build(deps): bump @humanfs/node from 0.16.7 to 0.16.8

Bumps [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) from 0.16.7 to 0.16.8.
- [Release notes](https://github.com/humanwhocodes/humanfs/releases)
- [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node)

---
updated-dependencies:
- dependency-name: "@humanfs/node"
  dependency-version: 0.16.8
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/actions/docker-pull/Dockerfile

@@ -0,0 +1,3 @@
+FROM docker:29.3@sha256:4d90f1f6c400315c2dba96d3ec93c01e64198395cbba04f79d12adce4f737029
+
+ENTRYPOINT ["docker"]

.github/actions/docker-pull/action.yml

@@ -0,0 +1,15 @@
+name: Pull Docker image
+
+description: Pull an image from a Docker container action
+
+inputs:
+  image:
+    description: Image reference to pull
+    required: true
+
+runs:
+  using: docker
+  image: Dockerfile
+  args:
+    - pull
+    - ${{ inputs.image }}

.github/workflows/ci.yml

@@ -106,11 +106,10 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       -
-        name: DinD
-        uses: docker://docker:29.3@sha256:4d90f1f6c400315c2dba96d3ec93c01e64198395cbba04f79d12adce4f737029
+        name: Pull test image from Docker CLI container action
+        uses: ./.github/actions/docker-pull
         with:
-          entrypoint: docker
-          args: pull ${{ env.GHCR_TEST_IMAGE }}
+          image: ${{ env.GHCR_TEST_IMAGE }}
       -
         name: Pull test image
         run: |

README.md

@@ -757,10 +757,10 @@ The following inputs can be used as `step.with` keys:
 
 The following environment variables can be set as `step.env` keys:
 
-| Name                          | Type   | Default | Description                                                                 |
-|-------------------------------|--------|---------|-----------------------------------------------------------------------------|
-| `DOCKERHUB_OIDC_CONNECTIONID` | String |         | Docker Hub OIDC connection ID. Required for Docker Hub OIDC login           |
-| `DOCKERHUB_OIDC_EXPIREIN`     | Number | `300`   | Docker Hub OIDC token lifetime in seconds. Must be between `300` and `3600` |
+| Name                          | Type   | Default | Description                                                                                        |
+|-------------------------------|--------|---------|----------------------------------------------------------------------------------------------------|
+| `DOCKERHUB_OIDC_CONNECTIONID` | String |         | Docker Hub OIDC connection ID. Required for Docker Hub OIDC login                                  |
+| `DOCKERHUB_OIDC_EXPIREIN`     | Number | `300`   | Docker Hub OIDC token lifetime in seconds. Must be between `300` (5 minutes) and `21600` (6 hours) |
 
 ## Contributing
 

__tests__/dockerhub.test.ts

@@ -5,6 +5,7 @@ import {beforeEach, describe, expect, test, vi} from 'vitest';
 import * as dockerhub from '../src/dockerhub.js';
 
 vi.mock('@actions/core', () => ({
+  debug: vi.fn(),
   getIDToken: vi.fn(),
   info: vi.fn(),
   setSecret: vi.fn()
@@ -83,13 +84,22 @@ describe('getOIDCToken', () => {
     expect(body.get('connection_id')).toBe(validConnectionID);
     expect(body.get('expires_in')).toBe('300');
     expect(setSecretMock).toHaveBeenCalledWith('hub-token');
+    expect(core.info).toHaveBeenCalledWith('Docker Hub OIDC detected for docker.io');
+    expect(core.info).toHaveBeenCalledWith('Retrieving GitHub OIDC token for Docker Hub');
+    expect(core.info).toHaveBeenCalledWith('Exchanging GitHub OIDC token for Docker Hub token');
+    expect(core.info).toHaveBeenCalledWith('Docker Hub OIDC token exchange succeeded');
+    expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token audience: https://identity.docker.com');
+    expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token expiration: 300s');
+    expect(core.debug).toHaveBeenCalledWith('Sending Docker Hub OIDC token request to https://identity.docker.com/oauth/token');
+    expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token request returned status code 200');
+    expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token response status code: 200');
   });
 
   test('uses custom token expiration', async () => {
-    process.env.DOCKERHUB_OIDC_EXPIREIN = '900';
+    process.env.DOCKERHUB_OIDC_EXPIREIN = '21600';
     await dockerhub.getOIDCToken('docker.io', 'dbowie');
     const body = new URLSearchParams(postSpy.mock.calls[0][1]);
-    expect(body.get('expires_in')).toBe('900');
+    expect(body.get('expires_in')).toBe('21600');
   });
 
   test('uses stage identity host for stage registry', async () => {
@@ -112,9 +122,9 @@ describe('getOIDCToken', () => {
     expect(postSpy).not.toHaveBeenCalled();
   });
 
-  test.each(['not-a-number', '299', '3601'])('validates token expiration %p', async expiresIn => {
+  test.each(['not-a-number', '299', '21601'])('validates token expiration %p', async expiresIn => {
     process.env.DOCKERHUB_OIDC_EXPIREIN = expiresIn;
-    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow(`Invalid DOCKERHUB_OIDC_EXPIREIN: ${expiresIn}. Must be between 300 and 3600`);
+    await expect(dockerhub.getOIDCToken('docker.io', 'dbowie')).rejects.toThrow(`Invalid DOCKERHUB_OIDC_EXPIREIN: ${expiresIn}. Must be between 300 and 21600`);
     expect(getIDTokenMock).not.toHaveBeenCalled();
     expect(postSpy).not.toHaveBeenCalled();
   });

src/dockerhub.ts

@@ -15,7 +15,7 @@ interface OIDCTokenResponse {
 const registries = new Set(['', 'docker.io', 'registry-1.docker.io', 'registry-1-stage.docker.io', 'dhi.io']);
 const defaultExpiresIn = 300;
 const minExpiresIn = 300;
-const maxExpiresIn = 3600;
+const maxExpiresIn = 21600;
 const maxRetries = 5;
 
 export const isDockerHubOIDC = (registry: string, password: string): boolean => {
@@ -35,6 +35,10 @@ export const getOIDCToken = async (registry: string, username: string): Promise<
   const expiresIn = getExpiresIn();
   const identityHost = registry === 'registry-1-stage.docker.io' ? 'identity-stage.docker.com' : 'identity.docker.com';
   const audience = `https://${identityHost}`;
+  core.info(`Docker Hub OIDC detected for ${registry || 'docker.io'}`);
+  core.debug(`Docker Hub OIDC token audience: ${audience}`);
+  core.debug(`Docker Hub OIDC token expiration: ${expiresIn}s`);
+  core.info(`Retrieving GitHub OIDC token for Docker Hub`);
   const idToken = await core.getIDToken(audience);
   const http: httpm.HttpClient = new httpm.HttpClient('github.com/docker/login-action', [], {
     headers: {
@@ -49,10 +53,12 @@ export const getOIDCToken = async (registry: string, username: string): Promise<
   data.set('connection_id', connectionID);
   data.set('expires_in', expiresIn.toString());
 
+  core.info(`Exchanging GitHub OIDC token for Docker Hub token`);
   const resp = await postWithRetry(http, `https://${identityHost}/oauth/token`, data.toString());
 
   const tokenResp = <OIDCTokenResponse>JSON.parse(await handleResponse(resp));
   core.setSecret(tokenResp.access_token);
+  core.info(`Docker Hub OIDC token exchange succeeded`);
 
   return {
     username,
@@ -70,16 +76,20 @@ const getExpiresIn = (): number => {
 };
 
 const postWithRetry = async (http: httpm.HttpClient, url: string, data: string): Promise<httpm.HttpClientResponse> => {
+  core.debug(`Sending Docker Hub OIDC token request to ${url}`);
   let resp = await http.post(url, data);
+  core.debug(`Docker Hub OIDC token request returned status code ${resp.message.statusCode || HttpCodes.InternalServerError}`);
   for (let attempt = 0; (resp.message.statusCode || HttpCodes.InternalServerError) === HttpCodes.TooManyRequests && attempt < maxRetries; attempt++) {
     const delay = parseRetryAfter(resp.message.headers['retry-after']);
     if (delay === null) {
+      core.debug(`Docker Hub OIDC token request rate limited without retry-after header`);
       break;
     }
     await resp.readBody();
     core.info(`Docker Hub OIDC token request rate limited, retrying in ${delay}ms (attempt ${attempt + 1}/${maxRetries})`);
     await new Promise(resolve => setTimeout(resolve, delay));
     resp = await http.post(url, data);
+    core.debug(`Docker Hub OIDC token request returned status code ${resp.message.statusCode || HttpCodes.InternalServerError}`);
   }
   return resp;
 };
@@ -101,6 +111,7 @@ const parseRetryAfter = (value: string | string[] | undefined): number | null =>
 const handleResponse = async (resp: httpm.HttpClientResponse): Promise<string> => {
   const body = await resp.readBody();
   const statusCode = resp.message.statusCode || HttpCodes.InternalServerError;
+  core.debug(`Docker Hub OIDC token response status code: ${statusCode}`);
   if (statusCode < HttpCodes.OK || statusCode >= HttpCodes.MultipleChoices) {
     throw parseError(statusCode, body);
   }

yarn.lock

@@ -1165,20 +1165,30 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@humanfs/core@npm:^0.19.1":
-  version: 0.19.1
-  resolution: "@humanfs/core@npm:0.19.1"
-  checksum: 10/270d936be483ab5921702623bc74ce394bf12abbf57d9145a69e8a0d1c87eb1c768bd2d93af16c5705041e257e6d9cc7529311f63a1349f3678abc776fc28523
+"@humanfs/core@npm:^0.19.2":
+  version: 0.19.2
+  resolution: "@humanfs/core@npm:0.19.2"
+  dependencies:
+    "@humanfs/types": "npm:^0.15.0"
+  checksum: 10/c6c0273721ec8df3d36a57c390a11a168d0a2f513d78bceb25165bded4fcb73609b1a317edc6c8f331cefd4b47285dde0b1e6679e08ef7f062232ec14fe05312
   languageName: node
   linkType: hard
 
 "@humanfs/node@npm:^0.16.6":
-  version: 0.16.7
-  resolution: "@humanfs/node@npm:0.16.7"
+  version: 0.16.8
+  resolution: "@humanfs/node@npm:0.16.8"
   dependencies:
-    "@humanfs/core": "npm:^0.19.1"
+    "@humanfs/core": "npm:^0.19.2"
+    "@humanfs/types": "npm:^0.15.0"
     "@humanwhocodes/retry": "npm:^0.4.0"
-  checksum: 10/b3633d3dce898592cac515ba5e6693c78e6be92863541d3eaf2c009b10f52b2fa62ff6e6e06f240f2447ddbe7b5f1890bc34e9308470675c876eee207553a08d
+  checksum: 10/ed01b3c066d9cec7526d139b9e71ca00ee4a30b3b5f5f5c198eb069c3509a3e167e180ba7e1e5a83b9571e906c4908bd20402b47586887452311af7354995e95
+  languageName: node
+  linkType: hard
+
+"@humanfs/types@npm:^0.15.0":
+  version: 0.15.0
+  resolution: "@humanfs/types@npm:0.15.0"
+  checksum: 10/dea3cc7fd8f8d4d088ed8d0a9921cf12bd8e1cdf40a6133106b03a6e2aebcc9a6f1771b3643b7ec71baae90d08245db34069dfcc861da8d678662741e6c3c986
   languageName: node
   linkType: hard