ci(tests): fix OCIR registry login in Release E2E workflow - #2973

🏁 Script executed:

# First, examine the file to confirm line 46 content
cat -n .github/workflows/release-e2e.yaml | sed -n '40,55p'

Repository: cozystack/cozystack

Length of output: 627

🏁 Script executed:

# Check if there are other workflows to see the pattern consistency
fd -e yaml .github/workflows/ -x grep -l "docker/login-action" {}

Repository: cozystack/cozystack

Length of output: 441

🏁 Script executed:

# Look for any pinning policy or security documentation
fd -e md -e txt . | xargs grep -l "pin\|commit.*sha\|docker/login" 2>/dev/null | head -20

Repository: cozystack/cozystack

Length of output: 579

🌐 Web query:

docker/login-action v3 mutable tag vs commit sha pinning security best practices

💡 Result:

The use of immutable commit SHA pinning for GitHub Actions, including docker/login-action, is widely considered the industry security best practice to prevent supply chain attacks [1][2][3]. Security Best Practices: 1. Use Immutable Commit SHAs: Unlike version tags (e.g., v3), which are mutable and can be retargeted by maintainers or attackers to point to malicious code, full 40-character commit SHAs are content-addressable and immutable [1][2][4]. Pinning to a specific SHA ensures your workflow executes the exact code you have reviewed and verified [5][4]. 2. Mitigating Tag Retargeting: If an attacker compromises a repository or an account with push access, they can update existing tags to point to compromised commits [6][7]. SHA pinning renders this attack vector ineffective because the workflow will continue to reference the original, verified commit hash [1][5]. 3. Organizational Policy Enforcement: Many organizations now enforce SHA pinning at the policy level [3][4]. GitHub allows administrators to mandate full commit SHA pinning for all actions; when enabled, workflows using tags will fail execution [2][3][4]. 4. Maintenance Strategy: To balance security with the need for updates, teams commonly use automated dependency management tools like Dependabot or Renovate [1][7][5]. These tools can be configured to automatically create pull requests that update SHAs, while preserving the human-readable version tag (e.g., v3) in a code comment [5][4]. This allows for easy tracking and controlled adoption of new versions [1][7]. Implementation Example: When pinning, use the full 40-character SHA and include a comment with the original version for readability [1][5]. - uses: docker/login-action@f4b8f3e # v3.3.0 While tags are more convenient and widely used, they should only be used if you fully trust the creator and are aware of the risks associated with mutability [2]. For enterprise or production-grade CI/CD pipelines, SHA pinning is the standard requirement [2][3][4].

Citations:

• 1: https://docs.ozarksecuritylabs.com/supply-chain/tier-1-baseline/sha-pin-actions/
• 2: https://docs.github.com/en/actions/reference/security/secure-use
• 3: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
• 4: https://www.romainlespinasse.dev/posts/github-actions-commit-sha-pinning/
• 5: https://safeguard.sh/resources/blog/github-actions-pinning-sha-vs-tag
• 6: Krunixbase/agent-ai-lab@690a52c
• 7: https://emmer.dev/blog/pin-your-github-actions-to-protect-against-mutability/

🏁 Script executed:

# Find all workflow files and check for unpinned docker/login-action uses
fd --full-path '.github/workflows' -type f -name '*.yaml' -o -name '*.yml' | xargs grep -n "docker/login-action" 2>/dev/null

Repository: cozystack/cozystack

Length of output: 236

🌐 Web query:

docker/login-action v3 latest commit sha

💡 Result:

docker/login-action@v3 latest commit SHA (i.e., the current HEAD of the v3 branch as of 2026-06-22): 06895751d15a223ec091bea144ad5c7f50d228d0 [1]. Notes: GitHub actions “めら (@V3)” points to the moving tag/branch for major version v3; the commit SHA shown for the v3 tree is 06895751d15a223ec091bea144ad5c7f50d228d0. [1]

Citations:

• 1: https://github.com/docker/login-action/tree/06895751d15a223ec091bea144ad5c7f50d228d0

🏁 Script executed:

# Correct fd syntax to find all yaml files in .github/workflows
fd . '.github/workflows' -type f \( -name '*.yaml' -o -name '*.yml' \)

Repository: cozystack/cozystack

Length of output: 234

🏁 Script executed:

# Then check them for docker/login-action and other action uses
find .github/workflows -type f \( -name '*.yaml' -o -name '*.yml' \) -exec grep -n "uses:" {} + | head -30

Repository: cozystack/cozystack

Length of output: 2582

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.