Add scope input to set scopes for the authentication token

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
2026-01-16 17:20:46 +08:00 · 2026-01-06 13:51:25 +01:00
parent 916386b000
commit 4850ca5e15
8 changed files with 255 additions and 78 deletions
--- a/src/context.ts
+++ b/src/context.ts
@@ -1,21 +1,82 @@
+import path from 'path';
 import * as core from '@actions/core';
+import * as yaml from 'js-yaml';
+
+import {Buildx} from '@docker/actions-toolkit/lib/buildx/buildx';

 export interface Inputs {
  registry: string;
  username: string;
  password: string;
+  scope: string;
  ecr: string;
  logout: boolean;
  registryAuth: string;
 }

+export interface Auth {
+  registry: string;
+  username: string;
+  password: string;
+  scope: string;
+  ecr: string;
+  configDir: string;
+}
+
 export function getInputs(): Inputs {
  return {
    registry: core.getInput('registry'),
    username: core.getInput('username'),
    password: core.getInput('password'),
+    scope: core.getInput('scope'),
    ecr: core.getInput('ecr'),
    logout: core.getBooleanInput('logout'),
    registryAuth: core.getInput('registry-auth')
  };
 }
+
+export function getAuthList(inputs: Inputs): Array<Auth> {
+  if (inputs.registryAuth && (inputs.registry || inputs.username || inputs.password || inputs.scope || inputs.ecr)) {
+    throw new Error('Cannot use registry-auth with other inputs');
+  }
+  let auths: Array<Auth> = [];
+  if (!inputs.registryAuth) {
+    auths.push({
+      registry: inputs.registry || 'docker.io',
+      username: inputs.username,
+      password: inputs.password,
+      scope: inputs.scope,
+      ecr: inputs.ecr || 'auto',
+      configDir: scopeToConfigDir(inputs.registry, inputs.scope)
+    });
+  } else {
+    auths = (yaml.load(inputs.registryAuth) as Array<Auth>).map(auth => {
+      core.setSecret(auth.password); // redacted in workflow logs
+      return {
+        registry: auth.registry || 'docker.io',
+        username: auth.username,
+        password: auth.password,
+        scope: auth.scope,
+        ecr: auth.ecr || 'auto',
+        configDir: scopeToConfigDir(auth.registry || 'docker.io', auth.scope)
+      };
+    });
+  }
+  if (auths.length == 0) {
+    throw new Error('No registry to login');
+  }
+  return auths;
+}
+
+export function scopeToConfigDir(registry: string, scope?: string): string {
+  if (!scope || scope === '') {
+    return '';
+  }
+  let configDir = path.join(Buildx.configDir, 'config', registry === 'docker.io' ? 'registry-1.docker.io' : registry);
+  if (scope.startsWith('@')) {
+    configDir += scope;
+  } else {
+    configDir = path.join(configDir, scope);
+  }
+  return configDir;
+}
--- a/src/docker.ts
+++ b/src/docker.ts
@@ -1,19 +1,31 @@
-import * as aws from './aws';
 import * as core from '@actions/core';

+import * as aws from './aws';
+import * as context from './context';
+
 import {Docker} from '@docker/actions-toolkit/lib/docker/docker';

-export async function login(registry: string, username: string, password: string, ecr: string): Promise<void> {
-  if (/true/i.test(ecr) || (ecr == 'auto' && aws.isECR(registry))) {
-    await loginECR(registry, username, password);
+export async function login(auth: context.Auth): Promise<void> {
+  if (/true/i.test(auth.ecr) || (auth.ecr == 'auto' && aws.isECR(auth.registry))) {
+    await loginECR(auth.registry, auth.username, auth.password, auth.scope);
  } else {
-    await loginStandard(registry, username, password);
+    await loginStandard(auth.registry, auth.username, auth.password, auth.scope);
  }
 }

-export async function logout(registry: string): Promise<void> {
+export async function logout(registry: string, configDir: string): Promise<void> {
+  let envs: {[key: string]: string} | undefined;
+  if (configDir !== '') {
+    envs = Object.assign({}, process.env, {
+      DOCKER_CONFIG: configDir
+    }) as {
+      [key: string]: string;
+    };
+    core.info(`Alternative config dir: ${configDir}`);
+  }
  await Docker.getExecOutput(['logout', registry], {
-    ignoreReturnCode: true
+    ignoreReturnCode: true,
+    env: envs
  }).then(res => {
    if (res.stderr.length > 0 && res.exitCode != 0) {
      core.warning(res.stderr.trim());
@@ -21,7 +33,7 @@ export async function logout(registry: string): Promise<void> {
  });
 }

-export async function loginStandard(registry: string, username: string, password: string): Promise<void> {
+export async function loginStandard(registry: string, username: string, password: string, scope?: string): Promise<void> {
  if (!username && !password) {
    throw new Error('Username and password required');
  }
@@ -31,38 +43,38 @@ export async function loginStandard(registry: string, username: string, password
  if (!password) {
    throw new Error('Password required');
  }
+  await loginExec(registry, username, password, scope);
+}

-  const loginArgs: Array<string> = ['login', '--password-stdin'];
-  loginArgs.push('--username', username);
-  loginArgs.push(registry);
+export async function loginECR(registry: string, username: string, password: string, scope?: string): Promise<void> {
+  core.info(`Retrieving registries data through AWS SDK...`);
+  const regDatas = await aws.getRegistriesData(registry, username, password);
+  for (const regData of regDatas) {
+    await loginExec(regData.registry, regData.username, regData.password, scope);
+  }
+}

-  core.info(`Logging into ${registry}...`);
-  await Docker.getExecOutput(loginArgs, {
+async function loginExec(registry: string, username: string, password: string, scope?: string): Promise<void> {
+  let envs: {[key: string]: string} | undefined;
+  if (scope && scope !== '') {
+    envs = Object.assign({}, process.env, {
+      DOCKER_CONFIG: context.scopeToConfigDir(registry, scope)
+    }) as {
+      [key: string]: string;
+    };
+    core.info(`Logging into ${registry} (scope ${scope})...`);
+  } else {
+    core.info(`Logging into ${registry}...`);
+  }
+  await Docker.getExecOutput(['login', '--password-stdin', '--username', username, registry], {
    ignoreReturnCode: true,
    silent: true,
-    input: Buffer.from(password)
+    input: Buffer.from(password),
+    env: envs
  }).then(res => {
    if (res.stderr.length > 0 && res.exitCode != 0) {
      throw new Error(res.stderr.trim());
    }
-    core.info(`Login Succeeded!`);
+    core.info('Login Succeeded!');
  });
 }
-
-export async function loginECR(registry: string, username: string, password: string): Promise<void> {
-  core.info(`Retrieving registries data through AWS SDK...`);
-  const regDatas = await aws.getRegistriesData(registry, username, password);
-  for (const regData of regDatas) {
-    core.info(`Logging into ${regData.registry}...`);
-    await Docker.getExecOutput(['login', '--password-stdin', '--username', regData.username, regData.registry], {
-      ignoreReturnCode: true,
-      silent: true,
-      input: Buffer.from(regData.password)
-    }).then(res => {
-      if (res.stderr.length > 0 && res.exitCode != 0) {
-        throw new Error(res.stderr.trim());
-      }
-      core.info('Login Succeeded!');
-    });
-  }
-}
--- a/src/main.ts
+++ b/src/main.ts
@@ -1,4 +1,3 @@
-import * as yaml from 'js-yaml';
 import * as core from '@actions/core';
 import * as actionsToolkit from '@docker/actions-toolkit';

@@ -6,48 +5,21 @@ import * as context from './context';
 import * as docker from './docker';
 import * as stateHelper from './state-helper';

-interface Auth {
-  registry: string;
-  username: string;
-  password: string;
-  ecr: string;
-}
-
 export async function main(): Promise<void> {
  const inputs: context.Inputs = context.getInputs();
  stateHelper.setLogout(inputs.logout);

-  if (inputs.registryAuth && (inputs.registry || inputs.username || inputs.password || inputs.ecr)) {
-    throw new Error('Cannot use registry-auth with other inputs');
-  }
+  const auths = context.getAuthList(inputs);
+  stateHelper.setRegistries(Array.from(new Map(auths.map(auth => [`${auth.registry}|${auth.configDir}`, {registry: auth.registry, configDir: auth.configDir} as stateHelper.RegistryState])).values()));

-  if (!inputs.registryAuth) {
-    stateHelper.setRegistries([inputs.registry || 'docker.io']);
-    await docker.login(inputs.registry || 'docker.io', inputs.username, inputs.password, inputs.ecr || 'auto');
+  if (auths.length === 1) {
+    await docker.login(auths[0]);
    return;
  }

-  const auths = yaml.load(inputs.registryAuth) as Auth[];
-  if (auths.length == 0) {
-    throw new Error('No registry to login');
-  }
-
-  const registries: string[] = [];
  for (const auth of auths) {
-    if (!auth.registry) {
-      registries.push('docker.io');
-    } else {
-      registries.push(auth.registry);
-    }
-    if (auth.password) {
-      core.setSecret(auth.password);
-    }
-  }
-  stateHelper.setRegistries(registries.filter((value, index, self) => self.indexOf(value) === index));
-
-  for (const auth of auths) {
-    await core.group(`Login to ${auth.registry || 'docker.io'}`, async () => {
-      await docker.login(auth.registry || 'docker.io', auth.username, auth.password, auth.ecr || 'auto');
+    await core.group(`Login to ${auth.registry}`, async () => {
+      await docker.login(auth);
    });
  }
 }
@@ -56,8 +28,10 @@ async function post(): Promise<void> {
  if (!stateHelper.logout) {
    return;
  }
-  for (const registry of stateHelper.registries.split(',')) {
-    await docker.logout(registry);
+  for (const registryState of stateHelper.registries) {
+    await core.group(`Logout from ${registryState.registry}`, async () => {
+      await docker.logout(registryState.registry, registryState.configDir);
+    });
  }
 }

--- a/src/state-helper.ts
+++ b/src/state-helper.ts
@@ -1,10 +1,15 @@
 import * as core from '@actions/core';

-export const registries = process.env['STATE_registries'] || '';
+export const registries = process.env['STATE_registries'] ? (JSON.parse(process.env['STATE_registries']) as Array<RegistryState>) : [];
 export const logout = /true/i.test(process.env['STATE_logout'] || '');

-export function setRegistries(registries: string[]) {
-  core.saveState('registries', registries.join(','));
+export interface RegistryState {
+  registry: string;
+  configDir: string;
+}
+
+export function setRegistries(registries: Array<RegistryState>) {
+  core.saveState('registries', JSON.stringify(registries));
 }

 export function setLogout(logout: boolean) {