Push images to Vercel Container Registry from GitHub Actions
By Steven Van ·
A new vcr-action/login GitHub Action authenticates via OIDC instead of stored registry credentials, supporting Docker, Podman, or Buildah.
GitHub Actions can now push images to Vercel Container Registry without storing long-lived registry credentials. A new action, vercel/vcr-action/login, exchanges the workflow's GitHub OIDC token for a short-lived Vercel access token and uses it to log in to vcr.vercel.com. When the job finishes, a post step logs out and revokes that token, even if a later step fails.
To use it, a team creates an OIDC policy matching the repository and workflow that grants read-write access to VCR, stores the Vercel team ID as a repo variable, and gives the workflow id-token: write permission. The login step then runs before the usual build and push commands. The action authenticates Docker by default, and can authenticate Podman or Buildah instead via its engines input. Once VCR has a linux/amd64 image, it can also be referenced as a custom Vercel Sandbox image within the same project.
Read the announcement for setup details.