Merge pull request #1068 from crazy-max/dockerhub-oidc-increase-expire-in

raise Docker Hub OIDC max expiry to 6 hours

README.md

@@ -757,10 +757,10 @@ The following inputs can be used as `step.with` keys:
 
 The following environment variables can be set as `step.env` keys:
 
-| Name                          | Type   | Default | Description                                                                 |
-|-------------------------------|--------|---------|-----------------------------------------------------------------------------|
-| `DOCKERHUB_OIDC_CONNECTIONID` | String |         | Docker Hub OIDC connection ID. Required for Docker Hub OIDC login           |
-| `DOCKERHUB_OIDC_EXPIREIN`     | Number | `300`   | Docker Hub OIDC token lifetime in seconds. Must be between `300` and `3600` |
+| Name                          | Type   | Default | Description                                                                                        |
+|-------------------------------|--------|---------|----------------------------------------------------------------------------------------------------|
+| `DOCKERHUB_OIDC_CONNECTIONID` | String |         | Docker Hub OIDC connection ID. Required for Docker Hub OIDC login                                  |
+| `DOCKERHUB_OIDC_EXPIREIN`     | Number | `300`   | Docker Hub OIDC token lifetime in seconds. Must be between `300` (5 minutes) and `21600` (6 hours) |
 
 ## Contributing
 

__tests__/dockerhub.test.ts

@@ -86,10 +86,10 @@ describe('getOIDCToken', () => {
   });
 
   test('uses custom token expiration', async () => {
-    process.env.DOCKERHUB_OIDC_EXPIREIN = '900';
+    process.env.DOCKERHUB_OIDC_EXPIREIN = '21600';
     await dockerhub.getOIDCToken('docker.io', 'dbowie');
     const body = new URLSearchParams(postSpy.mock.calls[0][1]);
-    expect(body.get('expires_in')).toBe('900');
+    expect(body.get('expires_in')).toBe('21600');
   });
 
   test('uses stage identity host for stage registry', async () => {
@@ -112,9 +112,9 @@ describe('getOIDCToken', () => {
     expect(postSpy).not.toHaveBeenCalled();
   });
 
-  test.each(['not-a-number', '299', '3601'])('validates token expiration %p', async expiresIn => {
+  test.each(['not-a-number', '299', '21601'])('validates token expiration %p', async expiresIn => {
     process.env.DOCKERHUB_OIDC_EXPIREIN = expiresIn;
-    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow(`Invalid DOCKERHUB_OIDC_EXPIREIN: ${expiresIn}. Must be between 300 and 3600`);
+    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow(`Invalid DOCKERHUB_OIDC_EXPIREIN: ${expiresIn}. Must be between 300 and 21600`);
     expect(getIDTokenMock).not.toHaveBeenCalled();
     expect(postSpy).not.toHaveBeenCalled();
   });

dist/licenses.txt

@@ -4591,7 +4591,7 @@ USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 The following npm packages may be included in this product:
 
- - brace-expansion@1.1.18
+ - brace-expansion@1.1.16
  - brace-expansion@2.0.3
 
 These packages each contain the following license:

src/dockerhub.ts

@@ -15,7 +15,7 @@ interface OIDCTokenResponse {
 const registries = new Set(['', 'docker.io', 'registry-1.docker.io', 'registry-1-stage.docker.io', 'dhi.io']);
 const defaultExpiresIn = 300;
 const minExpiresIn = 300;
-const maxExpiresIn = 3600;
+const maxExpiresIn = 21600;
 const maxRetries = 5;
 
 export const isDockerHubOIDC = (registry: string, password: string): boolean => {

yarn.lock

@@ -2762,12 +2762,12 @@ __metadata:
   linkType: hard
 
 "brace-expansion@npm:^1.1.7":
-  version: 1.1.18
-  resolution: "brace-expansion@npm:1.1.18"
+  version: 1.1.16
+  resolution: "brace-expansion@npm:1.1.16"
   dependencies:
     balanced-match: "npm:^1.0.0"
     concat-map: "npm:0.0.1"
-  checksum: 10/b55a3c03239b8d2127c7cbb3408c9ad3a556a8c303bf3064df78bfb7c093160fc8f6e0a32e42a850a78eba12f29ccf6ef997690b9acf945d242c56c61c4aa977
+  checksum: 10/94498bead66c51536df5b7bf1b0a0e581a5b7f86888be10481d06920c4bd9d976e003b13a3d19fddc733f21a09d162ff72f90e18b2c9d062b15121e973d0e13b
   languageName: node
   linkType: hard