1,5 @@
 name: test
 
-permissions:
-  contents: read
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -20,16 +17,16 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
       -
         name: Test
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        uses: docker/bake-action@v6
         with:
           source: .
           targets: test
       -
         name: Upload coverage
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@v5
         with:
           files: ./coverage/clover.xml
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/update-dist.yml

@@ -1,58 +0,0 @@
-name: update-dist
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-on:
-  pull_request:
-    types:
-      - opened
-      - synchronize
-
-jobs:
-  update-dist:
-    if: github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: GitHub auth token from GitHub App
-        id: docker-read-app
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          app-id: ${{ secrets.GHACTIONS_REPO_WRITE_APP_ID }}
-          private-key: ${{ secrets.GHACTIONS_REPO_WRITE_APP_PRIVATE_KEY }}
-          owner: docker
-          repositories: login-action
-          permission-contents: write
-      -
-        name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.pull_request.head.ref }}
-          fetch-depth: 0
-          token: ${{ steps.docker-read-app.outputs.token }}
-      -
-        name: Build
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
-        with:
-          source: .
-          targets: build
-      -
-        name: Commit and push dist
-        run: |
-          if [ -n "$(git status --porcelain -- dist)" ]; then
-            (
-              set -x
-              git config user.name "github-actions[bot]"
-              git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-              git add dist
-              git commit -m "[dependabot skip] chore: update generated content"
-              git push
-            )
-          else
-            echo "No changes in dist"
-          fi

.github/workflows/validate.yml

@@ -1,8 +1,5 @@
 name: validate
 
-permissions:
-  contents: read
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -18,15 +15,15 @@ jobs:
   prepare:
     runs-on: ubuntu-latest
     outputs:
-      matrix: ${{ steps.generate.outputs.matrix }}
+      targets: ${{ steps.generate.outputs.targets }}
     steps:
       -
         name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
       -
-        name: Generate matrix
+        name: List targets
         id: generate
-        uses: docker/bake-action/subaction/matrix@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        uses: docker/bake-action/subaction/list-targets@v6
         with:
           target: validate
 
@@ -37,10 +34,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include: ${{ fromJson(needs.prepare.outputs.matrix) }}
+        target: ${{ fromJson(needs.prepare.outputs.targets) }}
     steps:
       -
         name: Validate
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        uses: docker/bake-action@v6
         with:
           targets: ${{ matrix.target }}

.github/workflows/zizmor.yml

@@ -1,29 +0,0 @@
-name: zizmor
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - 'master'
-      - 'releases/v*'
-    tags:
-      - 'v*'
-  pull_request:
-
-jobs:
-  zizmor:
-    uses: crazy-max/.github/.github/workflows/zizmor.yml@46267a6e61cd56aac2fc79943df180152f4c89d6 # v1.10.1
-    permissions:
-      contents: read
-      security-events: write
-    with:
-      min-severity: medium
-      min-confidence: medium
-      persona: pedantic

.prettierrc.json

@@ -6,5 +6,6 @@
   "singleQuote": true,
   "trailingComma": "none",
   "bracketSpacing": false,
-  "arrowParens": "avoid"
+  "arrowParens": "avoid",
+  "parser": "typescript"
 }

.yarnrc.yml

@@ -1,24 +1,13 @@
-# https://yarnpkg.com/configuration/yarnrc
-
-nodeLinker: node-modules
-
 logFilters:
-  - code: YN0004
-    level: discard
   - code: YN0013
     level: discard
   - code: YN0019
     level: discard
   - code: YN0076
     level: discard
-  - code: YN0086
-    level: discard
 
-npmPreapprovedPackages:
+nodeLinker: node-modules
-  - "@docker/actions-toolkit"
 
-compressionLevel: mixed
+plugins:
-enableGlobalCache: false
+  - path: .yarn/plugins/@yarnpkg/plugin-interactive-tools.cjs
-enableHardenedMode: true
+    spec: "@yarnpkg/plugin-interactive-tools"
-enableScripts: false
-npmMinimalAgeGate: 2d

README.md

@@ -24,11 +24,8 @@ ___
   * [OCI Oracle Cloud Infrastructure Registry (OCIR)](#oci-oracle-cloud-infrastructure-registry-ocir)
   * [Quay.io](#quayio)
   * [DigitalOcean](#digitalocean-container-registry)
-  * [Authenticate to multiple registries](#authenticate-to-multiple-registries)
-  * [Set scopes for the authentication token](#set-scopes-for-the-authentication-token)
 * [Customizing](#customizing)
   * [inputs](#inputs)
-  * [environment variables](#environment-variables)
 * [Contributing](#contributing)
 
 ## Usage
@@ -52,42 +49,12 @@ jobs:
     steps:
       -
         name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ vars.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 ```
 
-You can also [authenticate to Docker Hub with OpenID Connect](https://docs.docker.com/enterprise/security/oidc-connections/)
-when your Docker Hub organization has an OIDC connection configured. The
-workflow must grant the `id-token: write` permission, pass the Docker Hub
-organization name as `username`, omit `password`, and set the OIDC connection
-ID in `DOCKERHUB_OIDC_CONNECTIONID` environment variable.
-
-```yaml
-name: ci
-
-on:
-  push:
-    branches: main
-
-permissions:
-  contents: read
-  id-token: write
-
-jobs:
-  login:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Login to Docker Hub
-        uses: docker/login-action@v4
-        env:
-          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
-        with:
-          username: ${{ vars.DOCKERHUB_ORGANIZATION }}
-```
-
 ### GitHub Container Registry
 
 To authenticate to the [GitHub Container Registry](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry),
@@ -107,7 +74,7 @@ jobs:
     steps:
       -
         name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -135,7 +102,7 @@ jobs:
     steps:
       -
         name: Login to GitLab
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: registry.gitlab.com
           username: ${{ vars.GITLAB_USERNAME }}
@@ -148,8 +115,6 @@ instead of a password.
 
 ### Azure Container Registry (ACR)
 
-#### Service principal
-
 [Create a service principal](https://docs.microsoft.com/en-us/azure/container-registry/container-registry-auth-service-principal#create-a-service-principal)
 with access to your container registry through the [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli)
 and take note of the generated service principal's ID (also called _client ID_)
@@ -168,67 +133,17 @@ jobs:
     steps:
       -
         name: Login to ACR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: <registry-name>.azurecr.io
           username: ${{ vars.AZURE_CLIENT_ID }}
           password: ${{ secrets.AZURE_CLIENT_SECRET }}
 ```
 
-> [!NOTE]
-> Replace `<registry-name>` with the name of your registry.
-
-#### OpenID Connect (OIDC)
-
-To authenticate with OpenID Connect, configure a federated identity credential
-for GitHub Actions and use the [Azure Login](https://github.com/Azure/login)
-action to sign in to Azure. Then expose an ACR access token and pass it to this
-action as the password.
-
-```yaml
-name: ci
-
-on:
-  push:
-    branches: main
-
-permissions:
-  contents: read
-  id-token: write
-
-jobs:
-  login:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Login to Azure
-        uses: azure/login@v3
-        with:
-          client-id: ${{ vars.AZURE_CLIENT_ID }}
-          tenant-id: ${{ vars.AZURE_TENANT_ID }}
-          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
-      -
-        name: Get ACR access token
-        id: acr-token
-        run: |
-          ACR_TOKEN=$(az acr login --name <registry-name> --expose-token --output tsv --query accessToken)
-          echo "::add-mask::$ACR_TOKEN" # mask the token in workflow logs
-          echo "token=$ACR_TOKEN" >> "$GITHUB_OUTPUT"
-      -
-        name: Login to ACR
-        uses: docker/login-action@v4
-        with:
-          registry: <registry-name>.azurecr.io
-          username: 00000000-0000-0000-0000-000000000000
-          password: ${{ steps.acr-token.outputs.token }}
-```
-
-> [!NOTE]
 > Replace `<registry-name>` with the name of your registry.
 
 ### Google Container Registry (GCR)
 
-> [!NOTE]
 > [Google Artifact Registry](#google-artifact-registry-gar) is the evolution of
 > Google Container Registry. As a fully-managed service with support for both
 > container images and non-container artifacts. If you currently use Google
@@ -259,24 +174,23 @@ jobs:
     -
       name: Authenticate to Google Cloud
       id: auth
-      uses: google-github-actions/auth@v3
+      uses: google-github-actions/auth@v1
       with:
         token_format: access_token
         workload_identity_provider: <workload_identity_provider>
         service_account: <service_account>
     -
       name: Login to GCR
-      uses: docker/login-action@v4
+      uses: docker/login-action@v3
       with:
         registry: gcr.io
         username: oauth2accesstoken
         password: ${{ steps.auth.outputs.access_token }}
 ```
 
-> [!NOTE]
 > Replace `<workload_identity_provider>` with configured workload identity
 > provider. For steps to configure, [see here](https://github.com/google-github-actions/auth#setting-up-workload-identity-federation).
->
+
 > Replace `<service_account>` with configured service account in workload
 > identity provider which has access to push to GCR
 
@@ -300,7 +214,7 @@ jobs:
     steps:
       -
         name: Login to GCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: gcr.io
           username: _json_key
@@ -331,27 +245,26 @@ jobs:
       -
         name: Authenticate to Google Cloud
         id: auth
-        uses: google-github-actions/auth@v3
+        uses: google-github-actions/auth@v1
         with:
           token_format: access_token
           workload_identity_provider: <workload_identity_provider>
           service_account: <service_account>
       -
         name: Login to GAR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: <location>-docker.pkg.dev
           username: oauth2accesstoken
           password: ${{ steps.auth.outputs.access_token }}
 ```
 
-> [!NOTE]
 > Replace `<workload_identity_provider>` with configured workload identity
 > provider
->
+
 > Replace `<service_account>` with configured service account in workload
 > identity provider which has access to push to GCR
->
+
 > Replace `<location>` with the regional or multi-regional [location](https://cloud.google.com/artifact-registry/docs/repo-organize#locations)
 > of the repository where the image is stored.
 
@@ -376,14 +289,13 @@ jobs:
     steps:
       -
         name: Login to GAR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: <location>-docker.pkg.dev
           username: _json_key
           password: ${{ secrets.GAR_JSON_KEY }}
 ```
 
-> [!NOTE]
 > Replace `<location>` with the regional or multi-regional [location](https://cloud.google.com/artifact-registry/docs/repo-organize#locations)
 > of the repository where the image is stored.
 
@@ -406,7 +318,7 @@ jobs:
     steps:
       -
         name: Login to ECR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: <aws-account-number>.dkr.ecr.<region>.amazonaws.com
           username: ${{ vars.AWS_ACCESS_KEY_ID }}
@@ -429,7 +341,7 @@ jobs:
     steps:
       -
         name: Login to ECR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: <aws-account-number>.dkr.ecr.<region>.amazonaws.com
           username: ${{ vars.AWS_ACCESS_KEY_ID }}
@@ -438,7 +350,6 @@ jobs:
           AWS_ACCOUNT_IDS: 012345678910,023456789012
 ```
 
-> [!NOTE]
 > Only available with [AWS CLI version 1](https://docs.aws.amazon.com/cli/latest/reference/ecr/get-login.html)
 
 You can also use the [Configure AWS Credentials](https://github.com/aws-actions/configure-aws-credentials)
@@ -457,19 +368,18 @@ jobs:
     steps:
       -
         name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-access-key-id: ${{ vars.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: <region>
       -
         name: Login to ECR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: <aws-account-number>.dkr.ecr.<region>.amazonaws.com
 ```
 
-> [!NOTE]
 > Replace `<aws-account-number>` and `<region>` with their respective values.
 
 ### AWS Public Elastic Container Registry (ECR)
@@ -492,7 +402,7 @@ jobs:
     steps:
       -
         name: Login to Public ECR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: public.ecr.aws
           username: ${{ vars.AWS_ACCESS_KEY_ID }}
@@ -501,7 +411,6 @@ jobs:
           AWS_REGION: <region>
 ```
 
-> [!NOTE]
 > Replace `<region>` with its respective value (default `us-east-1`).
 
 ### OCI Oracle Cloud Infrastructure Registry (OCIR)
@@ -527,14 +436,13 @@ jobs:
     steps:
       -
         name: Login to OCIR
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: <region>.ocir.io
           username: ${{ vars.OCI_USERNAME }}
           password: ${{ secrets.OCI_TOKEN }}
 ```
 
-> [!NOTE]
 > Replace `<region>` with their respective values from [availability regions](https://docs.cloud.oracle.com/iaas/Content/Registry/Concepts/registryprerequisites.htm#Availab)
 
 ### Quay.io
@@ -555,7 +463,7 @@ jobs:
     steps:
       -
         name: Login to Quay.io
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: quay.io
           username: ${{ vars.QUAY_USERNAME }}
@@ -579,188 +487,27 @@ jobs:
     steps:
       -
         name: Login to DigitalOcean Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           registry: registry.digitalocean.com
           username: ${{ vars.DIGITALOCEAN_USERNAME }}
           password: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
 ```
 
-### Authenticate to multiple registries
-
-To authenticate against multiple registries, you can specify the login-action
-step multiple times in your workflow:
-
-```yaml
-name: ci
-
-on:
-  push:
-    branches: main
-
-jobs:
-  login:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Login to Docker Hub
-        uses: docker/login-action@v4
-        with:
-          username: ${{ vars.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      -
-        name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-```
-
-You can also use the `registry-auth` input for raw authentication to
-registries, defined as YAML objects. Each object have the same attributes as
-current inputs (except `logout`):
-
-> [!WARNING]
-> We don't recommend using this method, it's better to use the action multiple
-> times as shown above.
-
-```yaml
-name: ci
-
-on:
-  push:
-    branches: main
-
-jobs:
-  login:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Login to registries
-        uses: docker/login-action@v4
-        with:
-          registry-auth: |
-            - username: ${{ vars.DOCKERHUB_USERNAME }}
-              password: ${{ secrets.DOCKERHUB_TOKEN }}
-            - registry: ghcr.io
-              username: ${{ github.actor }}
-              password: ${{ secrets.GITHUB_TOKEN }}
-```
-
-Docker Hub OIDC can also be used with `registry-auth`. Grant `id-token: write`,
-set `DOCKERHUB_OIDC_CONNECTIONID`, pass the Docker Hub organization name as
-`username`, and omit `password` for the Docker Hub object:
-
-```yaml
-name: ci
-
-on:
-  push:
-    branches: main
-
-permissions:
-  contents: read
-  id-token: write
-
-jobs:
-  login:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Login to registries
-        uses: docker/login-action@v4
-        env:
-          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
-        with:
-          registry-auth: |
-            - username: ${{ vars.DOCKERHUB_ORGANIZATION }}
-            - registry: ghcr.io
-              username: ${{ github.actor }}
-              password: ${{ secrets.GITHUB_TOKEN }}
-```
-
-### Set scopes for the authentication token
-
-The `scope` input allows limiting registry credentials to a specific repository
-or namespace scope when building images with Buildx.
-
-This is useful in GitHub Actions to avoid overriding the Docker Hub
-authentication token embedded in GitHub-hosted runners, which is used for
-pulling images without rate limits. By scoping credentials, you can
-authenticate only where needed (typically for pushing), while keeping
-unauthenticated pulls for base images.
-
-When `scope` is set, credentials are written to the Buildx configuration
-instead of the global Docker configuration. This means:
-* Authentication applies only to the specified scope
-* The default Docker Hub credentials remain available for pulls
-* Credentials are used only by Buildx during the build
-
-> [!IMPORTANT]
-> Credentials written to the Buildx configuration are only accessible by Buildx.
-> They are not available to `docker pull`, `docker push`, or any other Docker
-> CLI commands outside Buildx.
-
-> [!NOTE]
-> This feature requires Buildx version 0.31.0 or later.
-
-```yaml
-name: ci
-
-on:
-  push:
-    branches: main
-
-jobs:
-  login:
-    runs-on: ubuntu-latest
-    steps:
-      -
-        name: Login to Docker Hub (scoped)
-        uses: docker/login-action@v4
-        with:
-          username: ${{ vars.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-          scope: 'myorg/myimage@push'
-      -
-        name: Build and push
-        uses: docker/build-push-action@v7
-        with:
-          push: true
-          tags: myorg/myimage:latest
-```
-
-In this example, base images are pulled using the embedded GitHub-hosted runner
-credentials, while authenticated access is used only to push `myorg/myimage`.
-
 ## Customizing
 
 ### inputs
 
 The following inputs can be used as `step.with` keys:
 
-| Name            | Type   | Default     | Description                                                                   |
+| Name       | Type   | Default | Description                                                                   |
-|-----------------|--------|-------------|-------------------------------------------------------------------------------|
+|------------|--------|---------|-------------------------------------------------------------------------------|
-| `registry`      | String | `docker.io` | Server address of Docker registry. If not set then will default to Docker Hub |
+| `registry` | String |         | Server address of Docker registry. If not set then will default to Docker Hub |
-| `username`      | String |             | Username for authenticating to the Docker registry                            |
+| `username` | String |         | Username for authenticating to the Docker registry                            |
-| `password`      | String |             | Password or personal access token for authenticating the Docker registry      |
+| `password` | String |         | Password or personal access token for authenticating the Docker registry      |
-| `scope`         | String |             | Scope for the authentication token                                            |
+| `ecr`      | String | `auto`  | Specifies whether the given registry is ECR (`auto`, `true` or `false`)       |
-| `ecr`           | String | `auto`      | Specifies whether the given registry is ECR (`auto`, `true` or `false`)       |
+| `logout`   | Bool   | `true`  | Log out from the Docker registry at the end of a job                          |
-| `logout`        | Bool   | `true`      | Log out from the Docker registry at the end of a job                          |
+| `logins`   | YAML   |         | Add other registries to authenticate to, defined as YAML objects              |
-| `registry-auth` | YAML   |             | Raw authentication to registries, defined as YAML objects                     |
-
-> [!NOTE]
-> The `registry-auth` input cannot be used with other inputs except `logout`.
-
-### environment variables
-
-The following environment variables can be set as `step.env` keys:
-
-| Name                          | Type   | Default | Description                                                                                        |
-|-------------------------------|--------|---------|----------------------------------------------------------------------------------------------------|
-| `DOCKERHUB_OIDC_CONNECTIONID` | String |         | Docker Hub OIDC connection ID. Required for Docker Hub OIDC login                                  |
-| `DOCKERHUB_OIDC_EXPIREIN`     | Number | `300`   | Docker Hub OIDC token lifetime in seconds. Must be between `300` (5 minutes) and `21600` (6 hours) |
 
 ## Contributing
 

__tests__/aws.test.ts

@@ -1,7 +1,7 @@
-import {beforeEach, describe, expect, test, vi} from 'vitest';
+import {beforeEach, describe, expect, jest, test} from '@jest/globals';
 import {AuthorizationData} from '@aws-sdk/client-ecr';
 
-import * as aws from '../src/aws.js';
+import * as aws from '../src/aws';
 
 describe('isECR', () => {
   test.each([
@@ -11,7 +11,6 @@ describe('isECR', () => {
     ['876820548815.dkr.ecr.cn-north-1.amazonaws.com.cn', true],
     ['390948362332.dkr.ecr.cn-northwest-1.amazonaws.com.cn', true],
     ['012345678901.dkr-ecr.eu-north-1.on.aws', true],
-    ['012345678901.dkr.ecr.eusc-de-east-1.amazonaws.eu', true],
     ['public.ecr.aws', true],
     ['ecr-public.aws.com', true]
   ])('given registry %p', async (registry, expected) => {
@@ -27,7 +26,6 @@ describe('isPubECR', () => {
     ['876820548815.dkr.ecr.cn-north-1.amazonaws.com.cn', false],
     ['390948362332.dkr.ecr.cn-northwest-1.amazonaws.com.cn', false],
     ['012345678901.dkr-ecr.eu-north-1.on.aws', false],
-    ['012345678901.dkr.ecr.eusc-de-east-1.amazonaws.eu', false],
     ['public.ecr.aws', true],
     ['ecr-public.aws.com', true]
   ])('given registry %p', async (registry, expected) => {
@@ -41,7 +39,6 @@ describe('getRegion', () => {
     ['876820548815.dkr.ecr.cn-north-1.amazonaws.com.cn', 'cn-north-1'],
     ['390948362332.dkr.ecr.cn-northwest-1.amazonaws.com.cn', 'cn-northwest-1'],
     ['012345678901.dkr-ecr.eu-north-1.on.aws', 'eu-north-1'],
-    ['012345678901.dkr.ecr.eusc-de-east-1.amazonaws.eu', 'eusc-de-east-1'],
     ['public.ecr.aws', 'us-east-1']
   ])('given registry %p', async (registry, expected) => {
     expect(aws.getRegion(registry)).toEqual(expected);
@@ -55,7 +52,6 @@ describe('getAccountIDs', () => {
     ['012345678901.dkr.ecr.eu-west-3.amazonaws.com', '012345678901,012345678910,023456789012', ['012345678901', '012345678910', '023456789012']],
     ['390948362332.dkr.ecr.cn-northwest-1.amazonaws.com.cn', '012345678910,023456789012', ['390948362332', '012345678910', '023456789012']],
     ['876820548815.dkr-ecr.eu-north-1.on.aws', '012345678910,023456789012', ['876820548815', '012345678910', '023456789012']],
-    ['012345678901.dkr.ecr.eusc-de-east-1.amazonaws.eu', '012345678910,023456789012', ['012345678901', '012345678910', '023456789012']],
     ['public.ecr.aws', undefined, []]
   ])('given registry %p', async (registry, accountIDsEnv, expected) => {
     if (accountIDsEnv) {
@@ -65,28 +61,26 @@ describe('getAccountIDs', () => {
   });
 });
 
-const mockEcrGetAuthToken = vi.fn();
+const mockEcrGetAuthToken = jest.fn();
-const mockEcrPublicGetAuthToken = vi.fn();
+const mockEcrPublicGetAuthToken = jest.fn();
-vi.mock('@aws-sdk/client-ecr', () => {
+jest.mock('@aws-sdk/client-ecr', () => {
-  class ECR {
-    getAuthorizationToken = mockEcrGetAuthToken;
-  }
   return {
-    ECR
+    ECR: jest.fn(() => ({
+      getAuthorizationToken: mockEcrGetAuthToken
+    }))
   };
 });
-vi.mock('@aws-sdk/client-ecr-public', () => {
+jest.mock('@aws-sdk/client-ecr-public', () => {
-  class ECRPUBLIC {
-    getAuthorizationToken = mockEcrPublicGetAuthToken;
-  }
   return {
-    ECRPUBLIC
+    ECRPUBLIC: jest.fn(() => ({
+      getAuthorizationToken: mockEcrPublicGetAuthToken
+    }))
   };
 });
 
 describe('getRegistriesData', () => {
   beforeEach(() => {
-    vi.clearAllMocks();
+    jest.clearAllMocks();
     delete process.env.AWS_ACCOUNT_IDS;
   });
   // prettier-ignore

__tests__/context.test.ts

@@ -1,18 +1,6 @@
-import {afterEach, expect, test, vi} from 'vitest';
+import {expect, test} from '@jest/globals';
-import * as path from 'path';
 
-import {Buildx} from '@docker/actions-toolkit/lib/buildx/buildx.js';
+import {getInputs} from '../src/context';
-
-import {getAuthList, getInputs} from '../src/context.js';
-
-afterEach(() => {
-  vi.restoreAllMocks();
-  for (const key of Object.keys(process.env)) {
-    if (key.startsWith('INPUT_')) {
-      delete process.env[key];
-    }
-  }
-});
 
 test('with password and username getInputs does not throw error', async () => {
   process.env['INPUT_USERNAME'] = 'dbowie';
@@ -22,149 +10,3 @@ test('with password and username getInputs does not throw error', async () => {
     getInputs();
   }).not.toThrow();
 });
-
-test('getAuthList uses the default Docker Hub registry when computing scoped config dir', async () => {
-  process.env['INPUT_USERNAME'] = 'dbowie';
-  process.env['INPUT_PASSWORD'] = 'groundcontrol';
-  process.env['INPUT_SCOPE'] = 'myscope';
-  process.env['INPUT_LOGOUT'] = 'false';
-  const [auth] = getAuthList(getInputs());
-  expect(auth).toMatchObject({
-    registry: 'docker.io',
-    configDir: path.join(Buildx.configDir, 'config', 'registry-1.docker.io', 'myscope')
-  });
-});
-
-test('getAuthList supports @ scopes appended to the registry config dir', async () => {
-  process.env['INPUT_USERNAME'] = 'dbowie';
-  process.env['INPUT_PASSWORD'] = 'groundcontrol';
-  process.env['INPUT_SCOPE'] = '@push';
-  process.env['INPUT_LOGOUT'] = 'false';
-  const [auth] = getAuthList(getInputs());
-  expect(auth).toMatchObject({
-    configDir: path.join(Buildx.configDir, 'config', 'registry-1.docker.io') + '@push'
-  });
-});
-
-test('getAuthList supports repository scopes with appended actions', async () => {
-  process.env['INPUT_USERNAME'] = 'dbowie';
-  process.env['INPUT_PASSWORD'] = 'groundcontrol';
-  process.env['INPUT_SCOPE'] = 'docker/buildx-bin@push';
-  process.env['INPUT_LOGOUT'] = 'false';
-  const [auth] = getAuthList(getInputs());
-  expect(auth).toMatchObject({
-    configDir: path.join(Buildx.configDir, 'config', 'registry-1.docker.io', 'docker', 'buildx-bin@push')
-  });
-});
-
-test('getAuthList supports comma-separated scope actions', async () => {
-  process.env['INPUT_USERNAME'] = 'dbowie';
-  process.env['INPUT_PASSWORD'] = 'groundcontrol';
-  process.env['INPUT_SCOPE'] = 'docker/buildx-bin@pull,push';
-  process.env['INPUT_LOGOUT'] = 'false';
-  const [auth] = getAuthList(getInputs());
-  expect(auth).toMatchObject({
-    configDir: path.join(Buildx.configDir, 'config', 'registry-1.docker.io', 'docker', 'buildx-bin@pull,push')
-  });
-});
-
-// prettier-ignore
-test.each([
-  '../../../../work/leaked',
-  '..',
-  'foo/../../../../etc',
-  '@../../../leaked',
-  'foo/bar@../../../leaked',
-  '@push@pull',
-  'foo/bar@push@pull',
-  '@push,',
-  '@,push',
-  '@pull,,push',
-  '@Push',
-  path.join(path.parse(Buildx.configDir).root, 'work', 'leaked')
-])('getAuthList rejects unsafe or unsupported scope path: %s', async scope => {
-  expect(() => {
-    getAuthList({
-      registry: '',
-      username: 'dbowie',
-      password: 'groundcontrol',
-      scope,
-      ecr: '',
-      logout: false,
-      registryAuth: ''
-    });
-  }).toThrow(/Invalid scope/);
-});
-
-// prettier-ignore
-test.each([
-  '../../../../work/leaked',
-  '..',
-  'foo/../../../../etc',
-  path.join(path.parse(Buildx.configDir).root, 'work', 'leaked')
-])('getAuthList rejects unsafe registry path: %s', async registry => {
-  expect(() => {
-    getAuthList({
-      registry,
-      username: 'dbowie',
-      password: 'groundcontrol',
-      scope: '@push',
-      ecr: '',
-      logout: false,
-      registryAuth: ''
-    });
-  }).toThrow(/Invalid registry/);
-});
-
-test('getAuthList skips secret masking when registry-auth password is absent', async () => {
-  const stdoutWriteSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
-  const [auth] = getAuthList({
-    registry: '',
-    username: '',
-    password: '',
-    scope: '',
-    ecr: '',
-    logout: true,
-    registryAuth: '- registry: public.ecr.aws\n'
-  });
-
-  expect(stdoutWriteSpy.mock.calls.map(call => call[0]).join('')).not.toContain('::add-mask::');
-  expect(auth).toMatchObject({
-    registry: 'public.ecr.aws',
-    ecr: 'auto'
-  });
-});
-
-test('getAuthList supports password-less Docker Hub registry-auth for OIDC', async () => {
-  const [auth] = getAuthList({
-    registry: '',
-    username: '',
-    password: '',
-    scope: '',
-    ecr: '',
-    logout: true,
-    registryAuth: '- username: docker-org\n'
-  });
-
-  expect(auth).toMatchObject({
-    registry: 'docker.io',
-    username: 'docker-org',
-    password: undefined,
-    ecr: 'auto'
-  });
-});
-
-test('getAuthList masks registry-auth password when present', async () => {
-  const stdoutWriteSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
-  getAuthList({
-    registry: '',
-    username: '',
-    password: '',
-    scope: '',
-    ecr: '',
-    logout: true,
-    registryAuth: '- registry: ghcr.io\n  username: dbowie\n  password: groundcontrol\n'
-  });
-
-  expect(stdoutWriteSpy.mock.calls.map(call => call[0]).join('')).toContain('::add-mask::groundcontrol');
-});

__tests__/docker.test.ts

@@ -1,17 +1,16 @@
-import {afterEach, expect, test, vi} from 'vitest';
+import {expect, jest, test} from '@jest/globals';
+import * as path from 'path';
 
-import {Docker} from '@docker/actions-toolkit/lib/docker/docker.js';
+import {loginStandard, logout} from '../src/docker';
 
-import {login, loginStandard, logout} from '../src/docker.js';
+import {Docker} from '@docker/actions-toolkit/lib/docker/docker';
-import * as dockerhub from '../src/dockerhub.js';
 
-afterEach(() => {
+process.env['RUNNER_TEMP'] = path.join(__dirname, 'runner');
-  vi.restoreAllMocks();
-  delete process.env.DOCKERHUB_OIDC_CONNECTIONID;
-});
 
 test('loginStandard calls exec', async () => {
-  const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
+  // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+  // @ts-ignore
+  const execSpy = jest.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
     return {
       exitCode: expect.any(Number),
       stdout: expect.any(Function),
@@ -38,39 +37,10 @@ test('loginStandard calls exec', async () => {
   });
 });
 
-test('login exchanges Docker Hub OIDC token for password-less auth', async () => {
-  process.env.DOCKERHUB_OIDC_CONNECTIONID = '123e4567-e89b-42d3-a456-426614174000';
-  const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
-    return {
-      exitCode: 0,
-      stdout: '',
-      stderr: ''
-    };
-  });
-  const oidcSpy = vi.spyOn(dockerhub, 'getOIDCToken').mockResolvedValue({
-    username: 'docker-org',
-    token: 'hub-token'
-  });
-
-  await login({
-    registry: 'docker.io',
-    username: 'docker-org',
-    password: '',
-    scope: '',
-    ecr: 'auto',
-    configDir: ''
-  });
-
-  expect(oidcSpy).toHaveBeenCalledWith('docker.io', 'docker-org');
-  expect(execSpy).toHaveBeenCalledWith(['login', '--password-stdin', '--username', 'docker-org', 'docker.io'], {
-    input: Buffer.from('hub-token'),
-    silent: true,
-    ignoreReturnCode: true
-  });
-});
-
 test('logout calls exec', async () => {
-  const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
+  // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+  // @ts-ignore
+  const execSpy = jest.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
     return {
       exitCode: expect.any(Number),
       stdout: expect.any(Function),
@@ -80,7 +50,7 @@ test('logout calls exec', async () => {
 
   const registry = 'https://ghcr.io';
 
-  await logout(registry, '');
+  await logout(registry);
 
   expect(execSpy).toHaveBeenCalledTimes(1);
   const callfunc = execSpy.mock.calls[0];

__tests__/dockerhub.test.ts

@@ -1,149 +0,0 @@
-import * as core from '@actions/core';
-import * as httpm from '@actions/http-client';
-import {beforeEach, describe, expect, test, vi} from 'vitest';
-
-import * as dockerhub from '../src/dockerhub.js';
-
-vi.mock('@actions/core', () => ({
-  debug: vi.fn(),
-  getIDToken: vi.fn(),
-  info: vi.fn(),
-  setSecret: vi.fn()
-}));
-
-const validConnectionID = '123e4567-e89b-42d3-a456-426614174000';
-
-const httpResponse = (statusCode: number, body: string, headers: Record<string, string> = {}): httpm.HttpClientResponse => {
-  return {
-    message: {
-      statusCode,
-      headers
-    },
-    readBody: vi.fn(async () => body)
-  } as unknown as httpm.HttpClientResponse;
-};
-
-describe('isDockerHubOIDC', () => {
-  beforeEach(() => {
-    delete process.env.DOCKERHUB_OIDC_CONNECTIONID;
-  });
-
-  test.each(['', 'docker.io', 'registry-1.docker.io', 'registry-1-stage.docker.io'])('detects Docker Hub registry %p with empty password', registry => {
-    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
-    expect(dockerhub.isDockerHubOIDC(registry, '')).toBe(true);
-  });
-
-  test('requires connection ID env var', () => {
-    expect(dockerhub.isDockerHubOIDC('docker.io', '')).toBe(false);
-  });
-
-  test('requires empty password', () => {
-    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
-    expect(dockerhub.isDockerHubOIDC('docker.io', 'groundcontrol')).toBe(false);
-  });
-
-  test('ignores non-Docker Hub registries', () => {
-    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
-    expect(dockerhub.isDockerHubOIDC('ghcr.io', '')).toBe(false);
-  });
-});
-
-describe('getOIDCToken', () => {
-  const getIDTokenMock = vi.mocked(core.getIDToken);
-  const setSecretMock = vi.mocked(core.setSecret);
-  let postSpy: ReturnType<typeof vi.spyOn>;
-
-  beforeEach(() => {
-    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
-    delete process.env.DOCKERHUB_OIDC_EXPIREIN;
-    getIDTokenMock.mockResolvedValue('github-id-token');
-    postSpy = vi.spyOn(httpm.HttpClient.prototype, 'post').mockResolvedValue(httpResponse(200, JSON.stringify({access_token: 'hub-token'})));
-  });
-
-  test('exchanges GitHub OIDC token for Docker Hub token', async () => {
-    const credentials = await dockerhub.getOIDCToken('docker.io', 'dbowie');
-
-    expect(credentials).toEqual({
-      username: 'dbowie',
-      token: 'hub-token'
-    });
-    expect(getIDTokenMock).toHaveBeenCalledWith('https://identity.docker.com');
-    expect(postSpy).toHaveBeenCalledTimes(1);
-    expect(postSpy.mock.calls[0][0]).toBe('https://identity.docker.com/oauth/token');
-
-    const http = postSpy.mock.contexts[0] as httpm.HttpClient;
-    expect(http.userAgent).toBe('github.com/docker/login-action');
-    expect(http.requestOptions?.headers).toEqual({
-      'Content-Type': 'application/x-www-form-urlencoded'
-    });
-
-    const body = new URLSearchParams(postSpy.mock.calls[0][1]);
-    expect(body.get('grant_type')).toBe('urn:ietf:params:oauth:grant-type:token-exchange');
-    expect(body.get('subject_token_type')).toBe('urn:ietf:params:oauth:token-type:id_token');
-    expect(body.get('subject_token')).toBe('github-id-token');
-    expect(body.get('connection_id')).toBe(validConnectionID);
-    expect(body.get('expires_in')).toBe('300');
-    expect(setSecretMock).toHaveBeenCalledWith('hub-token');
-    expect(core.info).toHaveBeenCalledWith('Docker Hub OIDC detected for docker.io');
-    expect(core.info).toHaveBeenCalledWith('Retrieving GitHub OIDC token for Docker Hub');
-    expect(core.info).toHaveBeenCalledWith('Exchanging GitHub OIDC token for Docker Hub token');
-    expect(core.info).toHaveBeenCalledWith('Docker Hub OIDC token exchange succeeded');
-    expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token audience: https://identity.docker.com');
-    expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token expiration: 300s');
-    expect(core.debug).toHaveBeenCalledWith('Sending Docker Hub OIDC token request to https://identity.docker.com/oauth/token');
-    expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token request returned status code 200');
-    expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token response status code: 200');
-  });
-
-  test('uses custom token expiration', async () => {
-    process.env.DOCKERHUB_OIDC_EXPIREIN = '21600';
-    await dockerhub.getOIDCToken('docker.io', 'dbowie');
-    const body = new URLSearchParams(postSpy.mock.calls[0][1]);
-    expect(body.get('expires_in')).toBe('21600');
-  });
-
-  test('uses stage identity host for stage registry', async () => {
-    await dockerhub.getOIDCToken('registry-1-stage.docker.io', 'dbowie');
-    expect(getIDTokenMock).toHaveBeenCalledWith('https://identity-stage.docker.com');
-    expect(postSpy.mock.calls[0][0]).toBe('https://identity-stage.docker.com/oauth/token');
-  });
-
-  test('requires connection ID env var', async () => {
-    delete process.env.DOCKERHUB_OIDC_CONNECTIONID;
-    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('DOCKERHUB_OIDC_CONNECTIONID is required for Docker Hub OIDC login');
-    expect(getIDTokenMock).not.toHaveBeenCalled();
-    expect(postSpy).not.toHaveBeenCalled();
-  });
-
-  test('validates connection ID', async () => {
-    process.env.DOCKERHUB_OIDC_CONNECTIONID = 'not-a-uuid';
-    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('Invalid DOCKERHUB_OIDC_CONNECTIONID. Must be a valid UUID.');
-    expect(getIDTokenMock).not.toHaveBeenCalled();
-    expect(postSpy).not.toHaveBeenCalled();
-  });
-
-  test.each(['not-a-number', '299', '21601'])('validates token expiration %p', async expiresIn => {
-    process.env.DOCKERHUB_OIDC_EXPIREIN = expiresIn;
-    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow(`Invalid DOCKERHUB_OIDC_EXPIREIN: ${expiresIn}. Must be between 300 and 21600`);
-    expect(getIDTokenMock).not.toHaveBeenCalled();
-    expect(postSpy).not.toHaveBeenCalled();
-  });
-
-  test('retries rate limited token requests with Retry-After', async () => {
-    postSpy.mockResolvedValueOnce(httpResponse(429, '', {'retry-after': '0'})).mockResolvedValueOnce(httpResponse(200, JSON.stringify({access_token: 'hub-token'})));
-    await dockerhub.getOIDCToken('docker.io', 'dbowie');
-    expect(postSpy).toHaveBeenCalledTimes(2);
-    expect(core.info).toHaveBeenCalledWith('Docker Hub OIDC token request rate limited, retrying in 0ms (attempt 1/5)');
-  });
-
-  test('throws Docker Hub OIDC error responses', async () => {
-    postSpy.mockResolvedValue(httpResponse(400, JSON.stringify({error: 'invalid_request', error_description: 'bad connection', error_uri: 'https://docs.docker.com'})));
-    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('Docker Hub API: bad status code 400: {"error":"invalid_request","error_description":"bad connection","error_uri":"https://docs.docker.com"}');
-  });
-
-  test('throws rate limited Docker Hub OIDC error response after retries', async () => {
-    postSpy.mockResolvedValue(httpResponse(429, JSON.stringify({error: 'rate_limited', error_description: 'slow down'}), {'retry-after': '0'}));
-    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('Docker Hub API: bad status code 429: {"error":"rate_limited","error_description":"slow down"}');
-    expect(postSpy).toHaveBeenCalledTimes(6);
-  });
-});

__tests__/setup.unit.ts

@@ -1,12 +0,0 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-
-const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'docker-login-action-'));
-
-process.env = Object.assign({}, process.env, {
-  TEMP: tmpDir,
-  GITHUB_REPOSITORY: 'docker/login-action',
-  RUNNER_TEMP: path.join(tmpDir, 'runner-temp'),
-  RUNNER_TOOL_CACHE: path.join(tmpDir, 'runner-tool-cache')
-});

action.yml

@@ -18,19 +18,17 @@ inputs:
     required: false
   ecr:
     description: 'Specifies whether the given registry is ECR (auto, true or false)'
-    required: false
+    default: 'auto'
-  scope:
-    description: 'Scope for the authentication token'
     required: false
   logout:
     description: 'Log out from the Docker registry at the end of a job'
     default: 'true'
     required: false
-  registry-auth:
+  logins:
-    description: 'Raw authentication to registries, defined as YAML objects'
+    description: 'Add other registries to authenticate to, defined as YAML objects'
     required: false
 
 runs:
-  using: 'node24'
+  using: 'node20'
-  main: 'dist/index.cjs'
+  main: 'dist/index.js'
-  post: 'dist/index.cjs'
+  post: 'dist/index.js'

dev.Dockerfile

@@ -1,13 +1,12 @@
 # syntax=docker/dockerfile:1
 
-ARG NODE_VERSION=24
+ARG NODE_VERSION=20
 
 FROM node:${NODE_VERSION}-alpine AS base
-RUN apk add --no-cache cpio findutils git rsync
+RUN apk add --no-cache cpio findutils git
 WORKDIR /src
 RUN --mount=type=bind,target=.,rw \
   --mount=type=cache,target=/src/.yarn/cache <<EOT
-  set -e
   corepack enable
   yarn --version
   yarn config set --home enableTelemetry 0
@@ -17,7 +16,7 @@ FROM base AS deps
 RUN --mount=type=bind,target=.,rw \
   --mount=type=cache,target=/src/.yarn/cache \
   --mount=type=cache,target=/src/node_modules \
-  yarn install --immutable && mkdir /vendor && cp yarn.lock /vendor
+  yarn install && mkdir /vendor && cp yarn.lock /vendor
 
 FROM scratch AS vendor-update
 COPY --from=deps /vendor /
@@ -35,27 +34,18 @@ RUN --mount=type=bind,target=.,rw <<EOT
 EOT
 
 FROM deps AS build
-RUN --mount=target=/context \
+RUN --mount=type=bind,target=.,rw \
   --mount=type=cache,target=/src/.yarn/cache \
-  --mount=type=cache,target=/src/node_modules <<EOT
+  --mount=type=cache,target=/src/node_modules \
-  set -e
+  yarn run build && mkdir /out && cp -Rf dist /out/
-  rsync -a /context/. .
-  rm -rf dist
-  yarn run build
-  mkdir /out
-  cp -r dist /out
-EOT
 
 FROM scratch AS build-update
 COPY --from=build /out /
 
 FROM build AS build-validate
-RUN --mount=target=/context \
+RUN --mount=type=bind,target=.,rw <<EOT
-  --mount=target=.,type=tmpfs <<EOT
   set -e
-  rsync -a /context/. .
   git add -A
-  rm -rf dist
   cp -rf /out/* .
   if [ -n "$(git status --porcelain -- dist)" ]; then
     echo >&2 'ERROR: Build result differs. Please build first with "docker buildx bake build"'
@@ -68,7 +58,8 @@ FROM deps AS format
 RUN --mount=type=bind,target=.,rw \
   --mount=type=cache,target=/src/.yarn/cache \
   --mount=type=cache,target=/src/node_modules \
-  yarn run format && mkdir /out && find . -name '*.ts' -not -path './node_modules/*' -not -path './.yarn/*' | cpio -pdm /out
+  yarn run format \
+  && mkdir /out && find . -name '*.ts' -not -path './node_modules/*' -not -path './.yarn/*' | cpio -pdm /out
 
 FROM scratch AS format-update
 COPY --from=format /out /
@@ -85,7 +76,7 @@ ENV RUNNER_TOOL_CACHE=/tmp/github_tool_cache
 RUN --mount=type=bind,target=.,rw \
   --mount=type=cache,target=/src/.yarn/cache \
   --mount=type=cache,target=/src/node_modules \
-  yarn run test --coverage --coverage.reportsDirectory=/tmp/coverage
+  yarn run test --coverage --coverageDirectory=/tmp/coverage
 
 FROM scratch AS test-coverage
 COPY --from=test /tmp/coverage /

eslint.config.mjs

@@ -1,52 +0,0 @@
-import {defineConfig} from 'eslint/config';
-import js from '@eslint/js';
-import tseslint from '@typescript-eslint/eslint-plugin';
-import vitest from '@vitest/eslint-plugin';
-import globals from 'globals';
-import eslintConfigPrettier from 'eslint-config-prettier/flat';
-import eslintPluginPrettier from 'eslint-plugin-prettier';
-
-export default defineConfig([
-  {
-    ignores: ['.yarn/**/*', 'coverage/**/*', 'dist/**/*']
-  },
-  js.configs.recommended,
-  ...tseslint.configs['flat/recommended'],
-  eslintConfigPrettier,
-  {
-    languageOptions: {
-      globals: {
-        ...globals.node
-      }
-    }
-  },
-  {
-    files: ['__tests__/**'],
-    ...vitest.configs.recommended,
-    languageOptions: {
-      globals: {
-        ...globals.node,
-        ...vitest.environments.env.globals
-      }
-    },
-    rules: {
-      ...vitest.configs.recommended.rules,
-      'vitest/no-conditional-expect': 'error',
-      'vitest/no-disabled-tests': 0
-    }
-  },
-  {
-    plugins: {
-      prettier: eslintPluginPrettier
-    },
-    rules: {
-      'prettier/prettier': 'error',
-      '@typescript-eslint/no-require-imports': [
-        'error',
-        {
-          allowAsImport: true
-        }
-      ]
-    }
-  }
-]);

jest.config.ts

@@ -0,0 +1,30 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+
+const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'docker-login-action-')).split(path.sep).join(path.posix.sep);
+
+process.env = Object.assign({}, process.env, {
+  TEMP: tmpDir,
+  GITHUB_REPOSITORY: 'docker/login-action',
+  RUNNER_TEMP: path.join(tmpDir, 'runner-temp').split(path.sep).join(path.posix.sep),
+  RUNNER_TOOL_CACHE: path.join(tmpDir, 'runner-tool-cache').split(path.sep).join(path.posix.sep)
+}) as {
+  [key: string]: string;
+};
+
+module.exports = {
+  clearMocks: true,
+  testEnvironment: 'node',
+  moduleFileExtensions: ['js', 'ts'],
+  testMatch: ['**/*.test.ts'],
+  transform: {
+    '^.+\\.ts$': 'ts-jest'
+  },
+  moduleNameMapper: {
+    '^csv-parse/sync': '<rootDir>/node_modules/csv-parse/dist/cjs/sync.cjs'
+  },
+  collectCoverageFrom: ['src/**/{!(main.ts),}.ts'],
+  coveragePathIgnorePatterns: ['lib/', 'node_modules/', '__tests__/'],
+  verbose: true
+};

package.json

@@ -1,14 +1,16 @@
 {
   "name": "docker-login",
   "description": "GitHub Action to login against a Docker registry",
-  "type": "module",
   "main": "src/main.ts",
   "scripts": {
-    "build": "esbuild src/main.ts --bundle --platform=node --target=node24 --format=cjs --outfile=dist/index.cjs --sourcemap --minify --keep-names && yarn run license",
+    "build": "ncc build --source-map --minify --license licenses.txt",
-    "lint": "eslint --max-warnings=0 .",
+    "lint": "yarn run prettier && yarn run eslint",
-    "format": "eslint --fix .",
+    "format": "yarn run prettier:fix && yarn run eslint:fix",
-    "test": "vitest run",
+    "eslint": "eslint --max-warnings=0 .",
-    "license": "generate-license-file --input package.json --output dist/licenses.txt --overwrite --ci --no-spinner --eol lf"
+    "eslint:fix": "eslint --fix .",
+    "prettier": "prettier --check \"./**/*.ts\"",
+    "prettier:fix": "prettier --write \"./**/*.ts\"",
+    "test": "jest"
   },
   "repository": {
     "type": "git",
@@ -21,34 +23,30 @@
   ],
   "author": "Docker Inc.",
   "license": "Apache-2.0",
-  "packageManager": "yarn@4.15.0",
+  "packageManager": "yarn@3.6.3",
   "dependencies": {
-    "@actions/core": "^3.0.1",
+    "@actions/core": "^1.11.1",
-    "@actions/http-client": "^4.0.1",
+    "@aws-sdk/client-ecr": "^3.859.0",
-    "@aws-sdk/client-ecr": "^3.1095.0",
+    "@aws-sdk/client-ecr-public": "^3.859.0",
-    "@aws-sdk/client-ecr-public": "^3.1095.0",
+    "@docker/actions-toolkit": "^0.62.1",
-    "@docker/actions-toolkit": "^0.94.0",
+    "http-proxy-agent": "^7.0.2",
-    "http-proxy-agent": "^9.1.0",
+    "https-proxy-agent": "^7.0.6",
-    "https-proxy-agent": "^9.1.0",
+    "js-yaml": "^4.1.0"
-    "js-yaml": "^5.2.2",
-    "uuid": "^14.0.1"
   },
   "devDependencies": {
-    "@eslint/js": "^9.39.3",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^24.11.0",
+    "@types/node": "^20.12.12",
-    "@typescript-eslint/eslint-plugin": "^8.56.1",
+    "@typescript-eslint/eslint-plugin": "^7.9.0",
-    "@typescript-eslint/parser": "^8.56.1",
+    "@typescript-eslint/parser": "^7.9.0",
-    "@vitest/coverage-v8": "^4.0.18",
+    "@vercel/ncc": "^0.38.1",
-    "@vitest/eslint-plugin": "^1.6.9",
+    "eslint": "^8.57.0",
-    "esbuild": "^0.28.0",
+    "eslint-config-prettier": "^9.1.0",
-    "eslint": "^9.39.3",
+    "eslint-plugin-jest": "^28.5.0",
-    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-prettier": "^5.1.3",
-    "eslint-plugin-prettier": "^5.5.5",
+    "jest": "^29.7.0",
-    "generate-license-file": "^4.1.1",
+    "prettier": "^3.2.5",
-    "globals": "^17.3.0",
+    "ts-jest": "^29.1.2",
-    "prettier": "^3.8.1",
+    "ts-node": "^10.9.2",
-    "typescript": "^5.9.3",
+    "typescript": "^5.4.5"
-    "vitest": "^4.0.18"
   }
 }

src/aws.ts

@@ -5,7 +5,7 @@ import {NodeHttpHandler} from '@smithy/node-http-handler';
 import {HttpProxyAgent} from 'http-proxy-agent';
 import {HttpsProxyAgent} from 'https-proxy-agent';
 
-const ecrRegistryRegex = /^(([0-9]{12})\.(dkr\.ecr|dkr-ecr)\.(.+)\.(on\.aws|amazonaws\.(com(.cn)?|eu)))(\/([^:]+)(:.+)?)?$/;
+const ecrRegistryRegex = /^(([0-9]{12})\.(dkr\.ecr|dkr-ecr)\.(.+)\.(on\.aws|amazonaws\.com(.cn)?))(\/([^:]+)(:.+)?)?$/;
 const ecrPublicRegistryRegex = /public\.ecr\.aws|ecr-public\.aws\.com/;
 
 export const isECR = (registry: string): boolean => {

src/context.ts

@@ -1,27 +1,12 @@
-import path from 'path';
 import * as core from '@actions/core';
-import * as yaml from 'js-yaml';
-
-import {Buildx} from '@docker/actions-toolkit/lib/buildx/buildx.js';
-import {Util} from '@docker/actions-toolkit/lib/util.js';
 
 export interface Inputs {
   registry: string;
   username: string;
   password: string;
-  scope: string;
   ecr: string;
   logout: boolean;
-  registryAuth: string;
+  logins: string;
-}
-
-export interface Auth {
-  registry: string;
-  username: string;
-  password: string;
-  scope: string;
-  ecr: string;
-  configDir: string;
 }
 
 export function getInputs(): Inputs {
@@ -29,86 +14,8 @@ export function getInputs(): Inputs {
     registry: core.getInput('registry'),
     username: core.getInput('username'),
     password: core.getInput('password'),
-    scope: core.getInput('scope'),
     ecr: core.getInput('ecr'),
     logout: core.getBooleanInput('logout'),
-    registryAuth: core.getInput('registry-auth')
+    logins: core.getInput('logins')
   };
 }
-
-export function getAuthList(inputs: Inputs): Array<Auth> {
-  if (inputs.registryAuth && (inputs.registry || inputs.username || inputs.password || inputs.scope || inputs.ecr)) {
-    throw new Error('Cannot use registry-auth with other inputs');
-  }
-  let auths: Array<Auth> = [];
-  if (!inputs.registryAuth) {
-    const registry = inputs.registry || 'docker.io';
-    auths.push({
-      registry,
-      username: inputs.username,
-      password: inputs.password,
-      scope: inputs.scope,
-      ecr: inputs.ecr || 'auto',
-      configDir: scopeToConfigDir(registry, inputs.scope)
-    });
-  } else {
-    auths = (yaml.load(inputs.registryAuth) as Array<Auth>).map(auth => {
-      if (auth.password) {
-        core.setSecret(auth.password); // redacted in workflow logs
-      }
-      const registry = auth.registry || 'docker.io';
-      return {
-        registry,
-        username: auth.username,
-        password: auth.password,
-        scope: auth.scope,
-        ecr: auth.ecr || 'auto',
-        configDir: scopeToConfigDir(registry, auth.scope)
-      };
-    });
-  }
-  if (auths.length == 0) {
-    throw new Error('No registry to login');
-  }
-  return auths;
-}
-
-export function scopeToConfigDir(registry: string, scope?: string): string {
-  if (scopeDisabled() || !scope || scope === '') {
-    return '';
-  }
-  const configRoot = path.resolve(Buildx.configDir, 'config');
-  const registryDir = path.resolve(configRoot, registry === 'docker.io' ? 'registry-1.docker.io' : registry);
-  if (!isChildPath(configRoot, registryDir)) {
-    throw new Error(`Invalid registry '${registry}': resolved config path escapes the Buildx config directory`);
-  }
-  const scopeParts = scope.split('@');
-  if (scopeParts.length > 2) {
-    throw new Error(`Invalid scope '${scope}': scope can contain at most one @ separator`);
-  }
-  const [scopePath, scopeActions] = scopeParts;
-  if (scopeActions !== undefined && !/^[a-z]+(,[a-z]+)*$/.test(scopeActions)) {
-    throw new Error(`Invalid scope '${scope}': scope actions must be lowercase names separated by commas`);
-  }
-  const scopeSuffix = scopeActions === undefined ? '' : `@${scopeActions}`;
-  if (scopePath === '') {
-    return `${registryDir}${scopeSuffix}`;
-  }
-  const configDir = path.resolve(registryDir, scopePath);
-  if (!isChildPath(registryDir, configDir)) {
-    throw new Error(`Invalid scope '${scope}': resolved config path escapes the Buildx config directory`);
-  }
-  return `${configDir}${scopeSuffix}`;
-}
-
-function isChildPath(parent: string, child: string): boolean {
-  const relativePath = path.relative(parent, child);
-  return relativePath !== '' && relativePath !== '..' && !relativePath.startsWith(`..${path.sep}`) && !path.isAbsolute(relativePath);
-}
-
-function scopeDisabled(): boolean {
-  if (process.env.DOCKER_LOGIN_SCOPE_DISABLED) {
-    return Util.parseBool(process.env.DOCKER_LOGIN_SCOPE_DISABLED);
-  }
-  return false;
-}

src/docker.ts

@@ -1,39 +1,19 @@
+import * as aws from './aws';
 import * as core from '@actions/core';
 
-import {Docker} from '@docker/actions-toolkit/lib/docker/docker.js';
+import {Docker} from '@docker/actions-toolkit/lib/docker/docker';
 
-import * as aws from './aws.js';
+export async function login(registry: string, username: string, password: string, ecr: string): Promise<void> {
-import * as context from './context.js';
+  if (/true/i.test(ecr) || (ecr == 'auto' && aws.isECR(registry))) {
-import * as dockerhub from './dockerhub.js';
+    await loginECR(registry, username, password);
-
-export async function login(auth: context.Auth): Promise<void> {
-  if (/true/i.test(auth.ecr) || (auth.ecr == 'auto' && aws.isECR(auth.registry))) {
-    await loginECR(auth.registry, auth.username, auth.password, auth.scope);
   } else {
-    let username = auth.username;
+    await loginStandard(registry, username, password);
-    let password = auth.password;
-    if (dockerhub.isDockerHubOIDC(auth.registry, password)) {
-      const credentials = await dockerhub.getOIDCToken(auth.registry, username);
-      username = credentials.username;
-      password = credentials.token;
-    }
-    await loginStandard(auth.registry, username, password, auth.scope);
   }
 }
 
-export async function logout(registry: string, configDir: string): Promise<void> {
+export async function logout(registry: string): Promise<void> {
-  let envs: {[key: string]: string} | undefined;
-  if (configDir !== '') {
-    envs = Object.assign({}, process.env, {
-      DOCKER_CONFIG: configDir
-    }) as {
-      [key: string]: string;
-    };
-    core.info(`Alternative config dir: ${configDir}`);
-  }
   await Docker.getExecOutput(['logout', registry], {
-    ignoreReturnCode: true,
+    ignoreReturnCode: true
-    env: envs
   }).then(res => {
     if (res.stderr.length > 0 && res.exitCode != 0) {
       core.warning(res.stderr.trim());
@@ -41,7 +21,7 @@ export async function logout(registry: string, configDir: string): Promise<void>
   });
 }
 
-export async function loginStandard(registry: string, username: string, password: string, scope?: string): Promise<void> {
+export async function loginStandard(registry: string, username: string, password: string): Promise<void> {
   if (!username && !password) {
     throw new Error('Username and password required');
   }
@@ -51,39 +31,38 @@ export async function loginStandard(registry: string, username: string, password
   if (!password) {
     throw new Error('Password required');
   }
-  await loginExec(registry, username, password, scope);
-}
 
-export async function loginECR(registry: string, username: string, password: string, scope?: string): Promise<void> {
+  const loginArgs: Array<string> = ['login', '--password-stdin'];
-  core.info(`Retrieving registries data through AWS SDK...`);
+  loginArgs.push('--username', username);
-  const regDatas = await aws.getRegistriesData(registry, username, password);
+  loginArgs.push(registry);
-  for (const regData of regDatas) {
-    await loginExec(regData.registry, regData.username, regData.password, scope);
-  }
-}
 
-async function loginExec(registry: string, username: string, password: string, scope?: string): Promise<void> {
+  core.info(`Logging into ${registry}...`);
-  let envs: {[key: string]: string} | undefined;
+  await Docker.getExecOutput(loginArgs, {
-  const configDir = context.scopeToConfigDir(registry, scope);
-  if (configDir !== '') {
-    envs = Object.assign({}, process.env, {
-      DOCKER_CONFIG: configDir
-    }) as {
-      [key: string]: string;
-    };
-    core.info(`Logging into ${registry} (scope ${scope})...`);
-  } else {
-    core.info(`Logging into ${registry}...`);
-  }
-  await Docker.getExecOutput(['login', '--password-stdin', '--username', username, registry], {
     ignoreReturnCode: true,
     silent: true,
-    input: Buffer.from(password),
+    input: Buffer.from(password)
-    env: envs
   }).then(res => {
     if (res.stderr.length > 0 && res.exitCode != 0) {
       throw new Error(res.stderr.trim());
     }
-    core.info('Login Succeeded!');
+    core.info(`Login Succeeded!`);
   });
 }
+
+export async function loginECR(registry: string, username: string, password: string): Promise<void> {
+  core.info(`Retrieving registries data through AWS SDK...`);
+  const regDatas = await aws.getRegistriesData(registry, username, password);
+  for (const regData of regDatas) {
+    core.info(`Logging into ${regData.registry}...`);
+    await Docker.getExecOutput(['login', '--password-stdin', '--username', regData.username, regData.registry], {
+      ignoreReturnCode: true,
+      silent: true,
+      input: Buffer.from(regData.password)
+    }).then(res => {
+      if (res.stderr.length > 0 && res.exitCode != 0) {
+        throw new Error(res.stderr.trim());
+      }
+      core.info('Login Succeeded!');
+    });
+  }
+}

src/dockerhub.ts

@@ -1,137 +0,0 @@
-import * as core from '@actions/core';
-import * as httpm from '@actions/http-client';
-import {HttpCodes} from '@actions/http-client';
-import {validate as uuidValidate} from 'uuid';
-
-export interface LoginCredentials {
-  username: string;
-  token: string;
-}
-
-interface OIDCTokenResponse {
-  access_token: string;
-}
-
-const registries = new Set(['', 'docker.io', 'registry-1.docker.io', 'registry-1-stage.docker.io', 'dhi.io']);
-const defaultExpiresIn = 300;
-const minExpiresIn = 300;
-const maxExpiresIn = 21600;
-const maxRetries = 5;
-
-export const isDockerHubOIDC = (registry: string, password: string): boolean => {
-  return process.env.DOCKERHUB_OIDC_CONNECTIONID !== undefined && !password && registries.has(registry);
-};
-
-export const getOIDCToken = async (registry: string, username: string): Promise<LoginCredentials> => {
-  const connectionID = process.env.DOCKERHUB_OIDC_CONNECTIONID?.trim();
-  if (!connectionID) {
-    throw new Error('DOCKERHUB_OIDC_CONNECTIONID is required for Docker Hub OIDC login');
-  }
-
-  if (!uuidValidate(connectionID)) {
-    throw new Error('Invalid DOCKERHUB_OIDC_CONNECTIONID. Must be a valid UUID.');
-  }
-
-  const expiresIn = getExpiresIn();
-  const identityHost = registry === 'registry-1-stage.docker.io' ? 'identity-stage.docker.com' : 'identity.docker.com';
-  const audience = `https://${identityHost}`;
-  core.info(`Docker Hub OIDC detected for ${registry || 'docker.io'}`);
-  core.debug(`Docker Hub OIDC token audience: ${audience}`);
-  core.debug(`Docker Hub OIDC token expiration: ${expiresIn}s`);
-  core.info(`Retrieving GitHub OIDC token for Docker Hub`);
-  const idToken = await core.getIDToken(audience);
-  const http: httpm.HttpClient = new httpm.HttpClient('github.com/docker/login-action', [], {
-    headers: {
-      'Content-Type': 'application/x-www-form-urlencoded'
-    }
-  });
-
-  const data = new URLSearchParams();
-  data.set('grant_type', 'urn:ietf:params:oauth:grant-type:token-exchange');
-  data.set('subject_token_type', 'urn:ietf:params:oauth:token-type:id_token');
-  data.set('subject_token', idToken);
-  data.set('connection_id', connectionID);
-  data.set('expires_in', expiresIn.toString());
-
-  core.info(`Exchanging GitHub OIDC token for Docker Hub token`);
-  const resp = await postWithRetry(http, `https://${identityHost}/oauth/token`, data.toString());
-
-  const tokenResp = <OIDCTokenResponse>JSON.parse(await handleResponse(resp));
-  core.setSecret(tokenResp.access_token);
-  core.info(`Docker Hub OIDC token exchange succeeded`);
-
-  return {
-    username,
-    token: tokenResp.access_token
-  };
-};
-
-const getExpiresIn = (): number => {
-  const expiresInInput = process.env.DOCKERHUB_OIDC_EXPIREIN?.trim() || defaultExpiresIn.toString();
-  const expiresIn = Number(expiresInInput);
-  if (isNaN(expiresIn) || expiresIn < minExpiresIn || expiresIn > maxExpiresIn) {
-    throw new Error(`Invalid DOCKERHUB_OIDC_EXPIREIN: ${expiresInInput}. Must be between ${minExpiresIn} and ${maxExpiresIn}`);
-  }
-  return expiresIn;
-};
-
-const postWithRetry = async (http: httpm.HttpClient, url: string, data: string): Promise<httpm.HttpClientResponse> => {
-  core.debug(`Sending Docker Hub OIDC token request to ${url}`);
-  let resp = await http.post(url, data);
-  core.debug(`Docker Hub OIDC token request returned status code ${resp.message.statusCode || HttpCodes.InternalServerError}`);
-  for (let attempt = 0; (resp.message.statusCode || HttpCodes.InternalServerError) === HttpCodes.TooManyRequests && attempt < maxRetries; attempt++) {
-    const delay = parseRetryAfter(resp.message.headers['retry-after']);
-    if (delay === null) {
-      core.debug(`Docker Hub OIDC token request rate limited without retry-after header`);
-      break;
-    }
-    await resp.readBody();
-    core.info(`Docker Hub OIDC token request rate limited, retrying in ${delay}ms (attempt ${attempt + 1}/${maxRetries})`);
-    await new Promise(resolve => setTimeout(resolve, delay));
-    resp = await http.post(url, data);
-    core.debug(`Docker Hub OIDC token request returned status code ${resp.message.statusCode || HttpCodes.InternalServerError}`);
-  }
-  return resp;
-};
-
-const parseRetryAfter = (value: string | string[] | undefined): number | null => {
-  if (value === undefined) {
-    return null;
-  }
-  if (Array.isArray(value)) {
-    value = value[0];
-  }
-  const seconds = Number(value);
-  if (isNaN(seconds)) {
-    return null;
-  }
-  return Math.max(0, seconds * 1000);
-};
-
-const handleResponse = async (resp: httpm.HttpClientResponse): Promise<string> => {
-  const body = await resp.readBody();
-  const statusCode = resp.message.statusCode || HttpCodes.InternalServerError;
-  core.debug(`Docker Hub OIDC token response status code: ${statusCode}`);
-  if (statusCode < HttpCodes.OK || statusCode >= HttpCodes.MultipleChoices) {
-    throw parseError(statusCode, body);
-  }
-  return body;
-};
-
-const parseError = (statusCode: number, body: string): Error => {
-  if (body) {
-    let errResp: unknown;
-    try {
-      errResp = JSON.parse(body);
-    } catch {
-      errResp = undefined;
-    }
-    if (errResp !== undefined) {
-      throw new Error(`Docker Hub API: bad status code ${statusCode}: ${JSON.stringify(errResp)}`);
-    }
-  }
-  if (statusCode === 401) {
-    throw new Error(`Docker Hub API: operation not permitted`);
-  }
-  throw new Error(`Docker Hub API: bad status code ${statusCode}`);
-};

src/main.ts

@@ -1,26 +1,58 @@
+import * as yaml from 'js-yaml';
 import * as core from '@actions/core';
 import * as actionsToolkit from '@docker/actions-toolkit';
 
-import * as context from './context.js';
+import * as context from './context';
-import * as docker from './docker.js';
+import * as docker from './docker';
-import * as stateHelper from './state-helper.js';
+import * as stateHelper from './state-helper';
+
+interface Auth {
+  registry?: string;
+  username: string;
+  password: string;
+  ecr?: string;
+}
 
 export async function main(): Promise<void> {
   const inputs: context.Inputs = context.getInputs();
   stateHelper.setLogout(inputs.logout);
 
-  const auths = context.getAuthList(inputs);
+  const auths: Array<Auth> = [];
-  stateHelper.setRegistries(Array.from(new Map(auths.map(auth => [`${auth.registry}|${auth.configDir}`, {registry: auth.registry, configDir: auth.configDir} as stateHelper.RegistryState])).values()));
+  if (inputs.registry || inputs.username) {
-
+    auths.push({
-  if (auths.length === 1) {
+      registry: inputs.registry,
-    await docker.login(auths[0]);
+      username: inputs.username,
-    return;
+      password: inputs.password,
+      ecr: inputs.ecr
+    });
   }
 
+  const logins = yaml.load(inputs.logins) as Auth[];
+  if (Array.isArray(logins)) {
+    auths.push(...logins);
+  }
+
+  const registries: string[] = [];
   for (const auth of auths) {
-    await core.group(`Login to ${auth.registry}`, async () => {
+    if (!auth.registry) {
-      await docker.login(auth);
+      registries.push('docker.io');
-    });
+    } else {
+      registries.push(auth.registry);
+    }
+  }
+  stateHelper.setRegistries(registries.filter((value, index, self) => self.indexOf(value) === index));
+
+  if (auths.length == 0) {
+    throw new Error('No registry to login');
+  }
+  if (auths.length === 1) {
+    await docker.login(auths[0].registry || 'docker.io', auths[0].username, auths[0].password, auths[0].ecr || 'auto');
+  } else {
+    for (const auth of auths) {
+      await core.group(`Login to ${auth.registry || 'docker.io'}`, async () => {
+        await docker.login(auth.registry || 'docker.io', auth.username, auth.password, auth.ecr || 'auto');
+      });
+    }
   }
 }
 
@@ -28,10 +60,8 @@ async function post(): Promise<void> {
   if (!stateHelper.logout) {
     return;
   }
-  for (const registryState of stateHelper.registries) {
+  for (const registry of stateHelper.registries.split(',')) {
-    await core.group(`Logout from ${registryState.registry}`, async () => {
+    await docker.logout(registry);
-      await docker.logout(registryState.registry, registryState.configDir);
-    });
   }
 }
 

src/state-helper.ts

@@ -1,15 +1,10 @@
 import * as core from '@actions/core';
 
-export const registries = process.env['STATE_registries'] ? (JSON.parse(process.env['STATE_registries']) as Array<RegistryState>) : [];
+export const registries = process.env['STATE_registries'] || '';
 export const logout = /true/i.test(process.env['STATE_logout'] || '');
 
-export interface RegistryState {
+export function setRegistries(registries: string[]) {
-  registry: string;
+  core.saveState('registries', registries.join(','));
-  configDir: string;
-}
-
-export function setRegistries(registries: Array<RegistryState>) {
-  core.saveState('registries', JSON.stringify(registries));
 }
 
 export function setLogout(logout: boolean) {

tsconfig.json

@@ -1,8 +1,9 @@
 {
   "compilerOptions": {
-    "module": "nodenext",
-    "moduleResolution": "nodenext",
     "esModuleInterop": true,
+    "target": "es6",
+    "module": "commonjs",
+    "strict": true,
     "newLine": "lf",
     "outDir": "./lib",
     "rootDir": "./src",
@@ -11,7 +12,10 @@
     "resolveJsonModule": true,
     "useUnknownInCatchVariables": false,
   },
-  "include": [
+  "exclude": [
-    "src/**/*.ts"
+    "./__tests__/**/*",
+    "./lib/**/*",
+    "node_modules",
+    "jest.config.ts"
   ]
 }

vitest.config.ts

@@ -1,16 +0,0 @@
-import {defineConfig} from 'vitest/config';
-
-export default defineConfig({
-  test: {
-    clearMocks: true,
-    environment: 'node',
-    setupFiles: ['./__tests__/setup.unit.ts'],
-    include: ['**/*.test.ts'],
-    coverage: {
-      provider: 'v8',
-      reporter: ['clover'],
-      include: ['src/**/*.ts'],
-      exclude: ['src/**/main.ts']
-    }
-  }
-});