Docker has switched on OpenID Connect authentication between GitHub Actions and Docker Hub, letting a workflow exchange a signed per-run identity token for a short-lived Docker credential instead of reading a Personal Access Token out of a repo secret. Per the Docker blog, the feature is available to organizations on Docker Team, Docker Business and Docker Hardened Images plans. For platform teams, this pulls the registry credential out of the "rotate every 90 days and hope" pile and into the same federated-identity pattern already used for AWS, GCP, Azure and HashiCorp Vault.
The mechanics, briefly
The pattern is the standard Actions OIDC exchange. When a workflow declares permissions: id-token: write, GitHub mints a signed JWT for the run that encodes the repository, branch or environment, workflow name and a few other claims. The workflow presents that JWT to Docker, Docker validates the signature against GitHub's public keys, checks the claims against a trust policy configured on the Docker side, and returns a short-lived credential the run uses for the rest of its steps. When the job ends, the credential expires. There is no long-lived Docker token in the repo, in an environment secret, or in an Actions cache. Docker positions the change as eliminating stored credentials in CI/CD pipelines, which is fair as long as you actually delete the PAT afterwards.
