(ci) Use Docker Hub OIDC for image publishing

[arturcic]

Summary

• authenticate Docker Hub image publishing with OIDC through docker/login-action
• authenticate Docker Hub manifest publishing with the same short-lived flow
• grant id-token: write only to publishing jobs
• stop passing inherited repository secrets into the image and manifest workflows
• keep Docker test jobs on read-only permissions

Configuration required

Before exercising the publishing path:

• create a Docker Hub OIDC connection for GitTools/GitVersion on refs/heads/main
• grant write access only to gittools/gitversion
• set the repository variable DOCKERHUB_OIDC_CONNECTIONID to that connection ID

Known limitation

Docker Hub README publishing intentionally still uses the existing credential action. The official docker/oidc-action documentation currently states that issued tokens are limited to registry login and that broader Docker Hub API authentication is not supported. The README publisher calls the Docker Hub API directly, so migrating that step now would make release publishing fail.

This draft therefore covers the image and manifest portion of #5090, but does not close the issue.

Validation

• actionlint .github/workflows/_docker.yml .github/workflows/_docker_manifests.yml .github/workflows/ci.yml
• parsed both changed composite-action YAML files
• git diff --check

Closes to #5090

[arturcic]

Docker Hub API blocker: the official docker/oidc-action documentation says the short-lived OIDC token is currently limited to registry login and cannot authenticate to the broader Docker Hub API.

GitVersion's DockerHubReadmePublish target updates the repository overview through a Docker Hub API PATCH. That path therefore remains on the existing credentials in this draft. Once Docker supports Hub API access for OIDC-issued tokens, the follow-up can migrate the README step and remove the remaining dockerhub-creds / OP_SERVICE_ACCOUNT_TOKEN plumbing.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR updates GitVersion’s CI Docker publishing pipeline to authenticate to Docker Hub using short-lived OIDC tokens (via docker/login-action), reducing reliance on long-lived Docker Hub credentials and limiting id-token: write to the jobs involved in image/manifest publishing.

Changes:

• Switch Docker image and manifest publishing to Docker Hub OIDC (DOCKERHUB_OIDC_CONNECTIONID) and stop inheriting repository secrets for those reusable workflows.
• Add dockerhub_oidc_connection_id as an explicit reusable-workflow input and thread it through to the composite Docker publish/manifest actions.
• Update Docker Hub logins in composite actions to use OIDC (and bump docker/login-action to v4.6.0).

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/ci.yml	Grants id-token: write to Docker publishing jobs and passes the OIDC connection id via workflow inputs (removing secrets: inherit for Docker jobs).
.github/workflows/_docker.yml	Splits Docker workflow into test vs publish jobs so publishing can use OIDC + elevated permissions while tests remain minimal.
.github/workflows/_docker_manifests.yml	Updates manifest publishing workflow to use OIDC-based Docker Hub auth and scopes permissions to the publishing path.
.github/actions/docker-publish/action.yml	Replaces Docker Hub username/password login with OIDC-based login via DOCKERHUB_OIDC_CONNECTIONID.
.github/actions/docker-manifests/action.yml	Replaces Docker Hub username/password login with OIDC-based login via DOCKERHUB_OIDC_CONNECTIONID.