Merge pull request #1037 from docker/dependabot/npm_and_yarn/aws-sdk-dependencies-001763bcc2

build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 updates

.github/dependabot.yml

@@ -10,6 +10,9 @@ updates:
       crazy-max-dot-github:
         patterns:
           - "crazy-max/.github/*"
+      codeql-actions:
+        patterns:
+          - "github/codeql-action/*"
     labels:
       - "dependencies"
       - "bot"

.github/workflows/ci.yml

@@ -25,7 +25,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Stop docker
         run: |
@@ -49,7 +49,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to GitHub Container Registry
         uses: ./
@@ -67,7 +67,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to GitHub Container Registry
         uses: ./
@@ -97,7 +97,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to GitHub Container Registry
         uses: ./
@@ -122,7 +122,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to ACR
         uses: ./
@@ -142,7 +142,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to Docker Hub
         uses: ./
@@ -150,6 +150,29 @@ jobs:
           username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
           password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
 
+  dockerhub-oidc:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - windows-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      -
+        name: Login to Docker Hub with OIDC
+        uses: ./
+        env:
+          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
+        with:
+          username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
+
   ecr:
     runs-on: ${{ matrix.os }}
     strategy:
@@ -161,7 +184,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to ECR
         uses: ./
@@ -181,10 +204,10 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -209,10 +232,10 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
         with:
           role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd_login_action
           aws-region: us-east-1
@@ -233,7 +256,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to Public ECR
         continue-on-error: ${{ matrix.os == 'windows-latest' }}
@@ -256,10 +279,10 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -285,10 +308,10 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
         with:
           role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd_login_action
           aws-region: us-east-1
@@ -310,7 +333,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to GitHub Container Registry
         uses: ./
@@ -330,7 +353,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to GitLab
         uses: ./
@@ -350,7 +373,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to Google Artifact Registry
         uses: ./
@@ -370,7 +393,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to Google Container Registry
         uses: ./
@@ -384,7 +407,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to registries
         uses: ./
@@ -407,7 +430,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to registries
         uses: ./
@@ -428,7 +451,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to registries
         id: login
@@ -460,7 +483,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to Docker Hub
         uses: ./
@@ -490,7 +513,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to Docker Hub
         uses: ./
@@ -520,7 +543,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to GitHub Container Registry
         uses: ./
@@ -551,7 +574,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Login to GitHub Container Registry
         uses: ./

.github/workflows/codeql.yml

@@ -22,7 +22,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Enable corepack
         run: |
@@ -30,17 +30,17 @@ jobs:
           yarn --version
       -
         name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       -
         name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
         with:
           languages: javascript-typescript
           build-mode: none
       -
         name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
         with:
           category: "/language:javascript-typescript"

.github/workflows/publish.yml

@@ -22,7 +22,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Publish
         uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4

.github/workflows/test.yml

@@ -20,7 +20,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Test
         uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0

.github/workflows/update-dist.yml

@@ -30,7 +30,7 @@ jobs:
           permission-contents: write
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           fetch-depth: 0

.github/workflows/validate.yml

@@ -22,7 +22,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Generate matrix
         id: generate

README.md

@@ -28,6 +28,7 @@ ___
   * [Set scopes for the authentication token](#set-scopes-for-the-authentication-token)
 * [Customizing](#customizing)
   * [inputs](#inputs)
+  * [environment variables](#environment-variables)
 * [Contributing](#contributing)
 
 ## Usage
@@ -57,6 +58,36 @@ jobs:
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 ```
 
+You can also [authenticate to Docker Hub with OpenID Connect](https://docs.docker.com/enterprise/security/oidc-connections/)
+when your Docker Hub organization has an OIDC connection configured. The
+workflow must grant the `id-token: write` permission, pass the Docker Hub
+organization name as `username`, omit `password`, and set the OIDC connection
+ID in `DOCKERHUB_OIDC_CONNECTIONID` environment variable.
+
+```yaml
+name: ci
+
+on:
+  push:
+    branches: main
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  login:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Login to Docker Hub
+        uses: docker/login-action@v4
+        env:
+          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
+        with:
+          username: ${{ vars.DOCKERHUB_ORGANIZATION }}
+```
+
 ### GitHub Container Registry
 
 To authenticate to the [GitHub Container Registry](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry),
@@ -690,6 +721,15 @@ The following inputs can be used as `step.with` keys:
 > [!NOTE]
 > The `registry-auth` input cannot be used with other inputs except `logout`.
 
+### environment variables
+
+The following environment variables can be set as `step.env` keys:
+
+| Name                          | Type   | Default | Description                                                                 |
+|-------------------------------|--------|---------|-----------------------------------------------------------------------------|
+| `DOCKERHUB_OIDC_CONNECTIONID` | String |         | Docker Hub OIDC connection ID. Required for Docker Hub OIDC login           |
+| `DOCKERHUB_OIDC_EXPIREIN`     | Number | `300`   | Docker Hub OIDC token lifetime in seconds. Must be between `300` and `3600` |
+
 ## Contributing
 
 Want to contribute? Awesome! You can find information about contributing to

__tests__/dockerhub.test.ts

@@ -0,0 +1,133 @@
+import * as core from '@actions/core';
+import * as httpm from '@actions/http-client';
+import {beforeEach, describe, expect, test, vi} from 'vitest';
+
+import * as dockerhub from '../src/dockerhub.js';
+
+vi.mock('@actions/core', () => ({
+  getIDToken: vi.fn(),
+  info: vi.fn(),
+  setSecret: vi.fn()
+}));
+
+const validConnectionID = '123e4567-e89b-42d3-a456-426614174000';
+
+const httpResponse = (statusCode: number, body: string, headers: Record<string, string> = {}): httpm.HttpClientResponse => {
+  return {
+    message: {
+      statusCode,
+      headers
+    },
+    readBody: vi.fn(async () => body)
+  } as unknown as httpm.HttpClientResponse;
+};
+
+describe('isDockerHubOIDC', () => {
+  beforeEach(() => {
+    delete process.env.DOCKERHUB_OIDC_CONNECTIONID;
+  });
+
+  test.each(['', 'docker.io', 'registry-1.docker.io', 'registry-1-stage.docker.io'])('detects Docker Hub registry %p with empty password', registry => {
+    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
+    expect(dockerhub.isDockerHubOIDC(registry, '')).toBe(true);
+  });
+
+  test('requires connection ID env var', () => {
+    expect(dockerhub.isDockerHubOIDC('docker.io', '')).toBe(false);
+  });
+
+  test('requires empty password', () => {
+    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
+    expect(dockerhub.isDockerHubOIDC('docker.io', 'groundcontrol')).toBe(false);
+  });
+
+  test('ignores non-Docker Hub registries', () => {
+    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
+    expect(dockerhub.isDockerHubOIDC('ghcr.io', '')).toBe(false);
+  });
+});
+
+describe('getOIDCToken', () => {
+  const getIDTokenMock = vi.mocked(core.getIDToken);
+  const setSecretMock = vi.mocked(core.setSecret);
+  let postSpy: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
+    delete process.env.DOCKERHUB_OIDC_EXPIREIN;
+    getIDTokenMock.mockResolvedValue('github-id-token');
+    postSpy = vi.spyOn(httpm.HttpClient.prototype, 'post').mockResolvedValue(httpResponse(200, JSON.stringify({access_token: 'hub-token'})));
+  });
+
+  test('exchanges GitHub OIDC token for Docker Hub token', async () => {
+    const credentials = await dockerhub.getOIDCToken('docker.io', 'dbowie');
+
+    expect(credentials).toEqual({
+      username: 'dbowie',
+      token: 'hub-token'
+    });
+    expect(getIDTokenMock).toHaveBeenCalledWith('https://identity.docker.com');
+    expect(postSpy).toHaveBeenCalledTimes(1);
+    expect(postSpy.mock.calls[0][0]).toBe('https://identity.docker.com/oauth/token');
+
+    const http = postSpy.mock.contexts[0] as httpm.HttpClient;
+    expect(http.userAgent).toBe('github.com/docker/login-action');
+    expect(http.requestOptions?.headers).toEqual({
+      'Content-Type': 'application/x-www-form-urlencoded'
+    });
+
+    const body = new URLSearchParams(postSpy.mock.calls[0][1]);
+    expect(body.get('grant_type')).toBe('urn:ietf:params:oauth:grant-type:token-exchange');
+    expect(body.get('subject_token_type')).toBe('urn:ietf:params:oauth:token-type:id_token');
+    expect(body.get('subject_token')).toBe('github-id-token');
+    expect(body.get('connection_id')).toBe(validConnectionID);
+    expect(body.get('expires_in')).toBe('300');
+    expect(setSecretMock).toHaveBeenCalledWith('hub-token');
+  });
+
+  test('uses custom token expiration', async () => {
+    process.env.DOCKERHUB_OIDC_EXPIREIN = '900';
+    await dockerhub.getOIDCToken('docker.io', 'dbowie');
+    const body = new URLSearchParams(postSpy.mock.calls[0][1]);
+    expect(body.get('expires_in')).toBe('900');
+  });
+
+  test('uses stage identity host for stage registry', async () => {
+    await dockerhub.getOIDCToken('registry-1-stage.docker.io', 'dbowie');
+    expect(getIDTokenMock).toHaveBeenCalledWith('https://identity-stage.docker.com');
+    expect(postSpy.mock.calls[0][0]).toBe('https://identity-stage.docker.com/oauth/token');
+  });
+
+  test('requires connection ID env var', async () => {
+    delete process.env.DOCKERHUB_OIDC_CONNECTIONID;
+    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('DOCKERHUB_OIDC_CONNECTIONID is required for Docker Hub OIDC login');
+    expect(getIDTokenMock).not.toHaveBeenCalled();
+    expect(postSpy).not.toHaveBeenCalled();
+  });
+
+  test('validates connection ID', async () => {
+    process.env.DOCKERHUB_OIDC_CONNECTIONID = 'not-a-uuid';
+    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('Invalid DOCKERHUB_OIDC_CONNECTIONID. Must be a valid UUID.');
+    expect(getIDTokenMock).not.toHaveBeenCalled();
+    expect(postSpy).not.toHaveBeenCalled();
+  });
+
+  test.each(['not-a-number', '299', '3601'])('validates token expiration %p', async expiresIn => {
+    process.env.DOCKERHUB_OIDC_EXPIREIN = expiresIn;
+    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow(`Invalid DOCKERHUB_OIDC_EXPIREIN: ${expiresIn}. Must be between 300 and 3600`);
+    expect(getIDTokenMock).not.toHaveBeenCalled();
+    expect(postSpy).not.toHaveBeenCalled();
+  });
+
+  test('retries rate limited token requests with Retry-After', async () => {
+    postSpy.mockResolvedValueOnce(httpResponse(429, '', {'retry-after': '0'})).mockResolvedValueOnce(httpResponse(200, JSON.stringify({access_token: 'hub-token'})));
+    await dockerhub.getOIDCToken('docker.io', 'dbowie');
+    expect(postSpy).toHaveBeenCalledTimes(2);
+    expect(core.info).toHaveBeenCalledWith('Docker Hub OIDC token request rate limited, retrying in 0ms (attempt 1/5)');
+  });
+
+  test('throws Docker Hub API errors', async () => {
+    postSpy.mockResolvedValue(httpResponse(400, JSON.stringify({description: 'bad connection'})));
+    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('Docker Hub API: bad status code 400: bad connection');
+  });
+});

dist/licenses.txt

@@ -3,7 +3,7 @@ https://www.npmjs.com/package/generate-license-file
 
 The following npm package may be included in this product:
 
- - @aws/lambda-invoke-store@0.2.3
+ - @aws/lambda-invoke-store@0.3.0
 
 This package contains the following license:
 
@@ -399,7 +399,7 @@ Apache License
 
 The following npm package may be included in this product:
 
- - @docker/actions-toolkit@0.92.0
+ - @docker/actions-toolkit@0.94.0
 
 This package contains the following license:
 
@@ -1913,8 +1913,8 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/client-ecr-public@3.1077.0
- - @aws-sdk/client-ecr@3.1077.0
+ - @aws-sdk/client-ecr-public@3.1091.0
+ - @aws-sdk/client-ecr@3.1091.0
 
 These packages each contain the following license:
 
@@ -2124,9 +2124,9 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/signature-v4-multi-region@3.996.37
- - @smithy/core@3.28.0
- - @smithy/types@4.15.0
+ - @aws-sdk/signature-v4-multi-region@3.996.41
+ - @smithy/core@3.29.6
+ - @smithy/types@4.16.1
 
 These packages each contain the following license:
 
@@ -2398,7 +2398,7 @@ SOFTWARE.
 
 The following npm package may be included in this product:
 
- - js-yaml@5.2.0
+ - js-yaml@5.2.1
 
 This package contains the following license:
 
@@ -3175,7 +3175,7 @@ software or this license, under any kind of legal claim.***
 
 The following npm package may be included in this product:
 
- - @aws-sdk/core@3.974.25
+ - @aws-sdk/core@3.975.3
 
 This package contains the following license:
 
@@ -3385,16 +3385,16 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-env@3.972.51
- - @aws-sdk/credential-provider-ini@3.972.58
- - @aws-sdk/credential-provider-node@3.972.60
- - @aws-sdk/token-providers@3.1077.0
- - @aws-sdk/types@3.973.14
- - @aws-sdk/xml-builder@3.972.32
- - @smithy/credential-provider-imds@4.4.4
- - @smithy/fetch-http-handler@5.6.1
- - @smithy/node-http-handler@4.9.1
- - @smithy/signature-v4@5.6.0
+ - @aws-sdk/credential-provider-env@3.972.59
+ - @aws-sdk/credential-provider-ini@3.973.4
+ - @aws-sdk/credential-provider-node@3.972.70
+ - @aws-sdk/token-providers@3.1088.0
+ - @aws-sdk/types@3.974.2
+ - @aws-sdk/xml-builder@3.972.36
+ - @smithy/credential-provider-imds@4.4.11
+ - @smithy/fetch-http-handler@5.6.8
+ - @smithy/node-http-handler@4.9.8
+ - @smithy/signature-v4@5.6.7
 
 These packages each contain the following license:
 
@@ -3604,9 +3604,9 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-process@3.972.51
- - @aws-sdk/credential-provider-sso@3.972.57
- - @aws-sdk/credential-provider-web-identity@3.972.57
+ - @aws-sdk/credential-provider-process@3.972.59
+ - @aws-sdk/credential-provider-sso@3.973.3
+ - @aws-sdk/credential-provider-web-identity@3.972.65
 
 These packages each contain the following license:
 
@@ -3880,9 +3880,9 @@ END OF TERMS AND CONDITIONS
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-http@3.972.53
- - @aws-sdk/credential-provider-login@3.972.57
- - @aws-sdk/nested-clients@3.997.25
+ - @aws-sdk/credential-provider-http@3.972.61
+ - @aws-sdk/credential-provider-login@3.972.66
+ - @aws-sdk/nested-clients@3.997.33
  - @sigstore/verify@4.1.0
 
 These packages each contain the following license:
@@ -4590,7 +4590,7 @@ USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 The following npm packages may be included in this product:
 
- - brace-expansion@1.1.13
+ - brace-expansion@1.1.16
  - brace-expansion@2.0.3
 
 These packages each contain the following license:
@@ -5562,7 +5562,7 @@ THE SOFTWARE.
 
 The following npm package may be included in this product:
 
- - csv-parse@7.0.0
+ - csv-parse@7.0.1
 
 This package contains the following license:
 
@@ -5590,6 +5590,24 @@ SOFTWARE.
 
 -----------
 
+The following npm package may be included in this product:
+
+ - uuid@14.0.1
+
+This package contains the following license:
+
+The MIT License (MIT)
+
+Copyright (c) 2010-2020 Robert Kieffer and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+-----------
+
 The following npm package may be included in this product:
 
  - tunnel@0.0.6
@@ -6207,7 +6225,7 @@ THE SOFTWARE.
 The following npm packages may be included in this product:
 
  - @actions/artifact@6.2.1
- - @actions/cache@6.1.0
+ - @actions/cache@6.2.0
  - @actions/core@3.0.0
  - @actions/core@3.0.1
  - @actions/exec@3.0.0

package.json

@@ -24,12 +24,14 @@
   "packageManager": "yarn@4.15.0",
   "dependencies": {
     "@actions/core": "^3.0.1",
-    "@aws-sdk/client-ecr": "^3.1077.0",
-    "@aws-sdk/client-ecr-public": "^3.1077.0",
-    "@docker/actions-toolkit": "^0.92.0",
+    "@actions/http-client": "^4.0.1",
+    "@aws-sdk/client-ecr": "^3.1091.0",
+    "@aws-sdk/client-ecr-public": "^3.1091.0",
+    "@docker/actions-toolkit": "^0.94.0",
     "http-proxy-agent": "^9.1.0",
     "https-proxy-agent": "^9.1.0",
-    "js-yaml": "^5.2.0"
+    "js-yaml": "^5.2.1",
+    "uuid": "^14.0.1"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.3",

src/docker.ts

@@ -4,12 +4,20 @@ import {Docker} from '@docker/actions-toolkit/lib/docker/docker.js';
 
 import * as aws from './aws.js';
 import * as context from './context.js';
+import * as dockerhub from './dockerhub.js';
 
 export async function login(auth: context.Auth): Promise<void> {
   if (/true/i.test(auth.ecr) || (auth.ecr == 'auto' && aws.isECR(auth.registry))) {
     await loginECR(auth.registry, auth.username, auth.password, auth.scope);
   } else {
-    await loginStandard(auth.registry, auth.username, auth.password, auth.scope);
+    let username = auth.username;
+    let password = auth.password;
+    if (dockerhub.isDockerHubOIDC(auth.registry, password)) {
+      const credentials = await dockerhub.getOIDCToken(auth.registry, username);
+      username = credentials.username;
+      password = credentials.token;
+    }
+    await loginStandard(auth.registry, username, password, auth.scope);
   }
 }
 

src/dockerhub.ts

@@ -0,0 +1,134 @@
+import * as core from '@actions/core';
+import * as httpm from '@actions/http-client';
+import {HttpCodes} from '@actions/http-client';
+import {validate as uuidValidate} from 'uuid';
+
+export interface LoginCredentials {
+  username: string;
+  token: string;
+}
+
+interface OIDCTokenResponse {
+  access_token: string;
+}
+
+const defaultExpiresIn = 300;
+const minExpiresIn = 300;
+const maxExpiresIn = 3600;
+const maxRetries = 5;
+
+export const isDockerHubOIDC = (registry: string, password: string): boolean => {
+  return process.env.DOCKERHUB_OIDC_CONNECTIONID !== undefined && !password && isDockerHubRegistry(registry);
+};
+
+const isDockerHubRegistry = (registry: string): boolean => {
+  return registry === '' || registry === 'docker.io' || registry === 'registry-1.docker.io' || registry === 'registry-1-stage.docker.io';
+};
+
+export const getOIDCToken = async (registry: string, username: string): Promise<LoginCredentials> => {
+  const connectionID = process.env.DOCKERHUB_OIDC_CONNECTIONID?.trim();
+  if (!connectionID) {
+    throw new Error('DOCKERHUB_OIDC_CONNECTIONID is required for Docker Hub OIDC login');
+  }
+
+  if (!uuidValidate(connectionID)) {
+    throw new Error('Invalid DOCKERHUB_OIDC_CONNECTIONID. Must be a valid UUID.');
+  }
+
+  const expiresIn = getExpiresIn();
+  const identityHost = registry === 'registry-1-stage.docker.io' ? 'identity-stage.docker.com' : 'identity.docker.com';
+  const audience = `https://${identityHost}`;
+  const idToken = await core.getIDToken(audience);
+  const http: httpm.HttpClient = new httpm.HttpClient('github.com/docker/login-action', [], {
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded'
+    }
+  });
+
+  const data = new URLSearchParams();
+  data.set('grant_type', 'urn:ietf:params:oauth:grant-type:token-exchange');
+  data.set('subject_token_type', 'urn:ietf:params:oauth:token-type:id_token');
+  data.set('subject_token', idToken);
+  data.set('connection_id', connectionID);
+  data.set('expires_in', expiresIn.toString());
+
+  const resp = await postWithRetry(http, `https://${identityHost}/oauth/token`, data.toString());
+
+  const tokenResp = <OIDCTokenResponse>JSON.parse(await handleResponse(resp));
+  core.setSecret(tokenResp.access_token);
+
+  return {
+    username,
+    token: tokenResp.access_token
+  };
+};
+
+const getExpiresIn = (): number => {
+  const expiresInInput = process.env.DOCKERHUB_OIDC_EXPIREIN?.trim() || defaultExpiresIn.toString();
+  const expiresIn = Number(expiresInInput);
+  if (isNaN(expiresIn) || expiresIn < minExpiresIn || expiresIn > maxExpiresIn) {
+    throw new Error(`Invalid DOCKERHUB_OIDC_EXPIREIN: ${expiresInInput}. Must be between ${minExpiresIn} and ${maxExpiresIn}`);
+  }
+  return expiresIn;
+};
+
+const postWithRetry = async (http: httpm.HttpClient, url: string, data: string): Promise<httpm.HttpClientResponse> => {
+  let resp = await http.post(url, data);
+  for (let attempt = 0; (resp.message.statusCode || HttpCodes.InternalServerError) === HttpCodes.TooManyRequests && attempt < maxRetries; attempt++) {
+    const delay = parseRetryAfter(resp.message.headers['retry-after']);
+    if (delay === null) {
+      break;
+    }
+    await resp.readBody();
+    core.info(`Docker Hub OIDC token request rate limited, retrying in ${delay}ms (attempt ${attempt + 1}/${maxRetries})`);
+    await new Promise(resolve => setTimeout(resolve, delay));
+    resp = await http.post(url, data);
+  }
+  return resp;
+};
+
+const parseRetryAfter = (value: string | string[] | undefined): number | null => {
+  if (value === undefined) {
+    return null;
+  }
+  if (Array.isArray(value)) {
+    value = value[0];
+  }
+  const seconds = Number(value);
+  if (isNaN(seconds)) {
+    return null;
+  }
+  return Math.max(0, seconds * 1000);
+};
+
+const handleResponse = async (resp: httpm.HttpClientResponse): Promise<string> => {
+  const body = await resp.readBody();
+  const statusCode = resp.message.statusCode || HttpCodes.InternalServerError;
+  if (statusCode < HttpCodes.OK || statusCode >= HttpCodes.MultipleChoices) {
+    throw parseError(statusCode, body);
+  }
+  return body;
+};
+
+const parseError = (statusCode: number, body: string): Error => {
+  if (statusCode === 401) {
+    throw new Error(`Docker Hub API: operation not permitted`);
+  }
+  if (body) {
+    const errResp = parseErrorBody(body);
+    for (const k of ['description', 'message', 'detail', 'error']) {
+      if (errResp[k]) {
+        throw new Error(`Docker Hub API: bad status code ${statusCode}: ${errResp[k]}`);
+      }
+    }
+  }
+  throw new Error(`Docker Hub API: bad status code ${statusCode}`);
+};
+
+const parseErrorBody = (body: string): Record<string, string> => {
+  try {
+    return <Record<string, string>>JSON.parse(body);
+  } catch {
+    return {};
+  }
+};

yarn.lock

@@ -34,9 +34,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@actions/cache@npm:^6.1.0":
-  version: 6.1.0
-  resolution: "@actions/cache@npm:6.1.0"
+"@actions/cache@npm:^6.2.0":
+  version: 6.2.0
+  resolution: "@actions/cache@npm:6.2.0"
   dependencies:
     "@actions/core": "npm:^3.0.1"
     "@actions/exec": "npm:^3.0.0"
@@ -47,7 +47,7 @@ __metadata:
     "@azure/storage-blob": "npm:^12.31.0"
     "@protobuf-ts/runtime-rpc": "npm:^2.11.1"
     semver: "npm:^7.7.4"
-  checksum: 10/0cd89f335c1e89f514d56060110bfddc6ab1112ec0091533364c32aec2621896112cde71cfc4089b86d00f3b5478996088e4c4e0aba0aec32aae0afeb4921b3d
+  checksum: 10/b2b3d219d3458b6b7e8f47ff6a83a0566f0b3cd5b257e307636d2147f892e595ce8cecbc0675590a57d0eb4d4d73564d08d28753baa50934ad59a65cbee2d8fa
   languageName: node
   linkType: hard
 
@@ -170,244 +170,244 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@aws-sdk/client-ecr-public@npm:^3.1077.0":
-  version: 3.1077.0
-  resolution: "@aws-sdk/client-ecr-public@npm:3.1077.0"
+"@aws-sdk/client-ecr-public@npm:^3.1091.0":
+  version: 3.1091.0
+  resolution: "@aws-sdk/client-ecr-public@npm:3.1091.0"
   dependencies:
-    "@aws-sdk/core": "npm:^3.974.25"
-    "@aws-sdk/credential-provider-node": "npm:^3.972.60"
-    "@aws-sdk/types": "npm:^3.973.14"
-    "@smithy/core": "npm:^3.28.0"
-    "@smithy/fetch-http-handler": "npm:^5.6.1"
-    "@smithy/node-http-handler": "npm:^4.9.1"
-    "@smithy/types": "npm:^4.15.0"
+    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/credential-provider-node": "npm:^3.972.70"
+    "@aws-sdk/types": "npm:^3.974.2"
+    "@smithy/core": "npm:^3.29.4"
+    "@smithy/fetch-http-handler": "npm:^5.6.6"
+    "@smithy/node-http-handler": "npm:^4.9.6"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/916cf62d4db13bfcecc8023b26e9cdcc69e1df9c7daa7cbbe8b205998ccb9443251cae24fe3a06f5f20d2fbffee4e400e0714c2963dc75536a3482fd60544f53
+  checksum: 10/70da99ae235bfeb22ae8018860ae587ad77b0a17b89393a893f4a90625513ba0c69ab1f560ea0addae57361abb8f799a534b326fe58e741642049bfcf137cf25
   languageName: node
   linkType: hard
 
-"@aws-sdk/client-ecr@npm:^3.1077.0":
-  version: 3.1077.0
-  resolution: "@aws-sdk/client-ecr@npm:3.1077.0"
+"@aws-sdk/client-ecr@npm:^3.1091.0":
+  version: 3.1091.0
+  resolution: "@aws-sdk/client-ecr@npm:3.1091.0"
   dependencies:
-    "@aws-sdk/core": "npm:^3.974.25"
-    "@aws-sdk/credential-provider-node": "npm:^3.972.60"
-    "@aws-sdk/types": "npm:^3.973.14"
-    "@smithy/core": "npm:^3.28.0"
-    "@smithy/fetch-http-handler": "npm:^5.6.1"
-    "@smithy/node-http-handler": "npm:^4.9.1"
-    "@smithy/types": "npm:^4.15.0"
+    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/credential-provider-node": "npm:^3.972.70"
+    "@aws-sdk/types": "npm:^3.974.2"
+    "@smithy/core": "npm:^3.29.4"
+    "@smithy/fetch-http-handler": "npm:^5.6.6"
+    "@smithy/node-http-handler": "npm:^4.9.6"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/5c70110f9a3cac414701b97710ae40147e1e982ab6239ccd6a839f8726f490b548874fc4e4d968ccc548bdc187cd2864b54c2d3d5ed3bfe32285e555c6a413a8
+  checksum: 10/622dce201f147c99017945ed479fac1ab12485c6612c4b7cd76eb1885965639073517d392b56c05ca6d88a1104c662608edd26c44930a0ee47f6bd6dc8d5956e
   languageName: node
   linkType: hard
 
-"@aws-sdk/core@npm:^3.974.25":
-  version: 3.974.25
-  resolution: "@aws-sdk/core@npm:3.974.25"
+"@aws-sdk/core@npm:^3.975.3":
+  version: 3.975.3
+  resolution: "@aws-sdk/core@npm:3.975.3"
   dependencies:
-    "@aws-sdk/types": "npm:^3.973.14"
-    "@aws-sdk/xml-builder": "npm:^3.972.32"
-    "@aws/lambda-invoke-store": "npm:^0.2.2"
-    "@smithy/core": "npm:^3.28.0"
-    "@smithy/signature-v4": "npm:^5.6.0"
-    "@smithy/types": "npm:^4.15.0"
+    "@aws-sdk/types": "npm:^3.974.2"
+    "@aws-sdk/xml-builder": "npm:^3.972.36"
+    "@aws/lambda-invoke-store": "npm:^0.3.0"
+    "@smithy/core": "npm:^3.29.4"
+    "@smithy/signature-v4": "npm:^5.6.5"
+    "@smithy/types": "npm:^4.16.1"
     bowser: "npm:^2.11.0"
     tslib: "npm:^2.6.2"
-  checksum: 10/25ca1498913983d8f7c2f25485d3c825e9b23a48b15eeac3e695b70fd6393f815f644b4ca11bc8145eff2dec5cbee06360ae7bcf76b5fd9dbb214fd80abe81be
+  checksum: 10/a4be9e91891f6f2169cc694e8d4abe1a0bd83ed257af688d83617c428d54ad34516ccd4ed51854b4df9b81e585d30dfa9618cec75d2dfa6a8b7f5239d01913d4
   languageName: node
   linkType: hard
 
-"@aws-sdk/credential-provider-env@npm:^3.972.51":
-  version: 3.972.51
-  resolution: "@aws-sdk/credential-provider-env@npm:3.972.51"
+"@aws-sdk/credential-provider-env@npm:^3.972.59":
+  version: 3.972.59
+  resolution: "@aws-sdk/credential-provider-env@npm:3.972.59"
   dependencies:
-    "@aws-sdk/core": "npm:^3.974.25"
-    "@aws-sdk/types": "npm:^3.973.14"
-    "@smithy/core": "npm:^3.28.0"
-    "@smithy/types": "npm:^4.15.0"
+    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/types": "npm:^3.974.2"
+    "@smithy/core": "npm:^3.29.4"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/3e745169838f44f26828a6c860e32d662d9b52be6d7b63dd2407028b53567fdd24b8a2e92bfb27da73c2f71e07a051a17722bfe0c7dd5a665a0d3f302812a148
+  checksum: 10/e9456725b6e1ad9c28f1901fa4275261821d8590e396c40f331d3bc59712533c7950216938260adb2fc63f72721a17f0b1acb36093a2c2242147039f00180fec
   languageName: node
   linkType: hard
 
-"@aws-sdk/credential-provider-http@npm:^3.972.53":
-  version: 3.972.53
-  resolution: "@aws-sdk/credential-provider-http@npm:3.972.53"
+"@aws-sdk/credential-provider-http@npm:^3.972.61":
+  version: 3.972.61
+  resolution: "@aws-sdk/credential-provider-http@npm:3.972.61"
   dependencies:
-    "@aws-sdk/core": "npm:^3.974.25"
-    "@aws-sdk/types": "npm:^3.973.14"
-    "@smithy/core": "npm:^3.28.0"
-    "@smithy/fetch-http-handler": "npm:^5.6.1"
-    "@smithy/node-http-handler": "npm:^4.9.1"
-    "@smithy/types": "npm:^4.15.0"
+    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/types": "npm:^3.974.2"
+    "@smithy/core": "npm:^3.29.4"
+    "@smithy/fetch-http-handler": "npm:^5.6.6"
+    "@smithy/node-http-handler": "npm:^4.9.6"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/94247a81a8d0235c3eb14a2e8ac41b70314efa585ca62d0c16c0293f96a2d2f1d0b0ed947d6e15e46d0fdc565725d6d2a37d5e847523995d11f21fe254eb0094
+  checksum: 10/c8d8dba6bb6ae8816ac2ccad8cb661d30a73c8414abc73972c74ef0a50ccadfaaef59b051832648b57852934dc3051d0218bd805e6beff35537f3b8a00d881fb
   languageName: node
   linkType: hard
 
-"@aws-sdk/credential-provider-ini@npm:^3.972.58":
-  version: 3.972.58
-  resolution: "@aws-sdk/credential-provider-ini@npm:3.972.58"
+"@aws-sdk/credential-provider-ini@npm:^3.973.4":
+  version: 3.973.4
+  resolution: "@aws-sdk/credential-provider-ini@npm:3.973.4"
   dependencies:
-    "@aws-sdk/core": "npm:^3.974.25"
-    "@aws-sdk/credential-provider-env": "npm:^3.972.51"
-    "@aws-sdk/credential-provider-http": "npm:^3.972.53"
-    "@aws-sdk/credential-provider-login": "npm:^3.972.57"
-    "@aws-sdk/credential-provider-process": "npm:^3.972.51"
-    "@aws-sdk/credential-provider-sso": "npm:^3.972.57"
-    "@aws-sdk/credential-provider-web-identity": "npm:^3.972.57"
-    "@aws-sdk/nested-clients": "npm:^3.997.25"
-    "@aws-sdk/types": "npm:^3.973.14"
-    "@smithy/core": "npm:^3.28.0"
-    "@smithy/credential-provider-imds": "npm:^4.4.4"
-    "@smithy/types": "npm:^4.15.0"
+    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/credential-provider-env": "npm:^3.972.59"
+    "@aws-sdk/credential-provider-http": "npm:^3.972.61"
+    "@aws-sdk/credential-provider-login": "npm:^3.972.66"
+    "@aws-sdk/credential-provider-process": "npm:^3.972.59"
+    "@aws-sdk/credential-provider-sso": "npm:^3.973.3"
+    "@aws-sdk/credential-provider-web-identity": "npm:^3.972.65"
+    "@aws-sdk/nested-clients": "npm:^3.997.33"
+    "@aws-sdk/types": "npm:^3.974.2"
+    "@smithy/core": "npm:^3.29.4"
+    "@smithy/credential-provider-imds": "npm:^4.4.9"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/d9d0024c120fbe0de0a6436fe7d5fd8056549cfd630f385b389d131417cf06ba6848c56a45b0afad5fdeec6b850d2c1dc91fc165d47a671d904e9e1facd7001b
+  checksum: 10/4c0e53c8abfb10184984a2bd975d03bb850c0ff7a3d2a2e7c20413177cf1ac47869cc3f619084886bf933f96a36376896e0800c3ffe170ef470fedbdb114ead0
   languageName: node
   linkType: hard
 
-"@aws-sdk/credential-provider-login@npm:^3.972.57":
-  version: 3.972.57
-  resolution: "@aws-sdk/credential-provider-login@npm:3.972.57"
+"@aws-sdk/credential-provider-login@npm:^3.972.66":
+  version: 3.972.66
+  resolution: "@aws-sdk/credential-provider-login@npm:3.972.66"
   dependencies:
-    "@aws-sdk/core": "npm:^3.974.25"
-    "@aws-sdk/nested-clients": "npm:^3.997.25"
-    "@aws-sdk/types": "npm:^3.973.14"
-    "@smithy/core": "npm:^3.28.0"
-    "@smithy/types": "npm:^4.15.0"
+    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/nested-clients": "npm:^3.997.33"
+    "@aws-sdk/types": "npm:^3.974.2"
+    "@smithy/core": "npm:^3.29.4"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/22b24eedad0620c15ed78f6e02a6add822357c778acd452adf76a492a41a6750654aa01bd6a7877ee4cf96968988b305dbaf9a15278989f7960dddb53a11ddd0
+  checksum: 10/c9a4a5aab4f7de83c35f22c8fec13661e13939634a94c298ab1895b53a0ee477d4667ac1632007bc87daedbd3789742285e1b5882567497d7fe16a961f0afe95
   languageName: node
   linkType: hard
 
-"@aws-sdk/credential-provider-node@npm:^3.972.60":
-  version: 3.972.60
-  resolution: "@aws-sdk/credential-provider-node@npm:3.972.60"
+"@aws-sdk/credential-provider-node@npm:^3.972.70":
+  version: 3.972.70
+  resolution: "@aws-sdk/credential-provider-node@npm:3.972.70"
   dependencies:
-    "@aws-sdk/credential-provider-env": "npm:^3.972.51"
-    "@aws-sdk/credential-provider-http": "npm:^3.972.53"
-    "@aws-sdk/credential-provider-ini": "npm:^3.972.58"
-    "@aws-sdk/credential-provider-process": "npm:^3.972.51"
-    "@aws-sdk/credential-provider-sso": "npm:^3.972.57"
-    "@aws-sdk/credential-provider-web-identity": "npm:^3.972.57"
-    "@aws-sdk/types": "npm:^3.973.14"
-    "@smithy/core": "npm:^3.28.0"
-    "@smithy/credential-provider-imds": "npm:^4.4.4"
-    "@smithy/types": "npm:^4.15.0"
+    "@aws-sdk/credential-provider-env": "npm:^3.972.59"
+    "@aws-sdk/credential-provider-http": "npm:^3.972.61"
+    "@aws-sdk/credential-provider-ini": "npm:^3.973.4"
+    "@aws-sdk/credential-provider-process": "npm:^3.972.59"
+    "@aws-sdk/credential-provider-sso": "npm:^3.973.3"
+    "@aws-sdk/credential-provider-web-identity": "npm:^3.972.65"
+    "@aws-sdk/types": "npm:^3.974.2"
+    "@smithy/core": "npm:^3.29.4"
+    "@smithy/credential-provider-imds": "npm:^4.4.9"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/5249e3bf1ded99f207ef8b4c80c4c19ab934115304790916def3f29877061c850e3089f71fd65cca3688327763175837a86f5afa100ef926c9749782ca0b7a44
+  checksum: 10/302b7e3776429c61f89f863fcc14ac866d13bd6513e8f15a09d5c56bc5e619a3b0461a680fedad97dcd3cc000ed8a3522d776b9b2ff326505e1fd1d872a96adf
   languageName: node
   linkType: hard
 
-"@aws-sdk/credential-provider-process@npm:^3.972.51":
-  version: 3.972.51
-  resolution: "@aws-sdk/credential-provider-process@npm:3.972.51"
+"@aws-sdk/credential-provider-process@npm:^3.972.59":
+  version: 3.972.59
+  resolution: "@aws-sdk/credential-provider-process@npm:3.972.59"
   dependencies:
-    "@aws-sdk/core": "npm:^3.974.25"
-    "@aws-sdk/types": "npm:^3.973.14"
-    "@smithy/core": "npm:^3.28.0"
-    "@smithy/types": "npm:^4.15.0"
+    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/types": "npm:^3.974.2"
+    "@smithy/core": "npm:^3.29.4"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/bdbd1dbd6aadbc8737b03ff776fc3b9c8d7c773214f35113ac7cb796f56bbb9ae141cf282b15a5a17b77c5f06133a28fdbd363053772f5aad9021bd08d777e8d
+  checksum: 10/91bdaea2ff81b054ce8e508d83d5efd825a87f22ac74ac2a9f41d8310cb1211a4be7b6f33b505da2e3570b163e22faa5dfc7acd9afc73e61b98a3afb5621891e
   languageName: node
   linkType: hard
 
-"@aws-sdk/credential-provider-sso@npm:^3.972.57":
-  version: 3.972.57
-  resolution: "@aws-sdk/credential-provider-sso@npm:3.972.57"
+"@aws-sdk/credential-provider-sso@npm:^3.973.3":
+  version: 3.973.3
+  resolution: "@aws-sdk/credential-provider-sso@npm:3.973.3"
   dependencies:
-    "@aws-sdk/core": "npm:^3.974.25"
-    "@aws-sdk/nested-clients": "npm:^3.997.25"
-    "@aws-sdk/token-providers": "npm:3.1077.0"
-    "@aws-sdk/types": "npm:^3.973.14"
-    "@smithy/core": "npm:^3.28.0"
-    "@smithy/types": "npm:^4.15.0"
+    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/nested-clients": "npm:^3.997.33"
+    "@aws-sdk/token-providers": "npm:3.1088.0"
+    "@aws-sdk/types": "npm:^3.974.2"
+    "@smithy/core": "npm:^3.29.4"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/53fa4e00bcedd8673ac271503dfe452d3c4076ac780bb381012b0f71732511dcb63e83211b544db1f0bedc667925629af5dc5b3b5fa0e8c11372a4211cbf135d
+  checksum: 10/c5194138240365f799c65c2e6daac956342e45bd2877615c959f62f1d378193509699d2480814aebdd07ce6440af05500df0aa54397d7b097371db423c0c4543
   languageName: node
   linkType: hard
 
-"@aws-sdk/credential-provider-web-identity@npm:^3.972.57":
-  version: 3.972.57
-  resolution: "@aws-sdk/credential-provider-web-identity@npm:3.972.57"
+"@aws-sdk/credential-provider-web-identity@npm:^3.972.65":
+  version: 3.972.65
+  resolution: "@aws-sdk/credential-provider-web-identity@npm:3.972.65"
   dependencies:
-    "@aws-sdk/core": "npm:^3.974.25"
-    "@aws-sdk/nested-clients": "npm:^3.997.25"
-    "@aws-sdk/types": "npm:^3.973.14"
-    "@smithy/core": "npm:^3.28.0"
-    "@smithy/types": "npm:^4.15.0"
+    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/nested-clients": "npm:^3.997.33"
+    "@aws-sdk/types": "npm:^3.974.2"
+    "@smithy/core": "npm:^3.29.4"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/e3db324879b623695584fe4e591a360d930c82dc276fea4d344e537df29c1c821c52886562af51008573d0357e132fe6676a99ac49b545368f8e82ebd94a58f4
+  checksum: 10/9a0f2aec505420929ea78d414e8561691d6fdc0de21f7d947dbb56269236ef16d11d518f31bb0b0ff154fb92039f94211440d113ed09af9965bd5c6d5be1f9cd
   languageName: node
   linkType: hard
 
-"@aws-sdk/nested-clients@npm:^3.997.25":
-  version: 3.997.25
-  resolution: "@aws-sdk/nested-clients@npm:3.997.25"
+"@aws-sdk/nested-clients@npm:^3.997.33":
+  version: 3.997.33
+  resolution: "@aws-sdk/nested-clients@npm:3.997.33"
   dependencies:
-    "@aws-sdk/core": "npm:^3.974.25"
-    "@aws-sdk/signature-v4-multi-region": "npm:^3.996.37"
-    "@aws-sdk/types": "npm:^3.973.14"
-    "@smithy/core": "npm:^3.28.0"
-    "@smithy/fetch-http-handler": "npm:^5.6.1"
-    "@smithy/node-http-handler": "npm:^4.9.1"
-    "@smithy/types": "npm:^4.15.0"
+    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/signature-v4-multi-region": "npm:^3.996.41"
+    "@aws-sdk/types": "npm:^3.974.2"
+    "@smithy/core": "npm:^3.29.4"
+    "@smithy/fetch-http-handler": "npm:^5.6.6"
+    "@smithy/node-http-handler": "npm:^4.9.6"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/6e9507477672572d90e7802526f133b9956adb6306f401b51c1f76b55b60e93297943d9927e531cecba63303a157757bfadbf14524e164688a515e351f57d9de
+  checksum: 10/2a37d83609009b8b95b56658a48bb70fc56a1296d80701bfe12561aede13c6ebb9e678f3bfb20c5c4533ac6ebe63d4bec791760943c835917c95782eba0ec80c
   languageName: node
   linkType: hard
 
-"@aws-sdk/signature-v4-multi-region@npm:^3.996.37":
-  version: 3.996.37
-  resolution: "@aws-sdk/signature-v4-multi-region@npm:3.996.37"
+"@aws-sdk/signature-v4-multi-region@npm:^3.996.41":
+  version: 3.996.41
+  resolution: "@aws-sdk/signature-v4-multi-region@npm:3.996.41"
   dependencies:
-    "@aws-sdk/types": "npm:^3.973.14"
-    "@smithy/signature-v4": "npm:^5.6.0"
-    "@smithy/types": "npm:^4.15.0"
+    "@aws-sdk/types": "npm:^3.974.2"
+    "@smithy/signature-v4": "npm:^5.6.5"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/16608054281ae2b29c409ef772572f27d51c05269efc5965bfb2a72405675fb2449087d635f62e9e6438a73cf2edad15c1161287ddb2672ad8f08e8bc598df0a
+  checksum: 10/564a619949bd62e0f53543a7193313d994351d4c710d721f926c65f58872f2de7fcce7a0f915e03968ed67a6b2ad110bdf915e1320e5590d9e04a0cbe0f48e0b
   languageName: node
   linkType: hard
 
-"@aws-sdk/token-providers@npm:3.1077.0":
-  version: 3.1077.0
-  resolution: "@aws-sdk/token-providers@npm:3.1077.0"
+"@aws-sdk/token-providers@npm:3.1088.0":
+  version: 3.1088.0
+  resolution: "@aws-sdk/token-providers@npm:3.1088.0"
   dependencies:
-    "@aws-sdk/core": "npm:^3.974.25"
-    "@aws-sdk/nested-clients": "npm:^3.997.25"
-    "@aws-sdk/types": "npm:^3.973.14"
-    "@smithy/core": "npm:^3.28.0"
-    "@smithy/types": "npm:^4.15.0"
+    "@aws-sdk/core": "npm:^3.975.3"
+    "@aws-sdk/nested-clients": "npm:^3.997.33"
+    "@aws-sdk/types": "npm:^3.974.2"
+    "@smithy/core": "npm:^3.29.4"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/7b026fd9a234c52424dba53c86208143dc87b009efee933cee5522ac815e77ac567cc25fba013df34b3616268697f36737ad47c4a9e274da57519d4c5cf024f4
+  checksum: 10/ae399cc5f0589f00514079f79ab1e680fee104d433d8aed80c6f761bb4cb3c5176667a0c567726a22399242a817dfd9624094801da8fbb6f14c5c8bbb882caaf
   languageName: node
   linkType: hard
 
-"@aws-sdk/types@npm:^3.973.14":
-  version: 3.973.14
-  resolution: "@aws-sdk/types@npm:3.973.14"
+"@aws-sdk/types@npm:^3.974.2":
+  version: 3.974.2
+  resolution: "@aws-sdk/types@npm:3.974.2"
   dependencies:
-    "@smithy/types": "npm:^4.15.0"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/2c960877e3d5bb83b81a2974bc8aab86baa83053179e8fb1a77fde223138a64f5e14bc95d20146292af7eed499dd2b38aefd47ae68b5f746828abea8532e96a8
+  checksum: 10/12a2a3c13507211881d91d9186c0d20b138a569ab8e1937744393d2bcb14dc01257a97de42dd7ef002500a49f0237ce1faeb11e5a9c607d4ad16fd63357cefee
   languageName: node
   linkType: hard
 
-"@aws-sdk/xml-builder@npm:^3.972.32":
-  version: 3.972.32
-  resolution: "@aws-sdk/xml-builder@npm:3.972.32"
+"@aws-sdk/xml-builder@npm:^3.972.36":
+  version: 3.972.36
+  resolution: "@aws-sdk/xml-builder@npm:3.972.36"
   dependencies:
-    "@smithy/types": "npm:^4.15.0"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/d42371e477fb55823d406fac361bd2288af56284c52265dfeaa60191f90fc4f9105760df23e803fd5e1ea7bb14cd2567bb101e551d06417dad8bbd16568cf452
+  checksum: 10/8080815b2061ff64b0343f4bf9899ee7b90839e56cbd869ed96a29716678f71a5589a07ee6d4bea4cb40561b37cae58b899e3ed08fec36168c332664632f5214
   languageName: node
   linkType: hard
 
-"@aws/lambda-invoke-store@npm:^0.2.2":
-  version: 0.2.3
-  resolution: "@aws/lambda-invoke-store@npm:0.2.3"
-  checksum: 10/d0efa8ca73b2d8dc0bf634525eefa1b72cda85f5d47366264849343a6f2860cfa5c52b7f766a16b78da8406bbd3ee975da3abb1dbe38183f8af95413eafeb256
+"@aws/lambda-invoke-store@npm:^0.3.0":
+  version: 0.3.0
+  resolution: "@aws/lambda-invoke-store@npm:0.3.0"
+  checksum: 10/4a6c7af16477dd330d4dcd2269f89370be68295b54ae1e90ef8c2175efa4df6735f9a3f914ab7efa21ba7db5477031fe8488853adcd268eeb6cb8e34ad06b206
   languageName: node
   linkType: hard
 
@@ -677,12 +677,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@docker/actions-toolkit@npm:^0.92.0":
-  version: 0.92.0
-  resolution: "@docker/actions-toolkit@npm:0.92.0"
+"@docker/actions-toolkit@npm:^0.94.0":
+  version: 0.94.0
+  resolution: "@docker/actions-toolkit@npm:0.94.0"
   dependencies:
     "@actions/artifact": "npm:^6.2.1"
-    "@actions/cache": "npm:^6.1.0"
+    "@actions/cache": "npm:^6.2.0"
     "@actions/core": "npm:^3.0.1"
     "@actions/exec": "npm:^3.0.0"
     "@actions/github": "npm:^9.1.1"
@@ -693,16 +693,16 @@ __metadata:
     "@sigstore/tuf": "npm:^5.0.0"
     "@sigstore/verify": "npm:^4.1.0"
     async-retry: "npm:^1.3.3"
-    csv-parse: "npm:^7.0.0"
+    csv-parse: "npm:^7.0.1"
     gunzip-maybe: "npm:^1.4.2"
     handlebars: "npm:^4.7.9"
     he: "npm:^1.2.0"
-    js-yaml: "npm:^5.2.0"
+    js-yaml: "npm:^5.2.1"
     jwt-decode: "npm:^4.0.0"
     semver: "npm:^7.8.5"
     tar-stream: "npm:^3.2.0"
     tmp: "npm:^0.2.7"
-  checksum: 10/599cea84b897069c53744a2f05371c6d9ad60da18448b4431273529b92fd2d77ddc718ee205cf0bf1da53083d412da90b1067f1e64a5fdac73fe71d486726064
+  checksum: 10/96f7b3e488dd50db0b77575e1a2bd7e92506b1a2695d5c31a57d361e4dc07871ef1a14a7ab87bf6fe27af2f817d34351c2e289446b126675a20d9776fe5ab8ce
   languageName: node
   linkType: hard
 
@@ -1956,66 +1956,66 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@smithy/core@npm:^3.28.0":
-  version: 3.28.0
-  resolution: "@smithy/core@npm:3.28.0"
+"@smithy/core@npm:^3.29.4, @smithy/core@npm:^3.29.6":
+  version: 3.29.6
+  resolution: "@smithy/core@npm:3.29.6"
   dependencies:
-    "@smithy/types": "npm:^4.15.0"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/b8fe9db961112b8dd36b48c9d692d0cbe83be3a5962b51874f52079a22595674a9bc30c01bb3868da74e0c9ab328cac1f71405982432434be3e5d9d57777b5d7
+  checksum: 10/12c3021c0bda41e6201dc53c975e9a6d8b8635209004230795d11d9db96d787f593db7d8673a7b2584f143e98c3c0ba4743c698d2844a114a5e2d0fdb8382444
   languageName: node
   linkType: hard
 
-"@smithy/credential-provider-imds@npm:^4.4.4":
-  version: 4.4.4
-  resolution: "@smithy/credential-provider-imds@npm:4.4.4"
+"@smithy/credential-provider-imds@npm:^4.4.9":
+  version: 4.4.11
+  resolution: "@smithy/credential-provider-imds@npm:4.4.11"
   dependencies:
-    "@smithy/core": "npm:^3.28.0"
-    "@smithy/types": "npm:^4.15.0"
+    "@smithy/core": "npm:^3.29.6"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/47950acf6e89480592466fec4e7e5d6eed8ff9b939d76ef83a584b39067c593ce06df2616f354fda084b284af1406ac9a82d759a38623066b28ad7efe05a736b
+  checksum: 10/f3ff9bcdac8ed871558106ee36e1b4fa29155de5d3fa630557beced910cb75fc222478b2806d6275dbae71e14307a55c508546195c65a54019ab49a949d1f03d
   languageName: node
   linkType: hard
 
-"@smithy/fetch-http-handler@npm:^5.6.1":
-  version: 5.6.1
-  resolution: "@smithy/fetch-http-handler@npm:5.6.1"
+"@smithy/fetch-http-handler@npm:^5.6.6":
+  version: 5.6.8
+  resolution: "@smithy/fetch-http-handler@npm:5.6.8"
   dependencies:
-    "@smithy/core": "npm:^3.28.0"
-    "@smithy/types": "npm:^4.15.0"
+    "@smithy/core": "npm:^3.29.6"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/e7a841ef750fcfd936e274cd1bd011d0749328d7597e9d5ba8ed286be883fde25e6629315428502aec343c072c826ed512dd26a08ee33609884812cbbc1e2d84
+  checksum: 10/996e5c8bd9b2b78d8c0395ef5c602063ba393714ea89bd459c31225117e3aaca167adae68738a47c491d6346402ff7a6f95d4d36dbf5079185ec521ec6c563ec
   languageName: node
   linkType: hard
 
-"@smithy/node-http-handler@npm:^4.9.1":
-  version: 4.9.1
-  resolution: "@smithy/node-http-handler@npm:4.9.1"
+"@smithy/node-http-handler@npm:^4.9.6":
+  version: 4.9.8
+  resolution: "@smithy/node-http-handler@npm:4.9.8"
   dependencies:
-    "@smithy/core": "npm:^3.28.0"
-    "@smithy/types": "npm:^4.15.0"
+    "@smithy/core": "npm:^3.29.6"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/d12b489b301b71767036a33c3c6736f4f37ea5ae8f147b054acbebaf3a5b02df05cba38b764813fa0cd24cde3c3faa22842bda31e0840bb4d79dd737f801d82e
+  checksum: 10/defb5c0603b133172b80693243856fe602f45f2c4653f303bc61e9c37c21a5610fb2b037cc359a4f8c5ff6d875fded737c69a6bdc6df3de47ddddbb11e1bf44d
   languageName: node
   linkType: hard
 
-"@smithy/signature-v4@npm:^5.6.0":
-  version: 5.6.0
-  resolution: "@smithy/signature-v4@npm:5.6.0"
+"@smithy/signature-v4@npm:^5.6.5":
+  version: 5.6.7
+  resolution: "@smithy/signature-v4@npm:5.6.7"
   dependencies:
-    "@smithy/core": "npm:^3.28.0"
-    "@smithy/types": "npm:^4.15.0"
+    "@smithy/core": "npm:^3.29.6"
+    "@smithy/types": "npm:^4.16.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/e4036321b89bc522d2c1edad6e70151c155dc0e4780a0d828cfdf941d5f8a871fda50912e7b9ed87172916761e84e50030b05f020523873232877b3f814f0b8c
+  checksum: 10/5d400218cefae842ce0a81c56bf554cd8822db1b6c16fb1ece03f05ce69cd590b4ec0eb78fc1acd39491697b77f4c079121787258b8ce5b1081c62c06260ae9b
   languageName: node
   linkType: hard
 
-"@smithy/types@npm:^4.15.0":
-  version: 4.15.0
-  resolution: "@smithy/types@npm:4.15.0"
+"@smithy/types@npm:^4.16.1":
+  version: 4.16.1
+  resolution: "@smithy/types@npm:4.16.1"
   dependencies:
     tslib: "npm:^2.6.2"
-  checksum: 10/e41a84ec3eb9feb45040ccd541b1cacf0fc2375297802886459cb9311ff361080978c08ef98e9ad69f41d80ad212279d682a8fe30a993381b2f1dd376c1006c3
+  checksum: 10/23651203f2e8800b2b2311ef163ddec166d91e15b30fa1c877be352aeef8ae7cc7b0189f99e07b0dcd52160b10adfb3fa4ca32c38a2d7195fc5428b8986d5201
   languageName: node
   linkType: hard
 
@@ -2762,12 +2762,12 @@ __metadata:
   linkType: hard
 
 "brace-expansion@npm:^1.1.7":
-  version: 1.1.13
-  resolution: "brace-expansion@npm:1.1.13"
+  version: 1.1.16
+  resolution: "brace-expansion@npm:1.1.16"
   dependencies:
     balanced-match: "npm:^1.0.0"
     concat-map: "npm:0.0.1"
-  checksum: 10/b5f4329fdbe9d2e25fa250c8f866ebd054ba946179426e99b86dcccddabdb1d481f0e40ee5430032e62a7d0a6c2837605ace6783d015aa1d65d85ca72154d936
+  checksum: 10/94498bead66c51536df5b7bf1b0a0e581a5b7f86888be10481d06920c4bd9d976e003b13a3d19fddc733f21a09d162ff72f90e18b2c9d062b15121e973d0e13b
   languageName: node
   linkType: hard
 
@@ -3103,10 +3103,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"csv-parse@npm:^7.0.0":
-  version: 7.0.0
-  resolution: "csv-parse@npm:7.0.0"
-  checksum: 10/53c96e6b4ff80047713bb4d2967d06495890d4b628284a80271860be089fdb5a74cd97c76fd535a00ad26b11cc6e4fc5a243658e5377c0a6334ddd104620d169
+"csv-parse@npm:^7.0.1":
+  version: 7.0.1
+  resolution: "csv-parse@npm:7.0.1"
+  checksum: 10/5c914f01181dbb381068b98e17b49361d853faa95db3e8e82bc96b6a0de5313ecc8325a77db35ff66644d7747099965ba3167ec21bd9ce4500edf21b5bdd49bf
   languageName: node
   linkType: hard
 
@@ -3155,9 +3155,10 @@ __metadata:
   resolution: "docker-login@workspace:."
   dependencies:
     "@actions/core": "npm:^3.0.1"
-    "@aws-sdk/client-ecr": "npm:^3.1077.0"
-    "@aws-sdk/client-ecr-public": "npm:^3.1077.0"
-    "@docker/actions-toolkit": "npm:^0.92.0"
+    "@actions/http-client": "npm:^4.0.1"
+    "@aws-sdk/client-ecr": "npm:^3.1091.0"
+    "@aws-sdk/client-ecr-public": "npm:^3.1091.0"
+    "@docker/actions-toolkit": "npm:^0.94.0"
     "@eslint/js": "npm:^9.39.3"
     "@types/js-yaml": "npm:^4.0.9"
     "@types/node": "npm:^24.11.0"
@@ -3173,9 +3174,10 @@ __metadata:
     globals: "npm:^17.3.0"
     http-proxy-agent: "npm:^9.1.0"
     https-proxy-agent: "npm:^9.1.0"
-    js-yaml: "npm:^5.2.0"
+    js-yaml: "npm:^5.2.1"
     prettier: "npm:^3.8.1"
     typescript: "npm:^5.9.3"
+    uuid: "npm:^14.0.1"
     vitest: "npm:^4.0.18"
   languageName: unknown
   linkType: soft
@@ -4344,14 +4346,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"js-yaml@npm:^5.2.0":
-  version: 5.2.0
-  resolution: "js-yaml@npm:5.2.0"
+"js-yaml@npm:^5.2.1":
+  version: 5.2.1
+  resolution: "js-yaml@npm:5.2.1"
   dependencies:
     argparse: "npm:^2.0.1"
   bin:
     js-yaml: bin/js-yaml.mjs
-  checksum: 10/8a5e55c5d0fcafae4ac02114a99dc070048b8e5a82a056089ce1f69f8a00fd8eb05b622e76ad50aac1f9d409010636c9616c6b2ed4e58dae138379a60d301220
+  checksum: 10/e1eca2d21c15572585bb236d9fde31d6789eb50b9c63e8753fa7e0777bc480f7521cad517bd7a0c66f27dfc27ddcd7100beeefa51c1a50e10e98f2e009633c3d
   languageName: node
   linkType: hard
 
@@ -6300,6 +6302,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"uuid@npm:^14.0.1":
+  version: 14.0.1
+  resolution: "uuid@npm:14.0.1"
+  bin:
+    uuid: dist-node/bin/uuid
+  checksum: 10/0f978fd5b0269d7acb615342aeb131f0b8d85eeb8ec34f2915d906baa3befcc14a079a430d0f8116aec6fd20c850cbfab65d1b3d1643fa81ed373c0cf9574f18
+  languageName: node
+  linkType: hard
+
 "validate-npm-package-name@npm:^7.0.0":
   version: 7.0.2
   resolution: "validate-npm-package-name@npm:7.0.2"