[dependabot skip] chore: update generated content

Bumps [handlebars](https://github.com/handlebars-lang/handlebars.js) from 4.7.9 to 4.7.10.
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.10/release-notes.md)
- [Commits](https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10)

---
updated-dependencies:
- dependency-name: handlebars
  dependency-version: 4.7.10
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/actions/docker-pull/Dockerfile

@@ -0,0 +1,3 @@
+FROM docker:29.3@sha256:4d90f1f6c400315c2dba96d3ec93c01e64198395cbba04f79d12adce4f737029
+
+ENTRYPOINT ["docker"]

.github/actions/docker-pull/action.yml

@@ -0,0 +1,15 @@
+name: Pull Docker image
+
+description: Pull an image from a Docker container action
+
+inputs:
+  image:
+    description: Image reference to pull
+    required: true
+
+runs:
+  using: docker
+  image: Dockerfile
+  args:
+    - pull
+    - ${{ inputs.image }}

.github/workflows/ci.yml

@@ -106,11 +106,10 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       -
-        name: DinD
-        uses: docker://docker:29.3@sha256:4d90f1f6c400315c2dba96d3ec93c01e64198395cbba04f79d12adce4f737029
+        name: Pull test image from Docker CLI container action
+        uses: ./.github/actions/docker-pull
         with:
-          entrypoint: docker
-          args: pull ${{ env.GHCR_TEST_IMAGE }}
+          image: ${{ env.GHCR_TEST_IMAGE }}
       -
         name: Pull test image
         run: |
@@ -173,6 +172,27 @@ jobs:
         with:
           username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
 
+  registry-auth-oidc:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      -
+        name: Login to registries
+        uses: ./
+        env:
+          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
+        with:
+          registry-auth: |
+            - username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
+            - registry: ghcr.io
+              username: ${{ github.actor }}
+              password: ${{ secrets.GITHUB_TOKEN }}
+
   ecr:
     runs-on: ${{ matrix.os }}
     strategy:
@@ -207,7 +227,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -235,7 +255,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd_login_action
           aws-region: us-east-1
@@ -282,7 +302,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -311,7 +331,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd_login_action
           aws-region: us-east-1

.github/workflows/codeql.yml

@@ -35,12 +35,12 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
       -
         name: Initialize CodeQL
-        uses: github/codeql-action/init@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           languages: javascript-typescript
           build-mode: none
       -
         name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           category: "/language:javascript-typescript"

README.md

@@ -648,6 +648,38 @@ jobs:
               password: ${{ secrets.GITHUB_TOKEN }}
 ```
 
+Docker Hub OIDC can also be used with `registry-auth`. Grant `id-token: write`,
+set `DOCKERHUB_OIDC_CONNECTIONID`, pass the Docker Hub organization name as
+`username`, and omit `password` for the Docker Hub object:
+
+```yaml
+name: ci
+
+on:
+  push:
+    branches: main
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  login:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Login to registries
+        uses: docker/login-action@v4
+        env:
+          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
+        with:
+          registry-auth: |
+            - username: ${{ vars.DOCKERHUB_ORGANIZATION }}
+            - registry: ghcr.io
+              username: ${{ github.actor }}
+              password: ${{ secrets.GITHUB_TOKEN }}
+```
+
 ### Set scopes for the authentication token
 
 The `scope` input allows limiting registry credentials to a specific repository
@@ -725,10 +757,10 @@ The following inputs can be used as `step.with` keys:
 
 The following environment variables can be set as `step.env` keys:
 
-| Name                          | Type   | Default | Description                                                                 |
-|-------------------------------|--------|---------|-----------------------------------------------------------------------------|
-| `DOCKERHUB_OIDC_CONNECTIONID` | String |         | Docker Hub OIDC connection ID. Required for Docker Hub OIDC login           |
-| `DOCKERHUB_OIDC_EXPIREIN`     | Number | `300`   | Docker Hub OIDC token lifetime in seconds. Must be between `300` and `3600` |
+| Name                          | Type   | Default | Description                                                                                        |
+|-------------------------------|--------|---------|----------------------------------------------------------------------------------------------------|
+| `DOCKERHUB_OIDC_CONNECTIONID` | String |         | Docker Hub OIDC connection ID. Required for Docker Hub OIDC login                                  |
+| `DOCKERHUB_OIDC_EXPIREIN`     | Number | `300`   | Docker Hub OIDC token lifetime in seconds. Must be between `300` (5 minutes) and `21600` (6 hours) |
 
 ## Contributing
 

__tests__/context.test.ts

@@ -35,6 +35,87 @@ test('getAuthList uses the default Docker Hub registry when computing scoped con
   });
 });
 
+test('getAuthList supports @ scopes appended to the registry config dir', async () => {
+  process.env['INPUT_USERNAME'] = 'dbowie';
+  process.env['INPUT_PASSWORD'] = 'groundcontrol';
+  process.env['INPUT_SCOPE'] = '@push';
+  process.env['INPUT_LOGOUT'] = 'false';
+  const [auth] = getAuthList(getInputs());
+  expect(auth).toMatchObject({
+    configDir: path.join(Buildx.configDir, 'config', 'registry-1.docker.io') + '@push'
+  });
+});
+
+test('getAuthList supports repository scopes with appended actions', async () => {
+  process.env['INPUT_USERNAME'] = 'dbowie';
+  process.env['INPUT_PASSWORD'] = 'groundcontrol';
+  process.env['INPUT_SCOPE'] = 'docker/buildx-bin@push';
+  process.env['INPUT_LOGOUT'] = 'false';
+  const [auth] = getAuthList(getInputs());
+  expect(auth).toMatchObject({
+    configDir: path.join(Buildx.configDir, 'config', 'registry-1.docker.io', 'docker', 'buildx-bin@push')
+  });
+});
+
+test('getAuthList supports comma-separated scope actions', async () => {
+  process.env['INPUT_USERNAME'] = 'dbowie';
+  process.env['INPUT_PASSWORD'] = 'groundcontrol';
+  process.env['INPUT_SCOPE'] = 'docker/buildx-bin@pull,push';
+  process.env['INPUT_LOGOUT'] = 'false';
+  const [auth] = getAuthList(getInputs());
+  expect(auth).toMatchObject({
+    configDir: path.join(Buildx.configDir, 'config', 'registry-1.docker.io', 'docker', 'buildx-bin@pull,push')
+  });
+});
+
+// prettier-ignore
+test.each([
+  '../../../../work/leaked',
+  '..',
+  'foo/../../../../etc',
+  '@../../../leaked',
+  'foo/bar@../../../leaked',
+  '@push@pull',
+  'foo/bar@push@pull',
+  '@push,',
+  '@,push',
+  '@pull,,push',
+  '@Push',
+  path.join(path.parse(Buildx.configDir).root, 'work', 'leaked')
+])('getAuthList rejects unsafe or unsupported scope path: %s', async scope => {
+  expect(() => {
+    getAuthList({
+      registry: '',
+      username: 'dbowie',
+      password: 'groundcontrol',
+      scope,
+      ecr: '',
+      logout: false,
+      registryAuth: ''
+    });
+  }).toThrow(/Invalid scope/);
+});
+
+// prettier-ignore
+test.each([
+  '../../../../work/leaked',
+  '..',
+  'foo/../../../../etc',
+  path.join(path.parse(Buildx.configDir).root, 'work', 'leaked')
+])('getAuthList rejects unsafe registry path: %s', async registry => {
+  expect(() => {
+    getAuthList({
+      registry,
+      username: 'dbowie',
+      password: 'groundcontrol',
+      scope: '@push',
+      ecr: '',
+      logout: false,
+      registryAuth: ''
+    });
+  }).toThrow(/Invalid registry/);
+});
+
 test('getAuthList skips secret masking when registry-auth password is absent', async () => {
   const stdoutWriteSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
   const [auth] = getAuthList({
@@ -54,6 +135,25 @@ test('getAuthList skips secret masking when registry-auth password is absent', a
   });
 });
 
+test('getAuthList supports password-less Docker Hub registry-auth for OIDC', async () => {
+  const [auth] = getAuthList({
+    registry: '',
+    username: '',
+    password: '',
+    scope: '',
+    ecr: '',
+    logout: true,
+    registryAuth: '- username: docker-org\n'
+  });
+
+  expect(auth).toMatchObject({
+    registry: 'docker.io',
+    username: 'docker-org',
+    password: undefined,
+    ecr: 'auto'
+  });
+});
+
 test('getAuthList masks registry-auth password when present', async () => {
   const stdoutWriteSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
   getAuthList({
@@ -68,3 +168,23 @@ test('getAuthList masks registry-auth password when present', async () => {
 
   expect(stdoutWriteSpy.mock.calls.map(call => call[0]).join('')).toContain('::add-mask::groundcontrol');
 });
+
+// prettier-ignore
+test.each([
+  ['false', 'false'],
+  ['"false"', 'false'],
+  ['true', 'true'],
+  ['auto', 'auto'],
+  ['""', 'auto']
+])('getAuthList normalizes registry-auth ecr: %s', (ecr, expected) => {
+  const [auth] = getAuthList({
+    registry: '',
+    username: '',
+    password: '',
+    scope: '',
+    ecr: '',
+    logout: true,
+    registryAuth: `- registry: 012345678910.dkr.ecr.eu-west-3.amazonaws.com\n  username: AWS\n  password: token\n  ecr: ${ecr}\n`
+  });
+  expect(auth.ecr).toBe(expected);
+});

__tests__/docker.test.ts

@@ -1,8 +1,14 @@
-import {expect, test, vi} from 'vitest';
+import {afterEach, expect, test, vi} from 'vitest';
 
 import {Docker} from '@docker/actions-toolkit/lib/docker/docker.js';
 
-import {loginStandard, logout} from '../src/docker.js';
+import {login, loginStandard, logout} from '../src/docker.js';
+import * as dockerhub from '../src/dockerhub.js';
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  delete process.env.DOCKERHUB_OIDC_CONNECTIONID;
+});
 
 test('loginStandard calls exec', async () => {
   const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
@@ -32,6 +38,37 @@ test('loginStandard calls exec', async () => {
   });
 });
 
+test('login exchanges Docker Hub OIDC token for password-less auth', async () => {
+  process.env.DOCKERHUB_OIDC_CONNECTIONID = '123e4567-e89b-42d3-a456-426614174000';
+  const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
+    return {
+      exitCode: 0,
+      stdout: '',
+      stderr: ''
+    };
+  });
+  const oidcSpy = vi.spyOn(dockerhub, 'getOIDCToken').mockResolvedValue({
+    username: 'docker-org',
+    token: 'hub-token'
+  });
+
+  await login({
+    registry: 'docker.io',
+    username: 'docker-org',
+    password: '',
+    scope: '',
+    ecr: 'auto',
+    configDir: ''
+  });
+
+  expect(oidcSpy).toHaveBeenCalledWith('docker.io', 'docker-org');
+  expect(execSpy).toHaveBeenCalledWith(['login', '--password-stdin', '--username', 'docker-org', 'docker.io'], {
+    input: Buffer.from('hub-token'),
+    silent: true,
+    ignoreReturnCode: true
+  });
+});
+
 test('logout calls exec', async () => {
   const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
     return {

__tests__/dockerhub.test.ts

@@ -5,6 +5,7 @@ import {beforeEach, describe, expect, test, vi} from 'vitest';
 import * as dockerhub from '../src/dockerhub.js';
 
 vi.mock('@actions/core', () => ({
+  debug: vi.fn(),
   getIDToken: vi.fn(),
   info: vi.fn(),
   setSecret: vi.fn()
@@ -83,13 +84,22 @@ describe('getOIDCToken', () => {
     expect(body.get('connection_id')).toBe(validConnectionID);
     expect(body.get('expires_in')).toBe('300');
     expect(setSecretMock).toHaveBeenCalledWith('hub-token');
+    expect(core.info).toHaveBeenCalledWith('Docker Hub OIDC detected for docker.io');
+    expect(core.info).toHaveBeenCalledWith('Retrieving GitHub OIDC token for Docker Hub');
+    expect(core.info).toHaveBeenCalledWith('Exchanging GitHub OIDC token for Docker Hub token');
+    expect(core.info).toHaveBeenCalledWith('Docker Hub OIDC token exchange succeeded');
+    expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token audience: https://identity.docker.com');
+    expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token expiration: 300s');
+    expect(core.debug).toHaveBeenCalledWith('Sending Docker Hub OIDC token request to https://identity.docker.com/oauth/token');
+    expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token request returned status code 200');
+    expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token response status code: 200');
   });
 
   test('uses custom token expiration', async () => {
-    process.env.DOCKERHUB_OIDC_EXPIREIN = '900';
+    process.env.DOCKERHUB_OIDC_EXPIREIN = '21600';
     await dockerhub.getOIDCToken('docker.io', 'dbowie');
     const body = new URLSearchParams(postSpy.mock.calls[0][1]);
-    expect(body.get('expires_in')).toBe('900');
+    expect(body.get('expires_in')).toBe('21600');
   });
 
   test('uses stage identity host for stage registry', async () => {
@@ -112,9 +122,9 @@ describe('getOIDCToken', () => {
     expect(postSpy).not.toHaveBeenCalled();
   });
 
-  test.each(['not-a-number', '299', '3601'])('validates token expiration %p', async expiresIn => {
+  test.each(['not-a-number', '299', '21601'])('validates token expiration %p', async expiresIn => {
     process.env.DOCKERHUB_OIDC_EXPIREIN = expiresIn;
-    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow(`Invalid DOCKERHUB_OIDC_EXPIREIN: ${expiresIn}. Must be between 300 and 3600`);
+    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow(`Invalid DOCKERHUB_OIDC_EXPIREIN: ${expiresIn}. Must be between 300 and 21600`);
     expect(getIDTokenMock).not.toHaveBeenCalled();
     expect(postSpy).not.toHaveBeenCalled();
   });
@@ -126,8 +136,14 @@ describe('getOIDCToken', () => {
     expect(core.info).toHaveBeenCalledWith('Docker Hub OIDC token request rate limited, retrying in 0ms (attempt 1/5)');
   });
 
-  test('throws Docker Hub API errors', async () => {
-    postSpy.mockResolvedValue(httpResponse(400, JSON.stringify({description: 'bad connection'})));
-    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('Docker Hub API: bad status code 400: bad connection');
+  test('throws Docker Hub OIDC error responses', async () => {
+    postSpy.mockResolvedValue(httpResponse(400, JSON.stringify({error: 'invalid_request', error_description: 'bad connection', error_uri: 'https://docs.docker.com'})));
+    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('Docker Hub API: bad status code 400: {"error":"invalid_request","error_description":"bad connection","error_uri":"https://docs.docker.com"}');
+  });
+
+  test('throws rate limited Docker Hub OIDC error response after retries', async () => {
+    postSpy.mockResolvedValue(httpResponse(429, JSON.stringify({error: 'rate_limited', error_description: 'slow down'}), {'retry-after': '0'}));
+    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('Docker Hub API: bad status code 429: {"error":"rate_limited","error_description":"slow down"}');
+    expect(postSpy).toHaveBeenCalledTimes(6);
   });
 });

dist/licenses.txt

@@ -1913,8 +1913,8 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/client-ecr-public@3.1091.0
- - @aws-sdk/client-ecr@3.1091.0
+ - @aws-sdk/client-ecr-public@3.1095.0
+ - @aws-sdk/client-ecr@3.1095.0
 
 These packages each contain the following license:
 
@@ -2124,8 +2124,8 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/signature-v4-multi-region@3.996.41
- - @smithy/core@3.29.6
+ - @aws-sdk/signature-v4-multi-region@3.996.42
+ - @smithy/core@3.30.0
  - @smithy/types@4.16.1
 
 These packages each contain the following license:
@@ -2396,11 +2396,12 @@ SOFTWARE.
 
 -----------
 
-The following npm package may be included in this product:
+The following npm packages may be included in this product:
 
  - js-yaml@5.2.1
+ - js-yaml@5.2.2
 
-This package contains the following license:
+These packages each contain the following license:
 
 (The MIT License)
 
@@ -3175,7 +3176,7 @@ software or this license, under any kind of legal claim.***
 
 The following npm package may be included in this product:
 
- - @aws-sdk/core@3.975.3
+ - @aws-sdk/core@3.977.1
 
 This package contains the following license:
 
@@ -3385,16 +3386,16 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-env@3.972.59
- - @aws-sdk/credential-provider-ini@3.973.4
- - @aws-sdk/credential-provider-node@3.972.70
- - @aws-sdk/token-providers@3.1088.0
+ - @aws-sdk/credential-provider-env@3.972.61
+ - @aws-sdk/credential-provider-ini@3.973.6
+ - @aws-sdk/credential-provider-node@3.972.72
+ - @aws-sdk/token-providers@3.1095.0
  - @aws-sdk/types@3.974.2
- - @aws-sdk/xml-builder@3.972.36
- - @smithy/credential-provider-imds@4.4.11
- - @smithy/fetch-http-handler@5.6.8
- - @smithy/node-http-handler@4.9.8
- - @smithy/signature-v4@5.6.7
+ - @aws-sdk/xml-builder@3.972.37
+ - @smithy/credential-provider-imds@4.4.14
+ - @smithy/fetch-http-handler@5.6.11
+ - @smithy/node-http-handler@4.9.11
+ - @smithy/signature-v4@5.6.10
 
 These packages each contain the following license:
 
@@ -3604,9 +3605,9 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-process@3.972.59
- - @aws-sdk/credential-provider-sso@3.973.3
- - @aws-sdk/credential-provider-web-identity@3.972.65
+ - @aws-sdk/credential-provider-process@3.972.61
+ - @aws-sdk/credential-provider-sso@3.973.5
+ - @aws-sdk/credential-provider-web-identity@3.972.67
 
 These packages each contain the following license:
 
@@ -3880,9 +3881,9 @@ END OF TERMS AND CONDITIONS
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-http@3.972.61
- - @aws-sdk/credential-provider-login@3.972.66
- - @aws-sdk/nested-clients@3.997.33
+ - @aws-sdk/credential-provider-http@3.972.63
+ - @aws-sdk/credential-provider-login@3.972.68
+ - @aws-sdk/nested-clients@3.997.35
  - @sigstore/verify@4.1.0
 
 These packages each contain the following license:
@@ -3979,7 +3980,7 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 The following npm package may be included in this product:
 
- - handlebars@4.7.9
+ - handlebars@4.7.10
 
 This package contains the following license:
 

package.json

@@ -25,12 +25,12 @@
   "dependencies": {
     "@actions/core": "^3.0.1",
     "@actions/http-client": "^4.0.1",
-    "@aws-sdk/client-ecr": "^3.1091.0",
-    "@aws-sdk/client-ecr-public": "^3.1091.0",
+    "@aws-sdk/client-ecr": "^3.1095.0",
+    "@aws-sdk/client-ecr-public": "^3.1095.0",
     "@docker/actions-toolkit": "^0.94.0",
     "http-proxy-agent": "^9.1.0",
     "https-proxy-agent": "^9.1.0",
-    "js-yaml": "^5.2.1",
+    "js-yaml": "^5.2.2",
     "uuid": "^14.0.1"
   },
   "devDependencies": {

src/context.ts

@@ -62,7 +62,7 @@ export function getAuthList(inputs: Inputs): Array<Auth> {
         username: auth.username,
         password: auth.password,
         scope: auth.scope,
-        ecr: auth.ecr || 'auto',
+        ecr: String(auth.ecr ?? '') || 'auto',
         configDir: scopeToConfigDir(registry, auth.scope)
       };
     });
@@ -77,13 +77,33 @@ export function scopeToConfigDir(registry: string, scope?: string): string {
   if (scopeDisabled() || !scope || scope === '') {
     return '';
   }
-  let configDir = path.join(Buildx.configDir, 'config', registry === 'docker.io' ? 'registry-1.docker.io' : registry);
-  if (scope.startsWith('@')) {
-    configDir += scope;
-  } else {
-    configDir = path.join(configDir, scope);
+  const configRoot = path.resolve(Buildx.configDir, 'config');
+  const registryDir = path.resolve(configRoot, registry === 'docker.io' ? 'registry-1.docker.io' : registry);
+  if (!isChildPath(configRoot, registryDir)) {
+    throw new Error(`Invalid registry '${registry}': resolved config path escapes the Buildx config directory`);
   }
-  return configDir;
+  const scopeParts = scope.split('@');
+  if (scopeParts.length > 2) {
+    throw new Error(`Invalid scope '${scope}': scope can contain at most one @ separator`);
+  }
+  const [scopePath, scopeActions] = scopeParts;
+  if (scopeActions !== undefined && !/^[a-z]+(,[a-z]+)*$/.test(scopeActions)) {
+    throw new Error(`Invalid scope '${scope}': scope actions must be lowercase names separated by commas`);
+  }
+  const scopeSuffix = scopeActions === undefined ? '' : `@${scopeActions}`;
+  if (scopePath === '') {
+    return `${registryDir}${scopeSuffix}`;
+  }
+  const configDir = path.resolve(registryDir, scopePath);
+  if (!isChildPath(registryDir, configDir)) {
+    throw new Error(`Invalid scope '${scope}': resolved config path escapes the Buildx config directory`);
+  }
+  return `${configDir}${scopeSuffix}`;
+}
+
+function isChildPath(parent: string, child: string): boolean {
+  const relativePath = path.relative(parent, child);
+  return relativePath !== '' && relativePath !== '..' && !relativePath.startsWith(`..${path.sep}`) && !path.isAbsolute(relativePath);
 }
 
 function scopeDisabled(): boolean {

src/dockerhub.ts

@@ -12,17 +12,14 @@ interface OIDCTokenResponse {
   access_token: string;
 }
 
+const registries = new Set(['', 'docker.io', 'registry-1.docker.io', 'registry-1-stage.docker.io', 'dhi.io']);
 const defaultExpiresIn = 300;
 const minExpiresIn = 300;
-const maxExpiresIn = 3600;
+const maxExpiresIn = 21600;
 const maxRetries = 5;
 
 export const isDockerHubOIDC = (registry: string, password: string): boolean => {
-  return process.env.DOCKERHUB_OIDC_CONNECTIONID !== undefined && !password && isDockerHubRegistry(registry);
-};
-
-const isDockerHubRegistry = (registry: string): boolean => {
-  return registry === '' || registry === 'docker.io' || registry === 'registry-1.docker.io' || registry === 'registry-1-stage.docker.io';
+  return process.env.DOCKERHUB_OIDC_CONNECTIONID !== undefined && !password && registries.has(registry);
 };
 
 export const getOIDCToken = async (registry: string, username: string): Promise<LoginCredentials> => {
@@ -38,6 +35,10 @@ export const getOIDCToken = async (registry: string, username: string): Promise<
   const expiresIn = getExpiresIn();
   const identityHost = registry === 'registry-1-stage.docker.io' ? 'identity-stage.docker.com' : 'identity.docker.com';
   const audience = `https://${identityHost}`;
+  core.info(`Docker Hub OIDC detected for ${registry || 'docker.io'}`);
+  core.debug(`Docker Hub OIDC token audience: ${audience}`);
+  core.debug(`Docker Hub OIDC token expiration: ${expiresIn}s`);
+  core.info(`Retrieving GitHub OIDC token for Docker Hub`);
   const idToken = await core.getIDToken(audience);
   const http: httpm.HttpClient = new httpm.HttpClient('github.com/docker/login-action', [], {
     headers: {
@@ -52,10 +53,12 @@ export const getOIDCToken = async (registry: string, username: string): Promise<
   data.set('connection_id', connectionID);
   data.set('expires_in', expiresIn.toString());
 
+  core.info(`Exchanging GitHub OIDC token for Docker Hub token`);
   const resp = await postWithRetry(http, `https://${identityHost}/oauth/token`, data.toString());
 
   const tokenResp = <OIDCTokenResponse>JSON.parse(await handleResponse(resp));
   core.setSecret(tokenResp.access_token);
+  core.info(`Docker Hub OIDC token exchange succeeded`);
 
   return {
     username,
@@ -73,16 +76,20 @@ const getExpiresIn = (): number => {
 };
 
 const postWithRetry = async (http: httpm.HttpClient, url: string, data: string): Promise<httpm.HttpClientResponse> => {
+  core.debug(`Sending Docker Hub OIDC token request to ${url}`);
   let resp = await http.post(url, data);
+  core.debug(`Docker Hub OIDC token request returned status code ${resp.message.statusCode || HttpCodes.InternalServerError}`);
   for (let attempt = 0; (resp.message.statusCode || HttpCodes.InternalServerError) === HttpCodes.TooManyRequests && attempt < maxRetries; attempt++) {
     const delay = parseRetryAfter(resp.message.headers['retry-after']);
     if (delay === null) {
+      core.debug(`Docker Hub OIDC token request rate limited without retry-after header`);
       break;
     }
     await resp.readBody();
     core.info(`Docker Hub OIDC token request rate limited, retrying in ${delay}ms (attempt ${attempt + 1}/${maxRetries})`);
     await new Promise(resolve => setTimeout(resolve, delay));
     resp = await http.post(url, data);
+    core.debug(`Docker Hub OIDC token request returned status code ${resp.message.statusCode || HttpCodes.InternalServerError}`);
   }
   return resp;
 };
@@ -104,6 +111,7 @@ const parseRetryAfter = (value: string | string[] | undefined): number | null =>
 const handleResponse = async (resp: httpm.HttpClientResponse): Promise<string> => {
   const body = await resp.readBody();
   const statusCode = resp.message.statusCode || HttpCodes.InternalServerError;
+  core.debug(`Docker Hub OIDC token response status code: ${statusCode}`);
   if (statusCode < HttpCodes.OK || statusCode >= HttpCodes.MultipleChoices) {
     throw parseError(statusCode, body);
   }
@@ -111,24 +119,19 @@ const handleResponse = async (resp: httpm.HttpClientResponse): Promise<string> =
 };
 
 const parseError = (statusCode: number, body: string): Error => {
+  if (body) {
+    let errResp: unknown;
+    try {
+      errResp = JSON.parse(body);
+    } catch {
+      errResp = undefined;
+    }
+    if (errResp !== undefined) {
+      throw new Error(`Docker Hub API: bad status code ${statusCode}: ${JSON.stringify(errResp)}`);
+    }
+  }
   if (statusCode === 401) {
     throw new Error(`Docker Hub API: operation not permitted`);
   }
-  if (body) {
-    const errResp = parseErrorBody(body);
-    for (const k of ['description', 'message', 'detail', 'error']) {
-      if (errResp[k]) {
-        throw new Error(`Docker Hub API: bad status code ${statusCode}: ${errResp[k]}`);
-      }
-    }
-  }
   throw new Error(`Docker Hub API: bad status code ${statusCode}`);
 };
-
-const parseErrorBody = (body: string): Record<string, string> => {
-  try {
-    return <Record<string, string>>JSON.parse(body);
-  } catch {
-    return {};
-  }
-};

yarn.lock

@@ -170,217 +170,217 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@aws-sdk/client-ecr-public@npm:^3.1091.0":
-  version: 3.1091.0
-  resolution: "@aws-sdk/client-ecr-public@npm:3.1091.0"
+"@aws-sdk/client-ecr-public@npm:^3.1095.0":
+  version: 3.1095.0
+  resolution: "@aws-sdk/client-ecr-public@npm:3.1095.0"
   dependencies:
-    "@aws-sdk/core": "npm:^3.975.3"
-    "@aws-sdk/credential-provider-node": "npm:^3.972.70"
+    "@aws-sdk/core": "npm:^3.977.0"
+    "@aws-sdk/credential-provider-node": "npm:^3.972.72"
     "@aws-sdk/types": "npm:^3.974.2"
-    "@smithy/core": "npm:^3.29.4"
-    "@smithy/fetch-http-handler": "npm:^5.6.6"
-    "@smithy/node-http-handler": "npm:^4.9.6"
+    "@smithy/core": "npm:^3.29.8"
+    "@smithy/fetch-http-handler": "npm:^5.6.10"
+    "@smithy/node-http-handler": "npm:^4.9.10"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/70da99ae235bfeb22ae8018860ae587ad77b0a17b89393a893f4a90625513ba0c69ab1f560ea0addae57361abb8f799a534b326fe58e741642049bfcf137cf25
+  checksum: 10/39620a474a5a7b4e77b035b9da4fa446a4a2353141528349007d22e9416340c81f9fb4e09465856df921462cd21f90ee747a034e051f4b23c85f0cd7ed427ab8
   languageName: node
   linkType: hard
 
-"@aws-sdk/client-ecr@npm:^3.1091.0":
-  version: 3.1091.0
-  resolution: "@aws-sdk/client-ecr@npm:3.1091.0"
+"@aws-sdk/client-ecr@npm:^3.1095.0":
+  version: 3.1095.0
+  resolution: "@aws-sdk/client-ecr@npm:3.1095.0"
   dependencies:
-    "@aws-sdk/core": "npm:^3.975.3"
-    "@aws-sdk/credential-provider-node": "npm:^3.972.70"
+    "@aws-sdk/core": "npm:^3.977.0"
+    "@aws-sdk/credential-provider-node": "npm:^3.972.72"
     "@aws-sdk/types": "npm:^3.974.2"
-    "@smithy/core": "npm:^3.29.4"
-    "@smithy/fetch-http-handler": "npm:^5.6.6"
-    "@smithy/node-http-handler": "npm:^4.9.6"
+    "@smithy/core": "npm:^3.29.8"
+    "@smithy/fetch-http-handler": "npm:^5.6.10"
+    "@smithy/node-http-handler": "npm:^4.9.10"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/622dce201f147c99017945ed479fac1ab12485c6612c4b7cd76eb1885965639073517d392b56c05ca6d88a1104c662608edd26c44930a0ee47f6bd6dc8d5956e
+  checksum: 10/f629564991f3a20541ae34d71bf79f76a095ddb9e6566601276949b34300e4d95731998a4952fc21d3f9194e1a879c9f30d5929dbeda7de9ded8f91c10934391
   languageName: node
   linkType: hard
 
-"@aws-sdk/core@npm:^3.975.3":
-  version: 3.975.3
-  resolution: "@aws-sdk/core@npm:3.975.3"
+"@aws-sdk/core@npm:^3.977.0":
+  version: 3.977.1
+  resolution: "@aws-sdk/core@npm:3.977.1"
   dependencies:
     "@aws-sdk/types": "npm:^3.974.2"
-    "@aws-sdk/xml-builder": "npm:^3.972.36"
+    "@aws-sdk/xml-builder": "npm:^3.972.37"
     "@aws/lambda-invoke-store": "npm:^0.3.0"
-    "@smithy/core": "npm:^3.29.4"
-    "@smithy/signature-v4": "npm:^5.6.5"
+    "@smithy/core": "npm:^3.29.8"
+    "@smithy/signature-v4": "npm:^5.6.9"
     "@smithy/types": "npm:^4.16.1"
     bowser: "npm:^2.11.0"
     tslib: "npm:^2.6.2"
-  checksum: 10/a4be9e91891f6f2169cc694e8d4abe1a0bd83ed257af688d83617c428d54ad34516ccd4ed51854b4df9b81e585d30dfa9618cec75d2dfa6a8b7f5239d01913d4
+  checksum: 10/7828709646f5f6260123ebf9c13043650b29c6202314e9f9d463bf95600f982e89658f6edbb475737366141db9b7e3b680f3e3fd282037dd89e640975db97554
   languageName: node
   linkType: hard
 
-"@aws-sdk/credential-provider-env@npm:^3.972.59":
-  version: 3.972.59
-  resolution: "@aws-sdk/credential-provider-env@npm:3.972.59"
-  dependencies:
-    "@aws-sdk/core": "npm:^3.975.3"
-    "@aws-sdk/types": "npm:^3.974.2"
-    "@smithy/core": "npm:^3.29.4"
-    "@smithy/types": "npm:^4.16.1"
-    tslib: "npm:^2.6.2"
-  checksum: 10/e9456725b6e1ad9c28f1901fa4275261821d8590e396c40f331d3bc59712533c7950216938260adb2fc63f72721a17f0b1acb36093a2c2242147039f00180fec
-  languageName: node
-  linkType: hard
-
-"@aws-sdk/credential-provider-http@npm:^3.972.61":
+"@aws-sdk/credential-provider-env@npm:^3.972.61":
   version: 3.972.61
-  resolution: "@aws-sdk/credential-provider-http@npm:3.972.61"
+  resolution: "@aws-sdk/credential-provider-env@npm:3.972.61"
   dependencies:
-    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/core": "npm:^3.977.0"
     "@aws-sdk/types": "npm:^3.974.2"
-    "@smithy/core": "npm:^3.29.4"
-    "@smithy/fetch-http-handler": "npm:^5.6.6"
-    "@smithy/node-http-handler": "npm:^4.9.6"
+    "@smithy/core": "npm:^3.29.8"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/c8d8dba6bb6ae8816ac2ccad8cb661d30a73c8414abc73972c74ef0a50ccadfaaef59b051832648b57852934dc3051d0218bd805e6beff35537f3b8a00d881fb
+  checksum: 10/baddf90e8ccc0c223f81dc3ca267e0dbdb1e88a71c862e0617f4ebaca661e33e35b60719c98293358feb5d6e044b2e38808aad49dbcba878dec3db0e78475d31
   languageName: node
   linkType: hard
 
-"@aws-sdk/credential-provider-ini@npm:^3.973.4":
-  version: 3.973.4
-  resolution: "@aws-sdk/credential-provider-ini@npm:3.973.4"
+"@aws-sdk/credential-provider-http@npm:^3.972.63":
+  version: 3.972.63
+  resolution: "@aws-sdk/credential-provider-http@npm:3.972.63"
   dependencies:
-    "@aws-sdk/core": "npm:^3.975.3"
-    "@aws-sdk/credential-provider-env": "npm:^3.972.59"
-    "@aws-sdk/credential-provider-http": "npm:^3.972.61"
-    "@aws-sdk/credential-provider-login": "npm:^3.972.66"
-    "@aws-sdk/credential-provider-process": "npm:^3.972.59"
-    "@aws-sdk/credential-provider-sso": "npm:^3.973.3"
-    "@aws-sdk/credential-provider-web-identity": "npm:^3.972.65"
-    "@aws-sdk/nested-clients": "npm:^3.997.33"
+    "@aws-sdk/core": "npm:^3.977.0"
     "@aws-sdk/types": "npm:^3.974.2"
-    "@smithy/core": "npm:^3.29.4"
-    "@smithy/credential-provider-imds": "npm:^4.4.9"
+    "@smithy/core": "npm:^3.29.8"
+    "@smithy/fetch-http-handler": "npm:^5.6.10"
+    "@smithy/node-http-handler": "npm:^4.9.10"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/4c0e53c8abfb10184984a2bd975d03bb850c0ff7a3d2a2e7c20413177cf1ac47869cc3f619084886bf933f96a36376896e0800c3ffe170ef470fedbdb114ead0
+  checksum: 10/bfc63fa4a4d6b59475d005e24d22c7cb266b8caffffe06dfea68d02bbdf5bf5ae01549a79569f683651d1049f992aeb24f370b9f057e61bfa24ac9d4b68a6452
   languageName: node
   linkType: hard
 
-"@aws-sdk/credential-provider-login@npm:^3.972.66":
-  version: 3.972.66
-  resolution: "@aws-sdk/credential-provider-login@npm:3.972.66"
+"@aws-sdk/credential-provider-ini@npm:^3.973.6":
+  version: 3.973.6
+  resolution: "@aws-sdk/credential-provider-ini@npm:3.973.6"
   dependencies:
-    "@aws-sdk/core": "npm:^3.975.3"
-    "@aws-sdk/nested-clients": "npm:^3.997.33"
+    "@aws-sdk/core": "npm:^3.977.0"
+    "@aws-sdk/credential-provider-env": "npm:^3.972.61"
+    "@aws-sdk/credential-provider-http": "npm:^3.972.63"
+    "@aws-sdk/credential-provider-login": "npm:^3.972.68"
+    "@aws-sdk/credential-provider-process": "npm:^3.972.61"
+    "@aws-sdk/credential-provider-sso": "npm:^3.973.5"
+    "@aws-sdk/credential-provider-web-identity": "npm:^3.972.67"
+    "@aws-sdk/nested-clients": "npm:^3.997.35"
     "@aws-sdk/types": "npm:^3.974.2"
-    "@smithy/core": "npm:^3.29.4"
+    "@smithy/core": "npm:^3.29.8"
+    "@smithy/credential-provider-imds": "npm:^4.4.13"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/c9a4a5aab4f7de83c35f22c8fec13661e13939634a94c298ab1895b53a0ee477d4667ac1632007bc87daedbd3789742285e1b5882567497d7fe16a961f0afe95
+  checksum: 10/22f3ce890538b9175263f2b28bd64056b70974d78b2298f62cc3a33a8b95449e70efcca38729a077b8cd1efd643c84295b824e71ee6237c622a37b88bd968b7b
   languageName: node
   linkType: hard
 
-"@aws-sdk/credential-provider-node@npm:^3.972.70":
-  version: 3.972.70
-  resolution: "@aws-sdk/credential-provider-node@npm:3.972.70"
+"@aws-sdk/credential-provider-login@npm:^3.972.68":
+  version: 3.972.68
+  resolution: "@aws-sdk/credential-provider-login@npm:3.972.68"
   dependencies:
-    "@aws-sdk/credential-provider-env": "npm:^3.972.59"
-    "@aws-sdk/credential-provider-http": "npm:^3.972.61"
-    "@aws-sdk/credential-provider-ini": "npm:^3.973.4"
-    "@aws-sdk/credential-provider-process": "npm:^3.972.59"
-    "@aws-sdk/credential-provider-sso": "npm:^3.973.3"
-    "@aws-sdk/credential-provider-web-identity": "npm:^3.972.65"
+    "@aws-sdk/core": "npm:^3.977.0"
+    "@aws-sdk/nested-clients": "npm:^3.997.35"
     "@aws-sdk/types": "npm:^3.974.2"
-    "@smithy/core": "npm:^3.29.4"
-    "@smithy/credential-provider-imds": "npm:^4.4.9"
+    "@smithy/core": "npm:^3.29.8"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/302b7e3776429c61f89f863fcc14ac866d13bd6513e8f15a09d5c56bc5e619a3b0461a680fedad97dcd3cc000ed8a3522d776b9b2ff326505e1fd1d872a96adf
+  checksum: 10/2ce33326c891f2043a3eeeaf1cbc3f287aac1b3ab28400d7a6a8244ae7e60858cd0fc2423abaffa7b2145028606e917b7afb05ead5c8ddcea6a5885396593b76
   languageName: node
   linkType: hard
 
-"@aws-sdk/credential-provider-process@npm:^3.972.59":
-  version: 3.972.59
-  resolution: "@aws-sdk/credential-provider-process@npm:3.972.59"
+"@aws-sdk/credential-provider-node@npm:^3.972.72":
+  version: 3.972.72
+  resolution: "@aws-sdk/credential-provider-node@npm:3.972.72"
   dependencies:
-    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/credential-provider-env": "npm:^3.972.61"
+    "@aws-sdk/credential-provider-http": "npm:^3.972.63"
+    "@aws-sdk/credential-provider-ini": "npm:^3.973.6"
+    "@aws-sdk/credential-provider-process": "npm:^3.972.61"
+    "@aws-sdk/credential-provider-sso": "npm:^3.973.5"
+    "@aws-sdk/credential-provider-web-identity": "npm:^3.972.67"
     "@aws-sdk/types": "npm:^3.974.2"
-    "@smithy/core": "npm:^3.29.4"
+    "@smithy/core": "npm:^3.29.8"
+    "@smithy/credential-provider-imds": "npm:^4.4.13"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/91bdaea2ff81b054ce8e508d83d5efd825a87f22ac74ac2a9f41d8310cb1211a4be7b6f33b505da2e3570b163e22faa5dfc7acd9afc73e61b98a3afb5621891e
+  checksum: 10/a13f48bfce124ce2592654f775ccc9016b633ba14eec3e7d3a28d83b042ff8c0aaac328a86e55765a5a1597ffc6c5d5aa5dbc85b84f779680c6714ac6e8ed9a5
   languageName: node
   linkType: hard
 
-"@aws-sdk/credential-provider-sso@npm:^3.973.3":
-  version: 3.973.3
-  resolution: "@aws-sdk/credential-provider-sso@npm:3.973.3"
+"@aws-sdk/credential-provider-process@npm:^3.972.61":
+  version: 3.972.61
+  resolution: "@aws-sdk/credential-provider-process@npm:3.972.61"
   dependencies:
-    "@aws-sdk/core": "npm:^3.975.3"
-    "@aws-sdk/nested-clients": "npm:^3.997.33"
-    "@aws-sdk/token-providers": "npm:3.1088.0"
+    "@aws-sdk/core": "npm:^3.977.0"
     "@aws-sdk/types": "npm:^3.974.2"
-    "@smithy/core": "npm:^3.29.4"
+    "@smithy/core": "npm:^3.29.8"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/c5194138240365f799c65c2e6daac956342e45bd2877615c959f62f1d378193509699d2480814aebdd07ce6440af05500df0aa54397d7b097371db423c0c4543
+  checksum: 10/89e4a93aa498a78baec8a97dcfbae10e921b6844c9680ca717e207940d3ae6badd7b3002a6aa61efc5166a1c2b18175da1888128103b16b1228e4a52f223dbb4
   languageName: node
   linkType: hard
 
-"@aws-sdk/credential-provider-web-identity@npm:^3.972.65":
-  version: 3.972.65
-  resolution: "@aws-sdk/credential-provider-web-identity@npm:3.972.65"
+"@aws-sdk/credential-provider-sso@npm:^3.973.5":
+  version: 3.973.5
+  resolution: "@aws-sdk/credential-provider-sso@npm:3.973.5"
   dependencies:
-    "@aws-sdk/core": "npm:^3.975.3"
-    "@aws-sdk/nested-clients": "npm:^3.997.33"
+    "@aws-sdk/core": "npm:^3.977.0"
+    "@aws-sdk/nested-clients": "npm:^3.997.35"
+    "@aws-sdk/token-providers": "npm:3.1095.0"
     "@aws-sdk/types": "npm:^3.974.2"
-    "@smithy/core": "npm:^3.29.4"
+    "@smithy/core": "npm:^3.29.8"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/9a0f2aec505420929ea78d414e8561691d6fdc0de21f7d947dbb56269236ef16d11d518f31bb0b0ff154fb92039f94211440d113ed09af9965bd5c6d5be1f9cd
+  checksum: 10/db1f4ea8408a42eb074329f033917ef49ce94e31678a0a49598543a74ccc10bfb0d3127717b29b0f7988dd44ba21bc4ab1e0fca94a0c80266577f7d764df7ea9
   languageName: node
   linkType: hard
 
-"@aws-sdk/nested-clients@npm:^3.997.33":
-  version: 3.997.33
-  resolution: "@aws-sdk/nested-clients@npm:3.997.33"
+"@aws-sdk/credential-provider-web-identity@npm:^3.972.67":
+  version: 3.972.67
+  resolution: "@aws-sdk/credential-provider-web-identity@npm:3.972.67"
   dependencies:
-    "@aws-sdk/core": "npm:^3.975.3"
-    "@aws-sdk/signature-v4-multi-region": "npm:^3.996.41"
+    "@aws-sdk/core": "npm:^3.977.0"
+    "@aws-sdk/nested-clients": "npm:^3.997.35"
     "@aws-sdk/types": "npm:^3.974.2"
-    "@smithy/core": "npm:^3.29.4"
-    "@smithy/fetch-http-handler": "npm:^5.6.6"
-    "@smithy/node-http-handler": "npm:^4.9.6"
+    "@smithy/core": "npm:^3.29.8"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/2a37d83609009b8b95b56658a48bb70fc56a1296d80701bfe12561aede13c6ebb9e678f3bfb20c5c4533ac6ebe63d4bec791760943c835917c95782eba0ec80c
+  checksum: 10/2381ae9fe9805b91da97ca8a5a9856dd6e91d244f433e0f1ecb9049870beed601d4b514e0d6f872d8e9453f60a6cf43627ff2d387f685547d976128bb91d6e45
   languageName: node
   linkType: hard
 
-"@aws-sdk/signature-v4-multi-region@npm:^3.996.41":
-  version: 3.996.41
-  resolution: "@aws-sdk/signature-v4-multi-region@npm:3.996.41"
+"@aws-sdk/nested-clients@npm:^3.997.35":
+  version: 3.997.35
+  resolution: "@aws-sdk/nested-clients@npm:3.997.35"
   dependencies:
+    "@aws-sdk/core": "npm:^3.977.0"
+    "@aws-sdk/signature-v4-multi-region": "npm:^3.996.42"
     "@aws-sdk/types": "npm:^3.974.2"
-    "@smithy/signature-v4": "npm:^5.6.5"
+    "@smithy/core": "npm:^3.29.8"
+    "@smithy/fetch-http-handler": "npm:^5.6.10"
+    "@smithy/node-http-handler": "npm:^4.9.10"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/564a619949bd62e0f53543a7193313d994351d4c710d721f926c65f58872f2de7fcce7a0f915e03968ed67a6b2ad110bdf915e1320e5590d9e04a0cbe0f48e0b
+  checksum: 10/ee0410e54978819a2173d92548054ff34518b874c9d8979e94e388661784fe45efc4317495a9ee491d5180a7d9ebec9cac8308493a892712a8f3d96d135a4dd3
   languageName: node
   linkType: hard
 
-"@aws-sdk/token-providers@npm:3.1088.0":
-  version: 3.1088.0
-  resolution: "@aws-sdk/token-providers@npm:3.1088.0"
+"@aws-sdk/signature-v4-multi-region@npm:^3.996.42":
+  version: 3.996.42
+  resolution: "@aws-sdk/signature-v4-multi-region@npm:3.996.42"
   dependencies:
-    "@aws-sdk/core": "npm:^3.975.3"
-    "@aws-sdk/nested-clients": "npm:^3.997.33"
     "@aws-sdk/types": "npm:^3.974.2"
-    "@smithy/core": "npm:^3.29.4"
+    "@smithy/signature-v4": "npm:^5.6.9"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/ae399cc5f0589f00514079f79ab1e680fee104d433d8aed80c6f761bb4cb3c5176667a0c567726a22399242a817dfd9624094801da8fbb6f14c5c8bbb882caaf
+  checksum: 10/05c6027f1938da947ec33706ec70ebbddb6a7596709a47dca316344378277015be2b5c1891a3810a7ac759ceb6ca0830bc8dcce55b26e11a392ecdf7b4d1c3c1
+  languageName: node
+  linkType: hard
+
+"@aws-sdk/token-providers@npm:3.1095.0":
+  version: 3.1095.0
+  resolution: "@aws-sdk/token-providers@npm:3.1095.0"
+  dependencies:
+    "@aws-sdk/core": "npm:^3.977.0"
+    "@aws-sdk/nested-clients": "npm:^3.997.35"
+    "@aws-sdk/types": "npm:^3.974.2"
+    "@smithy/core": "npm:^3.29.8"
+    "@smithy/types": "npm:^4.16.1"
+    tslib: "npm:^2.6.2"
+  checksum: 10/b2b2df9ee103b76ba9efb9e8d1df1f90ef3eff488c984d62ba35e8b9498a8828b16987f930c2b0ee8cb9efec0998224de6604f5a9e45f692927cb1e9aec67381
   languageName: node
   linkType: hard
 
@@ -394,13 +394,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@aws-sdk/xml-builder@npm:^3.972.36":
-  version: 3.972.36
-  resolution: "@aws-sdk/xml-builder@npm:3.972.36"
+"@aws-sdk/xml-builder@npm:^3.972.37":
+  version: 3.972.37
+  resolution: "@aws-sdk/xml-builder@npm:3.972.37"
   dependencies:
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/8080815b2061ff64b0343f4bf9899ee7b90839e56cbd869ed96a29716678f71a5589a07ee6d4bea4cb40561b37cae58b899e3ed08fec36168c332664632f5214
+  checksum: 10/20f221d158a12cb39b117e65cde8ecb19f629d5292def76adee8680dad176cf6c9f0e83a3534c65bcd40ffaf5fa8a2afd62de262c4c00b355d1c8c057c261acb
   languageName: node
   linkType: hard
 
@@ -1956,57 +1956,57 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@smithy/core@npm:^3.29.4, @smithy/core@npm:^3.29.6":
-  version: 3.29.6
-  resolution: "@smithy/core@npm:3.29.6"
+"@smithy/core@npm:^3.29.8, @smithy/core@npm:^3.30.0":
+  version: 3.30.0
+  resolution: "@smithy/core@npm:3.30.0"
   dependencies:
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/12c3021c0bda41e6201dc53c975e9a6d8b8635209004230795d11d9db96d787f593db7d8673a7b2584f143e98c3c0ba4743c698d2844a114a5e2d0fdb8382444
+  checksum: 10/3525dd3b075c9c54119b6385fded81a82beba34df93d866d118653bdef8e7a3cbece7684cfa28687c2b9ec92131c4fa21d38f1951ec4c29e71c743bcf17856cd
   languageName: node
   linkType: hard
 
-"@smithy/credential-provider-imds@npm:^4.4.9":
-  version: 4.4.11
-  resolution: "@smithy/credential-provider-imds@npm:4.4.11"
+"@smithy/credential-provider-imds@npm:^4.4.13":
+  version: 4.4.14
+  resolution: "@smithy/credential-provider-imds@npm:4.4.14"
   dependencies:
-    "@smithy/core": "npm:^3.29.6"
+    "@smithy/core": "npm:^3.30.0"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/f3ff9bcdac8ed871558106ee36e1b4fa29155de5d3fa630557beced910cb75fc222478b2806d6275dbae71e14307a55c508546195c65a54019ab49a949d1f03d
+  checksum: 10/f0ce754433b48d11d734c8c7ed0c6770f1d2a8e1e0b30cfe9396d8be75a2bc50a392e0f2ce8ece4557d17186c7975b1498d68995e5b533dd284030dcf0bd38c5
   languageName: node
   linkType: hard
 
-"@smithy/fetch-http-handler@npm:^5.6.6":
-  version: 5.6.8
-  resolution: "@smithy/fetch-http-handler@npm:5.6.8"
+"@smithy/fetch-http-handler@npm:^5.6.10":
+  version: 5.6.11
+  resolution: "@smithy/fetch-http-handler@npm:5.6.11"
   dependencies:
-    "@smithy/core": "npm:^3.29.6"
+    "@smithy/core": "npm:^3.30.0"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/996e5c8bd9b2b78d8c0395ef5c602063ba393714ea89bd459c31225117e3aaca167adae68738a47c491d6346402ff7a6f95d4d36dbf5079185ec521ec6c563ec
+  checksum: 10/381ccd03e229f155bfcc6a03fb57cb56e8a9da98f806b4a4ccfa0e55f40f61958b5c9f3f63856bd4ef1accb2d3a090c21a9df8999b28931c42d05438c239533c
   languageName: node
   linkType: hard
 
-"@smithy/node-http-handler@npm:^4.9.6":
-  version: 4.9.8
-  resolution: "@smithy/node-http-handler@npm:4.9.8"
+"@smithy/node-http-handler@npm:^4.9.10":
+  version: 4.9.11
+  resolution: "@smithy/node-http-handler@npm:4.9.11"
   dependencies:
-    "@smithy/core": "npm:^3.29.6"
+    "@smithy/core": "npm:^3.30.0"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/defb5c0603b133172b80693243856fe602f45f2c4653f303bc61e9c37c21a5610fb2b037cc359a4f8c5ff6d875fded737c69a6bdc6df3de47ddddbb11e1bf44d
+  checksum: 10/d07a049affdf2f736cc11039e688bc6df73311d3a8de87618b32382f1c6ec09420899ab3550f633d295a9993c22257ae860af621bf65988b6e4329c52f38848c
   languageName: node
   linkType: hard
 
-"@smithy/signature-v4@npm:^5.6.5":
-  version: 5.6.7
-  resolution: "@smithy/signature-v4@npm:5.6.7"
+"@smithy/signature-v4@npm:^5.6.9":
+  version: 5.6.10
+  resolution: "@smithy/signature-v4@npm:5.6.10"
   dependencies:
-    "@smithy/core": "npm:^3.29.6"
+    "@smithy/core": "npm:^3.30.0"
     "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/5d400218cefae842ce0a81c56bf554cd8822db1b6c16fb1ece03f05ce69cd590b4ec0eb78fc1acd39491697b77f4c079121787258b8ce5b1081c62c06260ae9b
+  checksum: 10/1c35391afb685a7e77518e164d335f03561bb363a45854a6b587a1508e847aa7c402e48629b1f0cbd1817946034359d52a7190145b5bed47cbd89b7bdcf75824
   languageName: node
   linkType: hard
 
@@ -3156,8 +3156,8 @@ __metadata:
   dependencies:
     "@actions/core": "npm:^3.0.1"
     "@actions/http-client": "npm:^4.0.1"
-    "@aws-sdk/client-ecr": "npm:^3.1091.0"
-    "@aws-sdk/client-ecr-public": "npm:^3.1091.0"
+    "@aws-sdk/client-ecr": "npm:^3.1095.0"
+    "@aws-sdk/client-ecr-public": "npm:^3.1095.0"
     "@docker/actions-toolkit": "npm:^0.94.0"
     "@eslint/js": "npm:^9.39.3"
     "@types/js-yaml": "npm:^4.0.9"
@@ -3174,7 +3174,7 @@ __metadata:
     globals: "npm:^17.3.0"
     http-proxy-agent: "npm:^9.1.0"
     https-proxy-agent: "npm:^9.1.0"
-    js-yaml: "npm:^5.2.1"
+    js-yaml: "npm:^5.2.2"
     prettier: "npm:^3.8.1"
     typescript: "npm:^5.9.3"
     uuid: "npm:^14.0.1"
@@ -3948,10 +3948,10 @@ __metadata:
   linkType: hard
 
 "handlebars@npm:^4.7.9":
-  version: 4.7.9
-  resolution: "handlebars@npm:4.7.9"
+  version: 4.7.10
+  resolution: "handlebars@npm:4.7.10"
   dependencies:
-    minimist: "npm:^1.2.5"
+    minimist: "npm:^1.2.8"
     neo-async: "npm:^2.6.2"
     source-map: "npm:^0.6.1"
     uglify-js: "npm:^3.1.4"
@@ -3961,7 +3961,7 @@ __metadata:
       optional: true
   bin:
     handlebars: bin/handlebars
-  checksum: 10/e755433d652e8a15fc02f83d7478e652359e7a4d354c4328818853ed4f8a39d4a09e1d22dad3c7213c5240864a65b3c840970b8b181745575dd957dd258f2b8d
+  checksum: 10/e7df9b9986594384de11ea27d2f9c694f90dca9ff768ac28851b4cf89f6268a3177ec50c9bb1601c8841f67bee25598b37bdcd53d1f7acd3744619f938ad1f53
   languageName: node
   linkType: hard
 
@@ -4357,6 +4357,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"js-yaml@npm:^5.2.2":
+  version: 5.2.2
+  resolution: "js-yaml@npm:5.2.2"
+  dependencies:
+    argparse: "npm:^2.0.1"
+  bin:
+    js-yaml: bin/js-yaml.mjs
+  checksum: 10/2b4c2933af12c97e1c4894a4f27fe9b06dab70a64a96bb50624b4429bef6bf11008bde20d868bce52a36784473314efc30078ba6025b58cf7537961e23b1ae9c
+  languageName: node
+  linkType: hard
+
 "jsbn@npm:1.1.0":
   version: 1.1.0
   resolution: "jsbn@npm:1.1.0"
@@ -4690,7 +4701,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"minimist@npm:^1.2.5, minimist@npm:^1.2.6":
+"minimist@npm:^1.2.6, minimist@npm:^1.2.8":
   version: 1.2.8
   resolution: "minimist@npm:1.2.8"
   checksum: 10/908491b6cc15a6c440ba5b22780a0ba89b9810e1aea684e253e43c4e3b8d56ec1dcdd7ea96dde119c29df59c936cde16062159eae4225c691e19c70b432b6e6f
@@ -4853,12 +4864,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"nanoid@npm:^3.3.11":
-  version: 3.3.11
-  resolution: "nanoid@npm:3.3.11"
+"nanoid@npm:^3.3.16":
+  version: 3.3.16
+  resolution: "nanoid@npm:3.3.16"
   bin:
     nanoid: bin/nanoid.cjs
-  checksum: 10/73b5afe5975a307aaa3c95dfe3334c52cdf9ae71518176895229b8d65ab0d1c0417dd081426134eb7571c055720428ea5d57c645138161e7d10df80815527c48
+  checksum: 10/8004af92b5541af1dbd23b69845b5026f777d5b7ef07163cea1837aae86e052ced8b383cecbf8a4f1b5e77ae207df96dc45e16b9e0fa3c4b761d085f1e42851b
   languageName: node
   linkType: hard
 
@@ -5281,13 +5292,13 @@ __metadata:
   linkType: hard
 
 "postcss@npm:^8.5.6":
-  version: 8.5.10
-  resolution: "postcss@npm:8.5.10"
+  version: 8.5.22
+  resolution: "postcss@npm:8.5.22"
   dependencies:
-    nanoid: "npm:^3.3.11"
+    nanoid: "npm:^3.3.16"
     picocolors: "npm:^1.1.1"
     source-map-js: "npm:^1.2.1"
-  checksum: 10/7eac6169e535b63c8412e94d4f6047fc23efa3e9dde804b541940043c831b25f1cd867d83cd2c4371ad2450c8abcb42c208aa25668c1f0f3650d7f72faf711a8
+  checksum: 10/7944444f267f2d94c7caeed66f3da56d5b947bd4a7e57a166a5161af25c6006dd73f40e2a1a6822f3d7fccc2fa005778c03058368eb7efca1b5038aec55abd14
   languageName: node
   linkType: hard