From 5fac1416c6bb3ea7897b776a397afdb1b25ef593 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C3=ABl=20Pailloncy?=
 <mpailloncy@users.noreply.github.com>
Date: Mon, 21 Sep 2026 10:42:07 +0000
Subject: [PATCH] ci: use GitHub OIDC for Docker Hub auth in publish-agent

Replace the manual docker login using the long-lived HUB_OAT PAT
with docker/login-action's Docker Hub OIDC support. Requires
id-token: write and a DOCKERHUB_OIDC_CONNECTIONID repo variable
pointing at the Hub-side OIDC connection.

Refs docker/gordon#753
---
 .github/workflows/release.yml | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 103ce09..e77f244 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -368,6 +368,7 @@ jobs:
     environment: release
     permissions:
       contents: read
+      id-token: write
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -388,15 +389,12 @@ jobs:
           chmod +x docker-agent
           sudo mv docker-agent /usr/local/bin/
 
-      - name: Docker Hub login
+      - name: Login to Docker Hub
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         env:
-          HUB_ORG: ${{ secrets.HUB_ORG }}
-          HUB_OAT: ${{ secrets.HUB_OAT }}
-        run: |
-          set -e
-          if [ -z "${HUB_ORG}" ]; then echo "::error::HUB_ORG secret is not set"; exit 1; fi
-          if [ -z "${HUB_OAT}" ]; then echo "::error::HUB_OAT secret is not set"; exit 1; fi
-          echo "${HUB_OAT}" | docker login --username "${HUB_ORG}" --password-stdin
+          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
+        with:
+          username: ${{ secrets.HUB_ORG }}
 
       - name: Push agent
         env: