Vercel Container Registry Adds OIDC-Based Authentication for GitHub Actions
Vercel has introduced the vercel/vcr-action/login GitHub Action to enable image pushes to Vercel Container Registry (VCR) using OIDC tokens. This eliminates the need for long-lived registry credentials by exchanging workflow OIDC tokens for short-lived Vercel access tokens.
Verified State Diff
Impact & Verification Analysis
Developers using GitHub Actions to build and push container images to Vercel Container Registry.
Improves security posture by removing the risk associated with long-lived credentials and simplifies CI/CD pipeline configuration for containerized deployments.
Full Fact Overview
The new vercel/vcr-action/login action allows developers to authenticate with vcr.vercel.com directly from GitHub Actions workflows. By leveraging GitHub OIDC, the action automatically handles the exchange for a short-lived Vercel access token, which is revoked upon job completion. This integration supports Docker by default, with optional support for Podman or Buildah via engine configuration. Users must configure an OIDC policy on their Vercel team and grant the workflow 'id-token: write' permissions to enable this secure authentication flow.