GitHub 登录到 Docker 注册表的操作
GitHub Action to login against a Docker registry.
When authenticating to Docker Hub with GitHub Actions, use a personal access token. Don't use your account password.
name: ci
on:
push:
branches: main
jobs:
login:
runs-on: ubuntu-latest
steps:
-
name: Login to Docker Hub
uses: docker/login-action@v4
with:
username: ${{ vars.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
You can also authenticate to Docker Hub with OpenID Connect
when your Docker Hub organization has an OIDC connection configured. The
workflow must grant the id-token: write permission, pass the Docker Hub
organization name as username, omit password, and set the OIDC connection
ID in DOCKERHUB_OIDC_CONNECTIONID environment variable.
name: ci
on:
push:
branches: main
permissions:
contents: read
id-token: write
jobs:
login:
runs-on: ubuntu-latest
steps:
-
name: Login to Docker Hub
uses: docker/login-action@v4
env:
DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
with:
username: ${{ vars.DOCKERHUB_ORGANIZATION }}
To authenticate to the GitHub Container Registry,
use the GITHUB_TOKEN
secret.
name: ci
on:
push:
branches: main
jobs:
login:
runs-on: ubuntu-latest
steps:
-
name: Login to GitHub Container Registry
uses: docker/login-action@v4
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
You may need to manage write and read access of GitHub Actions for repositories in the container settings.
You can also use a personal access token (PAT) with the appropriate scopes.
name: ci
on:
push:
branches: main
jobs:
login:
runs-on: ubuntu-latest
steps:
-
name: Login to GitLab
uses: docker/login-action@v4
with:
registry: registry.gitlab.com
username: ${{ vars.GITLAB_USERNAME }}
password: ${{ secrets.GITLAB_PASSWORD }}
If you have Two-Factor Authentication enabled, use a Personal Access Token instead of a password.
Create a service principal with access to your container registry through the Azure CLI and take note of the generated service principal's ID (also called client ID) and password (also called client secret).
name: ci
on:
push:
branches: main
jobs:
login:
runs-on: ubuntu-latest
steps:
-
name: Login to ACR
uses: docker/login-action@v4
with:
registry: <registry-name>.azurecr.io
username: ${{ vars.AZURE_CLIENT_ID }}
password: ${{ secrets.AZURE_CLIENT_SECRET }}
[!NOTE] Replace
<registry-name>with the name of your registry.
To authenticate with OpenID Connect, configure a federated identity credential for GitHub Actions and use the Azure Login action to sign in to Azure. Then expose an ACR access token and pass it to this action as the password.
…
[!NOTE] Replace
<registry-name>with the name of your registry.
[!NOTE] Google Artifact Registry is the evolution of Google Container Registry. As a fully-managed service with support for both container images and non-container artifacts. If you currently use Google Container Registry, use the information on this page to learn about transitioning to Google Artifact Registry.
You can authenticate with workload identity federation or a service account.
Configure the workload identity federation for GitHub Actions in Google Cloud,
see here.
Your service account must have permission to push to GCR. Use the
google-github-actions/auth action to authenticate using workload identity as
shown in the following example:
name: ci
on:
push:
branches: main
jobs:
login:
runs-on: ubuntu-latest
steps:
-
name: Authenticate to Google Cloud
id: auth
uses: google-github-actions/auth@v3
with:
token_format: access_token
workload_identity_provider: <workload_identity_provider>
service_account: <service_account>
-
name: Login to GCR
uses: docker/login-action@v4
with:
registry: gcr.io
username: oauth2accesstoken
password: ${{ steps.auth.outputs.access_token }}
[!NOTE] Replace
<workload_identity_provider>with configured workload identity provider. For steps to configure, see here.Replace
<service_account>with configured service account in workload identity provider which has access to push to GCR
Use a service account with permission to push to GCR and configure access control.
Download the key for the service account as a JSON file. Save the contents of
the file as a secret
named GCR_JSON_KEY in your GitHub repository. Set the username to _json_key.
name: ci
on:
push:
branches: main
jobs:
login:
runs-on: ubuntu-latest
steps:
-
name: Login to GCR
uses: docker/login-action@v4
with:
registry: gcr.io
username: _json_key
password: ${{ secrets.GCR_JSON_KEY }}
You can authenticate with workload identity federation or a service account.
Your service account must have permission to push to GAR. Use the
google-github-actions/auth action to authenticate using workload identity as
shown in the following example:
…
[!NOTE] Replace
<workload_identity_provider>with configured workload identity providerReplace
<service_account>with configured service account in workload identity provider which has access to push to GCRReplace
<location>with the regional or multi-regional location of the repository where the image is stored.
Use a service account with permission to push to GAR and configure access control.
Download the key for the service account as a JSON file. Save the contents of
the file as a secret
named GAR_JSON_KEY in your GitHub repository. Set the username to _json_key,
or _json_key_base64 if you use a base64-encoded key.
name: ci
on:
push:
branches: main
jobs:
login:
runs-on: ubuntu-latest
steps:
-
name: Login to GAR
uses: docker/login-action@v4
with:
registry: <location>-docker.pkg.dev
username: _json_key
password: ${{ secrets.GAR_JSON_KEY }}
[!NOTE] Replace
<location>with the regional or multi-regional location of the repository where the image is stored.
Use an IAM user with the ability to push to ECR with AmazonEC2ContainerRegistryPowerUser managed policy for example.
Download the access keys and save them as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as secrets
in your GitHub repo.
name: ci
on:
push:
branches: main
jobs:
login:
runs-on: ubuntu-latest
steps:
-
name: Login to ECR
uses: docker/login-action@v4
with:
registry: <aws-account-number>.dkr.ecr.<region>.amazonaws.com
username: ${{ vars.AWS_ACCESS_KEY_ID }}
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
If you need to log in to Amazon ECR registries associated with other accounts,
you can use the AWS_ACCOUNT_IDS environment variable:
name: ci
on:
push:
branches: main
jobs:
login:
runs-on: ubuntu-latest
steps:
-
name: Login to ECR
uses: docker/login-action@v4
with:
registry: <aws-account-number>.dkr.ecr.<region>.amazonaws.com
username: ${{ vars.AWS_ACCESS_KEY_ID }}
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
env:
AWS_ACCOUNT_IDS: 012345678910,023456789012
[!NOTE] Only available with AWS CLI version 1
You can also use the Configure AWS Credentials action in combination with this action:
name: ci
on:
push:
branches: main
jobs:
login:
runs-on: ubuntu-latest
steps:
-
name:
暂无开放 Issues，或尚未同步最近议题。