Docker now supports OpenID Connect (OIDC) for GitHub Actions, allowing CI/CD workflows to authenticate with Docker Hub using short-lived, per-run tokens instead of stored personal access tokens (PATs) or organization access tokens (OATs). This eliminates the need to store long-lived credentials as GitHub secrets, reducing the risk of credential leaks and removing the burden of manual token rotation. The feature is available for Docker Team, Business, and Hardened Images subscribers, as well as Docker Sponsored Open Source Program organizations. Setup involves creating an OIDC connection in Docker Home with configurable rulesets (scoped to specific repos, branches, or environments), then updating the GitHub Actions workflow YAML to use docker/login-action v4.5.0+ with the connection ID. Existing PATs and OATs continue to work, allowing gradual migration.
