From 8984be3d970e953e7fa7ddc3f62033aaba129a94 Mon Sep 17 00:00:00 2001 From: CrazyMax <1951866+crazy-max@users.noreply.github.com> Date: Tue, 11 Aug 2026 11:21:18 +0200 Subject: [PATCH] set Docker Hub OIDC token lifetime default to 1 hour Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com> --- README.md | 2 +- __tests__/dockerhub.test.ts | 4 ++-- src/dockerhub.ts | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index ad303b5..e0433d7 100644 --- a/README.md +++ b/README.md @@ -760,7 +760,7 @@ The following environment variables can be set as `step.env` keys: | Name | Type | Default | Description | |-------------------------------|--------|---------|----------------------------------------------------------------------------------------------------| | `DOCKERHUB_OIDC_CONNECTIONID` | String | | Docker Hub OIDC connection ID. Required for Docker Hub OIDC login | -| `DOCKERHUB_OIDC_EXPIREIN` | Number | `300` | Docker Hub OIDC token lifetime in seconds. Must be between `300` (5 minutes) and `21600` (6 hours) | +| `DOCKERHUB_OIDC_EXPIREIN` | Number | `3600` | Docker Hub OIDC token lifetime in seconds. Must be between `300` (5 minutes) and `21600` (6 hours) | ## Contributing diff --git a/__tests__/dockerhub.test.ts b/__tests__/dockerhub.test.ts index 5195371..f0ad17a 100644 --- a/__tests__/dockerhub.test.ts +++ b/__tests__/dockerhub.test.ts @@ -82,14 +82,14 @@ describe('getOIDCToken', () => { expect(body.get('subject_token_type')).toBe('urn:ietf:params:oauth:token-type:id_token'); expect(body.get('subject_token')).toBe('github-id-token'); expect(body.get('connection_id')).toBe(validConnectionID); - expect(body.get('expires_in')).toBe('300'); + expect(body.get('expires_in')).toBe('3600'); expect(setSecretMock).toHaveBeenCalledWith('hub-token'); expect(core.info).toHaveBeenCalledWith('Docker Hub OIDC detected for docker.io'); expect(core.info).toHaveBeenCalledWith('Retrieving GitHub OIDC token for Docker Hub'); expect(core.info).toHaveBeenCalledWith('Exchanging GitHub OIDC token for Docker Hub token'); expect(core.info).toHaveBeenCalledWith('Docker Hub OIDC token exchange succeeded'); expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token audience: https://identity.docker.com'); - expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token expiration: 300s'); + expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token expiration: 3600s'); expect(core.debug).toHaveBeenCalledWith('Sending Docker Hub OIDC token request to https://identity.docker.com/oauth/token'); expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token request returned status code 200'); expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token response status code: 200'); diff --git a/src/dockerhub.ts b/src/dockerhub.ts index 6164b5d..f0fa190 100644 --- a/src/dockerhub.ts +++ b/src/dockerhub.ts @@ -13,7 +13,7 @@ interface OIDCTokenResponse { } const registries = new Set(['', 'docker.io', 'registry-1.docker.io', 'registry-1-stage.docker.io', 'dhi.io']); -const defaultExpiresIn = 300; +const defaultExpiresIn = 3600; const minExpiresIn = 300; const maxExpiresIn = 21600; const maxRetries = 5;