Docker Hub now supports OIDC federation with GitHub Actions, eliminating stored tokens

Docker has enabled OpenID Connect (OIDC) authentication between GitHub Actions and Docker Hub, allowing CI/CD workflows to use short-lived, automatically expiring credentials instead of stored Personal Access Tokens. The feature is available to organizations on Docker Team, Docker Business, and Docker Hardened Images plans. When a workflow runs, GitHub issues a signed JWT that Docker validates against a configured trust policy, returning a temporary credential that expires once the job ends. This eliminates long-lived tokens from repositories, secret stores, and Actions caches, reducing the risk of credential theft in supply-chain attacks. However, Docker cautions that the trust policy itself must be carefully scoped to specific repositories and environments, as an overly broad policy could allow any branch in an organization to request a Docker credential.