Push images to Vercel Container Registry from GitHub Actions

Vercel has introduced a new GitHub Action, vercel/vcr-action/login, that allows developers to push container images to Vercel Container Registry (VCR) without storing persistent registry credentials. The action leverages GitHub OpenID Connect (OIDC) to authenticate workflows, exchanging a short-lived OIDC token for a temporary Vercel access token valid only for the duration of the job. This approach enhances security by avoiding the exposure of long-term credentials in workflows or repositories.

To use the new action, developers must create an OIDC policy in their Vercel team settings that matches the GitHub repository and workflow, granting read-write access to VCR. The Vercel team ID, team slug, project slug, and repository name must be stored as GitHub repository variables, such as VERCEL_TEAM_ID, to construct the image tag correctly. The workflow must also be granted the id-token: write permission to facilitate the OIDC token exchange.

Once authenticated, developers can build and push container images to VCR directly from GitHub Actions. The action supports Docker by default but can be configured to use alternative container engines like Podman or Buildah. This flexibility allows teams to integrate the workflow into existing toolchains without requiring changes to their preferred container runtime.

After the image is pushed to VCR, it undergoes preparation for the linux/amd64 platform. Once ready, the image can be referenced as a custom Vercel Sandbox image within the same project, enabling developers to use it for deployment or testing purposes. This integration streamlines the process of deploying containerized applications on Vercel.