chore: update generated content

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
docker hub oidc support
2026-07-22 20:57:57 +00:00 · 2026-07-22 13:01:47 +02:00 · 2026-07-22 13:01:46 +02:00 · 2026-07-22 08:53:04 +02:00 · 2026-07-22 08:51:57 +02:00 · 2026-07-22 06:51:44 +00:00
22 changed files with 1966 additions and 3326 deletions
@@ -10,6 +10,9 @@ updates:
      crazy-max-dot-github:
        patterns:
          - "crazy-max/.github/*"
      codeql-actions:
        patterns:
          - "github/codeql-action/*"
    labels:
      - "dependencies"
      - "bot"
@@ -7,6 +7,9 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 env:
  GHCR_TEST_IMAGE: ghcr.io/docker/login-action-test:ci-${{ github.sha }}
 on:
  workflow_dispatch:
  schedule:
@@ -22,7 +25,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Stop docker
        run: |
@@ -46,7 +49,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Login to GitHub Container Registry
        uses: ./
@@ -56,44 +59,75 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}
          logout: ${{ matrix.logout }}
-  dind:
+  push-ghcr:
    runs-on: ubuntu-latest
-    env:
+    permissions:
-      DOCKER_CONFIG: $HOME/.docker
+      contents: read
      packages: write
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Login to GitHub Container Registry
        uses: ./
        with:
          registry: ghcr.io
-          username: ${{ secrets.GHCR_USERNAME }}
+          username: ${{ github.actor }}
-          password: ${{ secrets.GHCR_PAT }}
+          password: ${{ secrets.GITHUB_TOKEN }}
      -
        name: Build and push test image
        run: |
          docker buildx build --push -t "${GHCR_TEST_IMAGE}" - <<EOF
          FROM scratch
          LABEL org.opencontainers.image.title="docker/login-action CI test image"
          LABEL org.opencontainers.image.description="Empty image used by CI to verify GHCR authentication."
          LABEL org.opencontainers.image.source="https://github.com/${GITHUB_REPOSITORY}"
          EOF
  dind:
    runs-on: ubuntu-latest
    needs:
      - push-ghcr
    permissions:
      contents: read
      packages: read
    env:
      DOCKER_CONFIG: $HOME/.docker
    steps:
      -
        name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Login to GitHub Container Registry
        uses: ./
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      -
        name: DinD
        uses: docker://docker:29.3@sha256:4d90f1f6c400315c2dba96d3ec93c01e64198395cbba04f79d12adce4f737029
        with:
          entrypoint: docker
-          args: pull ghcr.io/docker-ghactiontest/test
+          args: pull ${{ env.GHCR_TEST_IMAGE }}
      -
-        name: Pull private image
+        name: Pull test image
        run: |
          docker image prune -a -f >/dev/null 2>&1
-          docker pull ghcr.io/docker-ghactiontest/test
+          docker pull "${GHCR_TEST_IMAGE}"
  acr:
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Login to ACR
        uses: ./
        with:
-          registry: ${{ secrets.AZURE_REGISTRY_NAME }}.azurecr.io
+          registry: officialgithubactions.azurecr.io
          username: ${{ secrets.AZURE_CLIENT_ID }}
          password: ${{ secrets.AZURE_CLIENT_SECRET }}
@@ -108,13 +142,36 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Login to Docker Hub
        uses: ./
        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
  dockerhub-oidc:
    permissions:
      contents: read
      id-token: write
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - windows-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Login to Docker Hub with OIDC
        uses: ./
        env:
          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
        with:
          username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
  ecr:
    runs-on: ${{ matrix.os }}
@@ -127,12 +184,12 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Login to ECR
        uses: ./
        with:
-          registry: ${{ secrets.AWS_ACCOUNT_NUMBER }}.dkr.ecr.us-east-1.amazonaws.com
+          registry: 175142243308.dkr.ecr.us-east-1.amazonaws.com
          username: ${{ secrets.AWS_ACCESS_KEY_ID }}
          password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -147,10 +204,10 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -159,7 +216,34 @@ jobs:
        name: Login to ECR
        uses: ./
        with:
-          registry: ${{ secrets.AWS_ACCOUNT_NUMBER }}.dkr.ecr.us-east-1.amazonaws.com
+          registry: 175142243308.dkr.ecr.us-east-1.amazonaws.com
  ecr-oidc:
    permissions:
      contents: read
      id-token: write
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - windows-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
        with:
          role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd_login_action
          aws-region: us-east-1
      -
        name: Login to ECR
        uses: ./
        with:
          registry: 175142243308.dkr.ecr.us-east-1.amazonaws.com
  ecr-public:
    runs-on: ${{ matrix.os }}
@@ -172,7 +256,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Login to Public ECR
        continue-on-error: ${{ matrix.os == 'windows-latest' }}
@@ -195,10 +279,10 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -210,6 +294,34 @@ jobs:
        with:
          registry: public.ecr.aws
  ecr-public-oidc:
    permissions:
      contents: read
      id-token: write
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - windows-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
        with:
          role-to-assume: arn:aws:iam::175142243308:role/official_gha_cicd_login_action
          aws-region: us-east-1
      -
        name: Login to Public ECR
        continue-on-error: ${{ matrix.os == 'windows-latest' }}
        uses: ./
        with:
          registry: public.ecr.aws
  ghcr:
    runs-on: ${{ matrix.os }}
    strategy:
@@ -221,7 +333,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Login to GitHub Container Registry
        uses: ./
@@ -241,7 +353,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Login to GitLab
        uses: ./
@@ -261,12 +373,12 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Login to Google Artifact Registry
        uses: ./
        with:
-          registry: ${{ secrets.GAR_LOCATION }}-docker.pkg.dev
+          registry: us-east4-docker.pkg.dev
          username: _json_key
          password: ${{ secrets.GAR_JSON_KEY }}
@@ -281,7 +393,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Login to Google Container Registry
        uses: ./
@@ -295,14 +407,14 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Login to registries
        uses: ./
        with:
          registry-auth: |
-            - username: ${{ secrets.DOCKERHUB_USERNAME }}
+            - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
-              password: ${{ secrets.DOCKERHUB_TOKEN }}
+              password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
            - registry: ghcr.io
              username: ${{ github.actor }}
              password: ${{ secrets.GITHUB_TOKEN }}
@@ -318,7 +430,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Login to registries
        uses: ./
@@ -339,7 +451,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Login to registries
        id: login
@@ -350,8 +462,8 @@ jobs:
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          registry-auth: |
-            - username: ${{ secrets.DOCKERHUB_USERNAME }}
+            - username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
-              password: ${{ secrets.DOCKERHUB_TOKEN }}
+              password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
      -
        name: Check
        run: |
@@ -371,13 +483,13 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Login to Docker Hub
        uses: ./
        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
          scope: '@push'
      -
        name: Print config.json files
@@ -401,13 +513,13 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Login to Docker Hub
        uses: ./
        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          username: ${{ vars.DOCKERPUBLICBOT_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          password: ${{ secrets.DOCKERPUBLICBOT_READ_PAT }}
          scope: 'docker/buildx-bin@push'
      -
        name: Print config.json files
@@ -431,7 +543,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Login to GitHub Container Registry
        uses: ./
@@ -462,7 +574,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Login to GitHub Container Registry
        uses: ./
@@ -22,7 +22,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Enable corepack
        run: |
@@ -30,17 +30,17 @@ jobs:
          yarn --version
      -
        name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: ${{ env.NODE_VERSION }}
      -
        name: Initialize CodeQL
-        uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
        with:
          languages: javascript-typescript
          build-mode: none
      -
        name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
        with:
          category: "/language:javascript-typescript"
@@ -11,7 +11,7 @@ on:
 jobs:
  run:
-    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@4a17dbaa9ce13920fc5bb8824eb89c16301e5ab2 # v1.7.0
+    uses: crazy-max/.github/.github/workflows/pr-assign-author.yml@46267a6e61cd56aac2fc79943df180152f4c89d6 # v1.10.1
    permissions:
      contents: read
      pull-requests: write
@@ -22,7 +22,7 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Publish
        uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4
@@ -20,16 +20,16 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Test
-        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
        with:
          source: .
          targets: test
      -
        name: Upload coverage
-        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
        with:
          files: ./coverage/clover.xml
          token: ${{ secrets.CODECOV_TOKEN }}
@@ -21,21 +21,23 @@ jobs:
      -
        name: GitHub auth token from GitHub App
        id: docker-read-app
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.GHACTIONS_REPO_WRITE_APP_ID }}
          private-key: ${{ secrets.GHACTIONS_REPO_WRITE_APP_PRIVATE_KEY }}
          owner: docker
          repositories: login-action
          permission-contents: write
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          fetch-depth: 0
          token: ${{ steps.docker-read-app.outputs.token }}
      -
        name: Build
-        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
        with:
          source: .
          targets: build
@@ -48,7 +50,7 @@ jobs:
              git config user.name "github-actions[bot]"
              git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
              git add dist
-              git commit -m "chore: update generated content"
+              git commit -m "[dependabot skip] chore: update generated content"
              git push
            )
          else
@@ -22,11 +22,11 @@ jobs:
    steps:
      -
        name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      -
        name: Generate matrix
        id: generate
-        uses: docker/bake-action/subaction/matrix@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
+        uses: docker/bake-action/subaction/matrix@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
        with:
          target: validate
@@ -41,6 +41,6 @@ jobs:
    steps:
      -
        name: Validate
-        uses: docker/bake-action@a66e1c87e2eca0503c343edf1d208c716d54b8a8 # v7.1.0
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
        with:
          targets: ${{ matrix.target }}
@@ -19,7 +19,7 @@ on:
 jobs:
  zizmor:
-    uses: crazy-max/.github/.github/workflows/zizmor.yml@4a17dbaa9ce13920fc5bb8824eb89c16301e5ab2 # v1.7.0
+    uses: crazy-max/.github/.github/workflows/zizmor.yml@46267a6e61cd56aac2fc79943df180152f4c89d6 # v1.10.1
    permissions:
      contents: read
      security-events: write
@@ -1,10 +1,10 @@
 # https://yarnpkg.com/configuration/yarnrc
-compressionLevel: mixed
+nodeLinker: node-modules
 enableGlobalCache: false
 enableHardenedMode: true
 logFilters:
  - code: YN0004
    level: discard
  - code: YN0013
    level: discard
  - code: YN0019
@@ -14,4 +14,11 @@ logFilters:
  - code: YN0086
    level: discard
-nodeLinker: node-modules
+npmPreapprovedPackages:
  - "@docker/actions-toolkit"
 compressionLevel: mixed
 enableGlobalCache: false
 enableHardenedMode: true
 enableScripts: false
 npmMinimalAgeGate: 2d
@@ -28,6 +28,7 @@ ___
  * [Set scopes for the authentication token](#set-scopes-for-the-authentication-token)
 * [Customizing](#customizing)
  * [inputs](#inputs)
  * [environment variables](#environment-variables)
 * [Contributing](#contributing)
 ## Usage
@@ -57,6 +58,36 @@ jobs:
          password: ${{ secrets.DOCKERHUB_TOKEN }}
 ```
 You can also [authenticate to Docker Hub with OpenID Connect](https://docs.docker.com/enterprise/security/oidc-connections/)
 when your Docker Hub organization has an OIDC connection configured. The
 workflow must grant the `id-token: write` permission, pass the Docker Hub
 organization name as `username`, omit `password`, and set the OIDC connection
 ID in `DOCKERHUB_OIDC_CONNECTIONID` environment variable.
 ```yaml
 name: ci
 on:
  push:
    branches: main
 permissions:
  contents: read
  id-token: write
 jobs:
  login:
    runs-on: ubuntu-latest
    steps:
      -
        name: Login to Docker Hub
        uses: docker/login-action@v4
        env:
          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
        with:
          username: ${{ vars.DOCKERHUB_ORGANIZATION }}
 ```
 ### GitHub Container Registry
 To authenticate to the [GitHub Container Registry](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry),
@@ -117,6 +148,8 @@ instead of a password.
 ### Azure Container Registry (ACR)
 #### Service principal
 [Create a service principal](https://docs.microsoft.com/en-us/azure/container-registry/container-registry-auth-service-principal#create-a-service-principal)
 with access to your container registry through the [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli)
 and take note of the generated service principal's ID (also called _client ID_)
@@ -142,10 +175,60 @@ jobs:
          password: ${{ secrets.AZURE_CLIENT_SECRET }}
 ```
 > [!NOTE]
 > Replace `<registry-name>` with the name of your registry.
 #### OpenID Connect (OIDC)
 To authenticate with OpenID Connect, configure a federated identity credential
 for GitHub Actions and use the [Azure Login](https://github.com/Azure/login)
 action to sign in to Azure. Then expose an ACR access token and pass it to this
 action as the password.
 ```yaml
 name: ci
 on:
  push:
    branches: main
 permissions:
  contents: read
  id-token: write
 jobs:
  login:
    runs-on: ubuntu-latest
    steps:
      -
        name: Login to Azure
        uses: azure/login@v3
        with:
          client-id: ${{ vars.AZURE_CLIENT_ID }}
          tenant-id: ${{ vars.AZURE_TENANT_ID }}
          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
      -
        name: Get ACR access token
        id: acr-token
        run: |
          ACR_TOKEN=$(az acr login --name <registry-name> --expose-token --output tsv --query accessToken)
          echo "::add-mask::$ACR_TOKEN" # mask the token in workflow logs
          echo "token=$ACR_TOKEN" >> "$GITHUB_OUTPUT"
      -
        name: Login to ACR
        uses: docker/login-action@v4
        with:
          registry: <registry-name>.azurecr.io
          username: 00000000-0000-0000-0000-000000000000
          password: ${{ steps.acr-token.outputs.token }}
 ```
 > [!NOTE]
 > Replace `<registry-name>` with the name of your registry.
 ### Google Container Registry (GCR)
 > [!NOTE]
 > [Google Artifact Registry](#google-artifact-registry-gar) is the evolution of
 > Google Container Registry. As a fully-managed service with support for both
 > container images and non-container artifacts. If you currently use Google
@@ -176,7 +259,7 @@ jobs:
    -
      name: Authenticate to Google Cloud
      id: auth
-      uses: google-github-actions/auth@v1
+      uses: google-github-actions/auth@v3
      with:
        token_format: access_token
        workload_identity_provider: <workload_identity_provider>
@@ -190,9 +273,10 @@ jobs:
        password: ${{ steps.auth.outputs.access_token }}
 ```
 > [!NOTE]
 > Replace `<workload_identity_provider>` with configured workload identity
 > provider. For steps to configure, [see here](https://github.com/google-github-actions/auth#setting-up-workload-identity-federation).
-
+>
 > Replace `<service_account>` with configured service account in workload
 > identity provider which has access to push to GCR
@@ -247,7 +331,7 @@ jobs:
      -
        name: Authenticate to Google Cloud
        id: auth
-        uses: google-github-actions/auth@v1
+        uses: google-github-actions/auth@v3
        with:
          token_format: access_token
          workload_identity_provider: <workload_identity_provider>
@@ -261,12 +345,13 @@ jobs:
          password: ${{ steps.auth.outputs.access_token }}
 ```
 > [!NOTE]
 > Replace `<workload_identity_provider>` with configured workload identity
 > provider
-
+>
 > Replace `<service_account>` with configured service account in workload
 > identity provider which has access to push to GCR
-
+>
 > Replace `<location>` with the regional or multi-regional [location](https://cloud.google.com/artifact-registry/docs/repo-organize#locations)
 > of the repository where the image is stored.
@@ -298,6 +383,7 @@ jobs:
          password: ${{ secrets.GAR_JSON_KEY }}
 ```
 > [!NOTE]
 > Replace `<location>` with the regional or multi-regional [location](https://cloud.google.com/artifact-registry/docs/repo-organize#locations)
 > of the repository where the image is stored.
@@ -352,6 +438,7 @@ jobs:
          AWS_ACCOUNT_IDS: 012345678910,023456789012
 ```
 > [!NOTE]
 > Only available with [AWS CLI version 1](https://docs.aws.amazon.com/cli/latest/reference/ecr/get-login.html)
 You can also use the [Configure AWS Credentials](https://github.com/aws-actions/configure-aws-credentials)
@@ -370,7 +457,7 @@ jobs:
    steps:
      -
        name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
        with:
          aws-access-key-id: ${{ vars.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -382,6 +469,7 @@ jobs:
          registry: <aws-account-number>.dkr.ecr.<region>.amazonaws.com
 ```
 > [!NOTE]
 > Replace `<aws-account-number>` and `<region>` with their respective values.
 ### AWS Public Elastic Container Registry (ECR)
@@ -413,6 +501,7 @@ jobs:
          AWS_REGION: <region>
 ```
 > [!NOTE]
 > Replace `<region>` with its respective value (default `us-east-1`).
 ### OCI Oracle Cloud Infrastructure Registry (OCIR)
@@ -445,6 +534,7 @@ jobs:
          password: ${{ secrets.OCI_TOKEN }}
 ```
 > [!NOTE]
 > Replace `<region>` with their respective values from [availability regions](https://docs.cloud.oracle.com/iaas/Content/Registry/Concepts/registryprerequisites.htm#Availab)
 ### Quay.io
@@ -603,7 +693,7 @@ jobs:
          scope: 'myorg/myimage@push'
      -
        name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          push: true
          tags: myorg/myimage:latest
@@ -631,6 +721,15 @@ The following inputs can be used as `step.with` keys:
 > [!NOTE]
 > The `registry-auth` input cannot be used with other inputs except `logout`.
 ### environment variables
 The following environment variables can be set as `step.env` keys:
 | Name                          | Type   | Default | Description                                                                 |
 |-------------------------------|--------|---------|-----------------------------------------------------------------------------|
 | `DOCKERHUB_OIDC_CONNECTIONID` | String |         | Docker Hub OIDC connection ID. Required for Docker Hub OIDC login           |
 | `DOCKERHUB_OIDC_EXPIREIN`     | Number | `300`   | Docker Hub OIDC token lifetime in seconds. Must be between `300` and `3600` |
 ## Contributing
 Want to contribute? Awesome! You can find information about contributing to
@@ -1,4 +1,4 @@
-import {afterEach, expect, test} from 'vitest';
+import {afterEach, expect, test, vi} from 'vitest';
 import * as path from 'path';
 import {Buildx} from '@docker/actions-toolkit/lib/buildx/buildx.js';
@@ -6,6 +6,7 @@ import {Buildx} from '@docker/actions-toolkit/lib/buildx/buildx.js';
 import {getAuthList, getInputs} from '../src/context.js';
 afterEach(() => {
  vi.restoreAllMocks();
  for (const key of Object.keys(process.env)) {
    if (key.startsWith('INPUT_')) {
      delete process.env[key];
@@ -33,3 +34,37 @@ test('getAuthList uses the default Docker Hub registry when computing scoped con
    configDir: path.join(Buildx.configDir, 'config', 'registry-1.docker.io', 'myscope')
  });
 });
 test('getAuthList skips secret masking when registry-auth password is absent', async () => {
  const stdoutWriteSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
  const [auth] = getAuthList({
    registry: '',
    username: '',
    password: '',
    scope: '',
    ecr: '',
    logout: true,
    registryAuth: '- registry: public.ecr.aws\n'
  });
  expect(stdoutWriteSpy.mock.calls.map(call => call[0]).join('')).not.toContain('::add-mask::');
  expect(auth).toMatchObject({
    registry: 'public.ecr.aws',
    ecr: 'auto'
  });
 });
 test('getAuthList masks registry-auth password when present', async () => {
  const stdoutWriteSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
  getAuthList({
    registry: '',
    username: '',
    password: '',
    scope: '',
    ecr: '',
    logout: true,
    registryAuth: '- registry: ghcr.io\n  username: dbowie\n  password: groundcontrol\n'
  });
  expect(stdoutWriteSpy.mock.calls.map(call => call[0]).join('')).toContain('::add-mask::groundcontrol');
 });
@@ -0,0 +1,133 @@
 import * as core from '@actions/core';
 import * as httpm from '@actions/http-client';
 import {beforeEach, describe, expect, test, vi} from 'vitest';
 import * as dockerhub from '../src/dockerhub.js';
 vi.mock('@actions/core', () => ({
  getIDToken: vi.fn(),
  info: vi.fn(),
  setSecret: vi.fn()
 }));
 const validConnectionID = '123e4567-e89b-42d3-a456-426614174000';
 const httpResponse = (statusCode: number, body: string, headers: Record<string, string> = {}): httpm.HttpClientResponse => {
  return {
    message: {
      statusCode,
      headers
    },
    readBody: vi.fn(async () => body)
  } as unknown as httpm.HttpClientResponse;
 };
 describe('isDockerHubOIDC', () => {
  beforeEach(() => {
    delete process.env.DOCKERHUB_OIDC_CONNECTIONID;
  });
  test.each(['', 'docker.io', 'registry-1.docker.io', 'registry-1-stage.docker.io'])('detects Docker Hub registry %p with empty password', registry => {
    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
    expect(dockerhub.isDockerHubOIDC(registry, '')).toBe(true);
  });
  test('requires connection ID env var', () => {
    expect(dockerhub.isDockerHubOIDC('docker.io', '')).toBe(false);
  });
  test('requires empty password', () => {
    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
    expect(dockerhub.isDockerHubOIDC('docker.io', 'groundcontrol')).toBe(false);
  });
  test('ignores non-Docker Hub registries', () => {
    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
    expect(dockerhub.isDockerHubOIDC('ghcr.io', '')).toBe(false);
  });
 });
 describe('getOIDCToken', () => {
  const getIDTokenMock = vi.mocked(core.getIDToken);
  const setSecretMock = vi.mocked(core.setSecret);
  let postSpy: ReturnType<typeof vi.spyOn>;
  beforeEach(() => {
    process.env.DOCKERHUB_OIDC_CONNECTIONID = validConnectionID;
    delete process.env.DOCKERHUB_OIDC_EXPIREIN;
    getIDTokenMock.mockResolvedValue('github-id-token');
    postSpy = vi.spyOn(httpm.HttpClient.prototype, 'post').mockResolvedValue(httpResponse(200, JSON.stringify({access_token: 'hub-token'})));
  });
  test('exchanges GitHub OIDC token for Docker Hub token', async () => {
    const credentials = await dockerhub.getOIDCToken('docker.io', 'dbowie');
    expect(credentials).toEqual({
      username: 'dbowie',
      token: 'hub-token'
    });
    expect(getIDTokenMock).toHaveBeenCalledWith('https://identity.docker.com');
    expect(postSpy).toHaveBeenCalledTimes(1);
    expect(postSpy.mock.calls[0][0]).toBe('https://identity.docker.com/oauth/token');
    const http = postSpy.mock.contexts[0] as httpm.HttpClient;
    expect(http.userAgent).toBe('github.com/docker/login-action');
    expect(http.requestOptions?.headers).toEqual({
      'Content-Type': 'application/x-www-form-urlencoded'
    });
    const body = new URLSearchParams(postSpy.mock.calls[0][1]);
    expect(body.get('grant_type')).toBe('urn:ietf:params:oauth:grant-type:token-exchange');
    expect(body.get('subject_token_type')).toBe('urn:ietf:params:oauth:token-type:id_token');
    expect(body.get('subject_token')).toBe('github-id-token');
    expect(body.get('connection_id')).toBe(validConnectionID);
    expect(body.get('expires_in')).toBe('300');
    expect(setSecretMock).toHaveBeenCalledWith('hub-token');
  });
  test('uses custom token expiration', async () => {
    process.env.DOCKERHUB_OIDC_EXPIREIN = '900';
    await dockerhub.getOIDCToken('docker.io', 'dbowie');
    const body = new URLSearchParams(postSpy.mock.calls[0][1]);
    expect(body.get('expires_in')).toBe('900');
  });
  test('uses stage identity host for stage registry', async () => {
    await dockerhub.getOIDCToken('registry-1-stage.docker.io', 'dbowie');
    expect(getIDTokenMock).toHaveBeenCalledWith('https://identity-stage.docker.com');
    expect(postSpy.mock.calls[0][0]).toBe('https://identity-stage.docker.com/oauth/token');
  });
  test('requires connection ID env var', async () => {
    delete process.env.DOCKERHUB_OIDC_CONNECTIONID;
    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('DOCKERHUB_OIDC_CONNECTIONID is required for Docker Hub OIDC login');
    expect(getIDTokenMock).not.toHaveBeenCalled();
    expect(postSpy).not.toHaveBeenCalled();
  });
  test('validates connection ID', async () => {
    process.env.DOCKERHUB_OIDC_CONNECTIONID = 'not-a-uuid';
    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('Invalid DOCKERHUB_OIDC_CONNECTIONID. Must be a valid UUID.');
    expect(getIDTokenMock).not.toHaveBeenCalled();
    expect(postSpy).not.toHaveBeenCalled();
  });
  test.each(['not-a-number', '299', '3601'])('validates token expiration %p', async expiresIn => {
    process.env.DOCKERHUB_OIDC_EXPIREIN = expiresIn;
    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow(`Invalid DOCKERHUB_OIDC_EXPIREIN: ${expiresIn}. Must be between 300 and 3600`);
    expect(getIDTokenMock).not.toHaveBeenCalled();
    expect(postSpy).not.toHaveBeenCalled();
  });
  test('retries rate limited token requests with Retry-After', async () => {
    postSpy.mockResolvedValueOnce(httpResponse(429, '', {'retry-after': '0'})).mockResolvedValueOnce(httpResponse(200, JSON.stringify({access_token: 'hub-token'})));
    await dockerhub.getOIDCToken('docker.io', 'dbowie');
    expect(postSpy).toHaveBeenCalledTimes(2);
    expect(core.info).toHaveBeenCalledWith('Docker Hub OIDC token request rate limited, retrying in 0ms (attempt 1/5)');
  });
  test('throws Docker Hub API errors', async () => {
    postSpy.mockResolvedValue(httpResponse(400, JSON.stringify({description: 'bad connection'})));
    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow('Docker Hub API: bad status code 400: bad connection');
  });
 });
@@ -17,7 +17,7 @@ FROM base AS deps
 RUN --mount=type=bind,target=.,rw \
  --mount=type=cache,target=/src/.yarn/cache \
  --mount=type=cache,target=/src/node_modules \
-  yarn install && mkdir /vendor && cp yarn.lock /vendor
+  yarn install --immutable && mkdir /vendor && cp yarn.lock /vendor
 FROM scratch AS vendor-update
 COPY --from=deps /vendor /
@@ -4,7 +4,7 @@
  "type": "module",
  "main": "src/main.ts",
  "scripts": {
-    "build": "esbuild src/main.ts --bundle --platform=node --target=node24 --format=cjs --outfile=dist/index.cjs --sourcemap --minify && yarn run license",
+    "build": "esbuild src/main.ts --bundle --platform=node --target=node24 --format=cjs --outfile=dist/index.cjs --sourcemap --minify --keep-names && yarn run license",
    "lint": "eslint --max-warnings=0 .",
    "format": "eslint --fix .",
    "test": "vitest run",
@@ -21,15 +21,17 @@
  ],
  "author": "Docker Inc.",
  "license": "Apache-2.0",
-  "packageManager": "yarn@4.9.2",
+  "packageManager": "yarn@4.15.0",
  "dependencies": {
-    "@actions/core": "^3.0.0",
+    "@actions/core": "^3.0.1",
-    "@aws-sdk/client-ecr": "^3.1020.0",
+    "@actions/http-client": "^4.0.1",
-    "@aws-sdk/client-ecr-public": "^3.1020.0",
+    "@aws-sdk/client-ecr": "^3.1077.0",
-    "@docker/actions-toolkit": "^0.86.0",
+    "@aws-sdk/client-ecr-public": "^3.1077.0",
-    "http-proxy-agent": "^9.0.0",
+    "@docker/actions-toolkit": "^0.93.0",
-    "https-proxy-agent": "^9.0.0",
+    "http-proxy-agent": "^9.1.0",
-    "js-yaml": "^4.1.1"
+    "https-proxy-agent": "^9.1.0",
    "js-yaml": "^5.2.1",
    "uuid": "^14.0.1"
  },
  "devDependencies": {
    "@eslint/js": "^9.39.3",
@@ -53,7 +53,9 @@ export function getAuthList(inputs: Inputs): Array<Auth> {
    });
  } else {
    auths = (yaml.load(inputs.registryAuth) as Array<Auth>).map(auth => {
-      core.setSecret(auth.password); // redacted in workflow logs
+      if (auth.password) {
        core.setSecret(auth.password); // redacted in workflow logs
      }
      const registry = auth.registry || 'docker.io';
      return {
        registry,
@@ -4,12 +4,20 @@ import {Docker} from '@docker/actions-toolkit/lib/docker/docker.js';
 import * as aws from './aws.js';
 import * as context from './context.js';
 import * as dockerhub from './dockerhub.js';
 export async function login(auth: context.Auth): Promise<void> {
  if (/true/i.test(auth.ecr) || (auth.ecr == 'auto' && aws.isECR(auth.registry))) {
    await loginECR(auth.registry, auth.username, auth.password, auth.scope);
  } else {
-    await loginStandard(auth.registry, auth.username, auth.password, auth.scope);
+    let username = auth.username;
    let password = auth.password;
    if (dockerhub.isDockerHubOIDC(auth.registry, password)) {
      const credentials = await dockerhub.getOIDCToken(auth.registry, username);
      username = credentials.username;
      password = credentials.token;
    }
    await loginStandard(auth.registry, username, password, auth.scope);
  }
 }
@@ -0,0 +1,134 @@
 import * as core from '@actions/core';
 import * as httpm from '@actions/http-client';
 import {HttpCodes} from '@actions/http-client';
 import {validate as uuidValidate} from 'uuid';
 export interface LoginCredentials {
  username: string;
  token: string;
 }
 interface OIDCTokenResponse {
  access_token: string;
 }
 const defaultExpiresIn = 300;
 const minExpiresIn = 300;
 const maxExpiresIn = 3600;
 const maxRetries = 5;
 export const isDockerHubOIDC = (registry: string, password: string): boolean => {
  return process.env.DOCKERHUB_OIDC_CONNECTIONID !== undefined && !password && isDockerHubRegistry(registry);
 };
 const isDockerHubRegistry = (registry: string): boolean => {
  return registry === '' || registry === 'docker.io' || registry === 'registry-1.docker.io' || registry === 'registry-1-stage.docker.io';
 };
 export const getOIDCToken = async (registry: string, username: string): Promise<LoginCredentials> => {
  const connectionID = process.env.DOCKERHUB_OIDC_CONNECTIONID?.trim();
  if (!connectionID) {
    throw new Error('DOCKERHUB_OIDC_CONNECTIONID is required for Docker Hub OIDC login');
  }
  if (!uuidValidate(connectionID)) {
    throw new Error('Invalid DOCKERHUB_OIDC_CONNECTIONID. Must be a valid UUID.');
  }
  const expiresIn = getExpiresIn();
  const identityHost = registry === 'registry-1-stage.docker.io' ? 'identity-stage.docker.com' : 'identity.docker.com';
  const audience = `https://${identityHost}`;
  const idToken = await core.getIDToken(audience);
  const http: httpm.HttpClient = new httpm.HttpClient('github.com/docker/login-action', [], {
    headers: {
      'Content-Type': 'application/x-www-form-urlencoded'
    }
  });
  const data = new URLSearchParams();
  data.set('grant_type', 'urn:ietf:params:oauth:grant-type:token-exchange');
  data.set('subject_token_type', 'urn:ietf:params:oauth:token-type:id_token');
  data.set('subject_token', idToken);
  data.set('connection_id', connectionID);
  data.set('expires_in', expiresIn.toString());
  const resp = await postWithRetry(http, `https://${identityHost}/oauth/token`, data.toString());
  const tokenResp = <OIDCTokenResponse>JSON.parse(await handleResponse(resp));
  core.setSecret(tokenResp.access_token);
  return {
    username,
    token: tokenResp.access_token
  };
 };
 const getExpiresIn = (): number => {
  const expiresInInput = process.env.DOCKERHUB_OIDC_EXPIREIN?.trim() || defaultExpiresIn.toString();
  const expiresIn = Number(expiresInInput);
  if (isNaN(expiresIn) || expiresIn < minExpiresIn || expiresIn > maxExpiresIn) {
    throw new Error(`Invalid DOCKERHUB_OIDC_EXPIREIN: ${expiresInInput}. Must be between ${minExpiresIn} and ${maxExpiresIn}`);
  }
  return expiresIn;
 };
 const postWithRetry = async (http: httpm.HttpClient, url: string, data: string): Promise<httpm.HttpClientResponse> => {
  let resp = await http.post(url, data);
  for (let attempt = 0; (resp.message.statusCode || HttpCodes.InternalServerError) === HttpCodes.TooManyRequests && attempt < maxRetries; attempt++) {
    const delay = parseRetryAfter(resp.message.headers['retry-after']);
    if (delay === null) {
      break;
    }
    await resp.readBody();
    core.info(`Docker Hub OIDC token request rate limited, retrying in ${delay}ms (attempt ${attempt + 1}/${maxRetries})`);
    await new Promise(resolve => setTimeout(resolve, delay));
    resp = await http.post(url, data);
  }
  return resp;
 };
 const parseRetryAfter = (value: string | string[] | undefined): number | null => {
  if (value === undefined) {
    return null;
  }
  if (Array.isArray(value)) {
    value = value[0];
  }
  const seconds = Number(value);
  if (isNaN(seconds)) {
    return null;
  }
  return Math.max(0, seconds * 1000);
 };
 const handleResponse = async (resp: httpm.HttpClientResponse): Promise<string> => {
  const body = await resp.readBody();
  const statusCode = resp.message.statusCode || HttpCodes.InternalServerError;
  if (statusCode < HttpCodes.OK || statusCode >= HttpCodes.MultipleChoices) {
    throw parseError(statusCode, body);
  }
  return body;
 };
 const parseError = (statusCode: number, body: string): Error => {
  if (statusCode === 401) {
    throw new Error(`Docker Hub API: operation not permitted`);
  }
  if (body) {
    const errResp = parseErrorBody(body);
    for (const k of ['description', 'message', 'detail', 'error']) {
      if (errResp[k]) {
        throw new Error(`Docker Hub API: bad status code ${statusCode}: ${errResp[k]}`);
      }
    }
  }
  throw new Error(`Docker Hub API: bad status code ${statusCode}`);
 };
 const parseErrorBody = (body: string): Record<string, string> => {
  try {
    return <Record<string, string>>JSON.parse(body);
  } catch {
    return {};
  }
 };