From 9cf00ce9f1c05cd8f27308ae62b4c418dc55a723 Mon Sep 17 00:00:00 2001 From: Lior Poterman <191881919+cx-lior-poterman@users.noreply.github.com> Date: Mon, 7 Sep 2026 12:41:01 +0300 Subject: [PATCH] fix(ci): use Docker Hub OIDC in 2ms release workflow The release job's Docker Hub login referenced DOCKERHUB_USERNAME and DOCKERHUB_TOKEN secrets that no longer exist as repo, org, or environment secrets, so the login step was authenticating with empty credentials. Switch to OIDC federation like kics and ast-cli: declare the release environment (needed to resolve the environment-scoped DOCKERHUB_OIDC_CONNECTIONID secret), add the id-token: write and contents: write permissions, and bump docker-login-action to the OIDC capable version. Also drop the dead dockerhub-description step, which relied on the same removed credentials and has no OIDC equivalent, and update CODEOWNERS to the team that gates the release environment. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/CODEOWNERS | 2 +- .github/workflows/release.yml | 18 ++++++++---------- 2 files changed, 9 insertions(+), 11 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 10ea74a1..1442b3a6 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1 +1 @@ -* @Checkmarx/2ms-dev +* @Checkmarx/cx-maintainers-kics diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 49367f9f..cb49bc64 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -53,6 +53,10 @@ jobs: runs-on: cx-public-ubuntu-x64 needs: test if: ${{ needs.test.outputs.git_tag }} + environment: release + permissions: + contents: write # for creating the GitHub release + id-token: write # for Docker Hub OIDC federation steps: - name: Checkout code uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 @@ -128,10 +132,11 @@ jobs: uses: step-security/setup-buildx-action@f931205d68723ad9589fd2a7e2ece238bf9de341 # v4.0.0 - name: Login to DockerHub - uses: step-security/docker-login-action@870af644803bf9f204aed474adbad2958fec048b # v4.1.0 + uses: step-security/docker-login-action@bd6978fd4ef9a5f78130095b298b8a721afcb0d8 # v4.5.1 with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} + username: ${{ vars.DOCKERHUB_USERNAME }} + env: + DOCKERHUB_OIDC_CONNECTIONID: ${{ secrets.DOCKERHUB_OIDC_CONNECTIONID }} - name: Creating Release uses: step-security/action-gh-release@277bfa82abcfdb73e5bbb19e213fd76532ee2be5 # v3.0.0 @@ -152,10 +157,3 @@ jobs: tags: | checkmarx/2ms:latest checkmarx/2ms:${{ needs.test.outputs.version }} - - - name: Update Docker repo description - uses: peter-evans/dockerhub-description@e98e4d1628a5f3be2be7c231e50981aee98723ae # v4.0.0 - with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - repository: checkmarx/2ms