mirror of
https://github.com/docker/login-action.git
synced 2026-10-20 13:23:08 +01:00
Compare commits
2 Commits
e5665a8005
...
f95fe26bb1
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
f95fe26bb1 | ||
|
|
e9e40199d9 |
59
README.md
59
README.md
@@ -25,7 +25,6 @@ ___
|
|||||||
* [Quay.io](#quayio)
|
* [Quay.io](#quayio)
|
||||||
* [DigitalOcean](#digitalocean-container-registry)
|
* [DigitalOcean](#digitalocean-container-registry)
|
||||||
* [Authenticate to multiple registries](#authenticate-to-multiple-registries)
|
* [Authenticate to multiple registries](#authenticate-to-multiple-registries)
|
||||||
* [Set scopes for the authentication token](#set-scopes-for-the-authentication-token)
|
|
||||||
* [Customizing](#customizing)
|
* [Customizing](#customizing)
|
||||||
* [inputs](#inputs)
|
* [inputs](#inputs)
|
||||||
* [Contributing](#contributing)
|
* [Contributing](#contributing)
|
||||||
@@ -528,8 +527,8 @@ jobs:
|
|||||||
```
|
```
|
||||||
|
|
||||||
You can also use the `registry-auth` input for raw authentication to
|
You can also use the `registry-auth` input for raw authentication to
|
||||||
registries, defined as YAML objects. Each object have the same attributes as
|
registries, defined as YAML objects. Each object can contain `registry`,
|
||||||
current inputs (except `logout`):
|
`username`, `password` and `ecr` keys similar to current inputs:
|
||||||
|
|
||||||
> [!WARNING]
|
> [!WARNING]
|
||||||
> We don't recommend using this method, it's better to use the action multiple
|
> We don't recommend using this method, it's better to use the action multiple
|
||||||
@@ -558,60 +557,6 @@ jobs:
|
|||||||
password: ${{ secrets.GITHUB_TOKEN }}
|
password: ${{ secrets.GITHUB_TOKEN }}
|
||||||
```
|
```
|
||||||
|
|
||||||
### Set scopes for the authentication token
|
|
||||||
|
|
||||||
The `scope` input allows limiting registry credentials to a specific repository
|
|
||||||
or namespace scope when building images with Buildx.
|
|
||||||
|
|
||||||
This is useful in GitHub Actions to avoid overriding the Docker Hub
|
|
||||||
authentication token embedded in GitHub-hosted runners, which is used for
|
|
||||||
pulling images without rate limits. By scoping credentials, you can
|
|
||||||
authenticate only where needed (typically for pushing), while keeping
|
|
||||||
unauthenticated pulls for base images.
|
|
||||||
|
|
||||||
When `scope` is set, credentials are written to the Buildx configuration
|
|
||||||
instead of the global Docker configuration. This means:
|
|
||||||
* Authentication applies only to the specified scope
|
|
||||||
* The default Docker Hub credentials remain available for pulls
|
|
||||||
* Credentials are used only by Buildx during the build
|
|
||||||
|
|
||||||
> [!IMPORTANT]
|
|
||||||
> Credentials written to the Buildx configuration are only accessible by Buildx.
|
|
||||||
> They are not available to `docker pull`, `docker push`, or any other Docker
|
|
||||||
> CLI commands outside Buildx.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> This feature requires Buildx version 0.31.0 or later.
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
name: ci
|
|
||||||
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
branches: main
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
login:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
-
|
|
||||||
name: Login to Docker Hub (scoped)
|
|
||||||
uses: docker/login-action@v3
|
|
||||||
with:
|
|
||||||
username: ${{ vars.DOCKERHUB_USERNAME }}
|
|
||||||
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
||||||
scope: 'myorg/myimage@push'
|
|
||||||
-
|
|
||||||
name: Build and push
|
|
||||||
uses: docker/build-push-action@v6
|
|
||||||
with:
|
|
||||||
push: true
|
|
||||||
tags: myorg/myimage:latest
|
|
||||||
```
|
|
||||||
|
|
||||||
In this example, base images are pulled using the embedded GitHub-hosted runner
|
|
||||||
credentials, while authenticated access is used only to push `myorg/myimage`.
|
|
||||||
|
|
||||||
## Customizing
|
## Customizing
|
||||||
|
|
||||||
### inputs
|
### inputs
|
||||||
|
|||||||
Reference in New Issue
Block a user