Merge pull request #643 from crazy-max/ci-codecov-oidc

ci: use OIDC for Codecov uploads

.github/workflows/ci.yml

@@ -182,6 +182,15 @@ jobs:
 
   endpoint:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        endpoint:
+          - mycontext
+          - tcp://127.0.0.1:2375
+    env:
+      # only the explicit endpoint should provide access to a daemon.
+      DOCKER_HOST: unix:///tmp/nonexistent-docker.sock
     services:
       dind:
         image: docker:29.3-dind@sha256:4d90f1f6c400315c2dba96d3ec93c01e64198395cbba04f79d12adce4f737029
@@ -209,11 +218,19 @@ jobs:
           docker --context mycontext info
       -
         name: Set up Docker Buildx
+        id: buildx
         uses: ./
         with:
-          endpoint: mycontext
+          endpoint: ${{ matrix.endpoint }}
+      -
+        name: Build
         env:
-          DOCKER_CONTEXT: mycontext
+          BUILDER: ${{ steps.buildx.outputs.name }}
+        run: |
+          docker buildx build --builder "$BUILDER" - <<'EOF'
+          FROM scratch
+          LABEL test=endpoint
+          EOF
 
   buildkitd-config:
     runs-on: ubuntu-latest

.github/workflows/test.yml

@@ -17,6 +17,9 @@ on:
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # for Codecov authentication
     steps:
       -
         name: Checkout
@@ -35,4 +38,4 @@ jobs:
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: ./coverage/clover.xml
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true

src/main.ts

@@ -133,12 +133,14 @@ actionsToolkit.run(
 
     if (!standalone && inputs.driver == 'docker-container') {
       const buildkitImages = new Set<string>();
-      if (!builderExists) {
+      if (!builderExists && !inputs.endpoint) {
         buildkitImages.add(resolveBuildKitImage(inputs.driverOpts));
       }
       for (const node of appendNodes) {
+        if (!node.endpoint) {
           buildkitImages.add(resolveBuildKitImage(node['driver-opts']));
         }
+      }
       if (buildkitImages.size > 0) {
         await core.group(`Pulling BuildKit image(s)`, async () => {
           for (const image of buildkitImages) {