Docker Hub gets OIDC federation for GitHub Actions, retiring the PAT-in-a-secret pattern

Docker Hub now supports OIDC federation with GitHub Actions, letting workflows exchange a per-run signed token for a temporary registry credential instead of storing a Personal Access Token (PAT).

The feature is available to Docker Team, Docker Business, and Docker Hardened Images customers, and requires trust policies configured on Docker’s side.

This reduces long-lived secrets in CI/CD, shrinking the window for token theft and making rotation, revocation, and incident response easier.

Security focus shifts from secret storage to designing and auditing trust policies that control which workflows can obtain credentials.