From deb9940bf4100a5b844d98a60d65f2b7811fc135 Mon Sep 17 00:00:00 2001
From: Luca Guerra <luca@guerra.sh>
Date: Sat, 10 Oct 2026 16:20:04 +0200
Subject: [PATCH] update(ci): use Docker Hub OIDC connection

Signed-off-by: Luca Guerra <luca@guerra.sh>
---
 .github/workflows/master.yml                     | 6 ++++++
 .github/workflows/release.yml                    | 6 ++++++
 .github/workflows/reusable_build_push_images.yml | 9 +++++++--
 .github/workflows/reusable_manifest_images.yml   | 9 +++++++--
 4 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
index 2797de4a..b0f597f2 100644
--- a/.github/workflows/master.yml
+++ b/.github/workflows/master.yml
@@ -19,6 +19,9 @@ jobs:
 
   push-images-master:
     needs: build-test-master
+    permissions:
+      contents: read
+      id-token: write
     strategy:
       matrix:
         arch: [amd64, arm64]
@@ -30,6 +33,9 @@ jobs:
 
   images-master:
     needs: push-images-master
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/reusable_manifest_images.yml
     secrets: inherit
       
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e66cc828..77bca8c2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,6 +20,9 @@ jobs:
 
   push-images-release:
     needs: build-test-release
+    permissions:
+      contents: read
+      id-token: write
     strategy:
       matrix:
         arch: [amd64, arm64]
@@ -33,6 +36,9 @@ jobs:
 
   images-release:
     needs: push-images-release
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/reusable_manifest_images.yml
     with:
       tag: ${{ github.ref_name }}
diff --git a/.github/workflows/reusable_build_push_images.yml b/.github/workflows/reusable_build_push_images.yml
index 72d1e77f..79d529ff 100644
--- a/.github/workflows/reusable_build_push_images.yml
+++ b/.github/workflows/reusable_build_push_images.yml
@@ -30,6 +30,9 @@ on:
 jobs:
   build-images:
     runs-on: ${{ (inputs.arch == 'arm64' && 'ubuntu-22.04-arm') || 'ubuntu-22.04' }}
+    permissions:
+      contents: read
+      id-token: write
     env:
       GIT_BRANCH: ${{ inputs.branch }}
       GIT_TAG: ${{ inputs.tag }}
@@ -55,9 +58,11 @@ jobs:
       - name: Login to Docker Hub
         if: inputs.push
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        env:
+          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTION }}
+          DOCKERHUB_OIDC_EXPIREIN: 600
         with:
-          username: ${{ secrets.DOCKERHUB_USER }}
-          password: ${{ secrets.DOCKERHUB_SECRET }}
+          username: falcosecurity
           
       - name: Build and Push docker images
         if: inputs.push
diff --git a/.github/workflows/reusable_manifest_images.yml b/.github/workflows/reusable_manifest_images.yml
index efd70e47..219d2de3 100644
--- a/.github/workflows/reusable_manifest_images.yml
+++ b/.github/workflows/reusable_manifest_images.yml
@@ -21,6 +21,9 @@ on:
 jobs:
   push-manifest:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     env:
       GIT_BRANCH: ${{ inputs.branch }}
       GIT_TAG: ${{ inputs.tag }}
@@ -33,9 +36,11 @@ jobs:
           
       - name: Login to Docker Hub
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        env:
+          DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.DOCKERHUB_OIDC_CONNECTION }}
+          DOCKERHUB_OIDC_EXPIREIN: 600
         with:
-          username: ${{ secrets.DOCKERHUB_USER }}
-          password: ${{ secrets.DOCKERHUB_SECRET }}
+          username: falcosecurity
           
       - name: Build and Push manifest to registry
         run: make manifest/all