chore(deps): update docker/login-action action to v4.6.0

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
docker/login-action	action	minor	v4.4.0 → v4.6.0
docker/login-action	action	major	v3.7.0 → v4.6.0

---

Release Notes

docker/login-action (docker/login-action)

v4.6.0

Compare Source

• Harden buildx scoped config path handling by @​crazy-max in #​1059
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1095.0 in #​1051
• Bump js-yaml from 5.2.1 to 5.2.2 in #​1057
• Bump postcss from 8.5.10 to 8.5.22 in #​1056

Full Changelog: docker/login-action@v4.5.2...v4.6.0

v4.5.2

Compare Source

• Surface Docker Hub OIDC error responses by @​crazy-max in #​1058

Full Changelog: docker/login-action@v4.5.1...v4.5.2

v4.5.1

Compare Source

• Support dhi.io as Docker Hub OIDC registry by @​crazy-max in #​1054

Full Changelog: docker/login-action@v4.5.0...v4.5.1

v4.5.0

Compare Source

• Docker Hub OIDC login support by @​crazy-max in #​1048
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1091.0 in #​1037
• Bump @​docker/actions-toolkit from 0.92.0 to 0.94.0 in #​1044 #​1050
• Bump brace-expansion from 1.1.13 to 1.1.16 in #​1046
• Bump js-yaml from 5.2.0 to 5.2.1 in #​1038

Full Changelog: docker/login-action@v4.4.0...v4.5.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c96820f2-ed00-4958-aa17-bf476ffeea65

📥 Commits

Reviewing files that changed from the base of the PR and between 07df2d9 and 832281d.

📒 Files selected for processing (3)

• .github/actions/build-single-image/action.yml
• .github/workflows/release-clis-to-ghcr.yml
• .github/workflows/workflow-call-publish-staged-manifests.yml

Included review availability: Your plan provides up to 12 included reviews per hour; 5 remain after this review.

---

Walkthrough

The change updates GHCR authentication references to docker/login-action v4.6.0 in one reusable action and two release workflows.

Changes

GHCR authentication updates

Layer / File(s)	Summary
Update GHCR login action references .github/actions/build-single-image/action.yml, .github/workflows/release-clis-to-ghcr.yml, .github/workflows/workflow-call-publish-staged-manifests.yml	The image build action and release workflows now use docker/login-action v4.6.0.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to 83228

GHCR build and release authentication now uses docker/login-action v4.6.0. The update is consistently applied across the affected workflows and is ready to merge.

Suggested reviewers: xynnn007

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: updating docker/login-action to v4.6.0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS. The pull request changes only three GitHub Actions workflow files. The complete diff contains only three docker/login-action reference updates. It adds no Ginkgo test declarations or test titl…
Test Structure And Quality	✅ Passed	PASS: The pull request changes only three GitHub Actions/workflow references from older docker/login-action versions to v4.6.0. The diff contains no Ginkgo tests, Go files, or test-related changes…
Microshift Test Compatibility	✅ Passed	PASS: The pull-request commit changes only three GitHub Actions login-action references from older versions to the pinned v4.6.0 commit. It adds no Ginkgo declarations, test files, OpenShift API refer…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request changes only three GitHub Actions/workflow YAML files. The exact HEAD diff contains no new or modified Ginkgo e2e tests, so the SNO compatibility check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request changes only three GitHub Actions/workflow references for docker/login-action versions. The parent-to-HEAD diff contains no deployment manifests, operator code, controllers, o…
Ote Binary Stdout Contract	✅ Passed	PASS. The PR changes only three GitHub workflow/composite-action YAML references for docker/login-action. The diff adds no OTE binary code or process-level stdout writes, and no changed lines match …
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request changes only three GitHub Actions/workflow files and updates docker/login-action references. The diff adds no Ginkgo tests, IPv4 assumptions, or test connectivity to external …
No-Weak-Crypto	✅ Passed	The pull request changes only three docker/login-action version pins. The changed lines add no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret/token comparison. The exact v4.6.0 action …
Container-Privileges	✅ Passed	PASS: The pull request changes only three docker/login-action references. The exact diff adds no privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN capability, `allowPrivilegeEscal…
No-Sensitive-Data-In-Logs	✅ Passed	PASS. The pull request changes only three pinned docker/login-action references. It adds no workflow logging. All changed uses authenticate to ghcr.io with secret-backed passwords. The pinned v4.6…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

Full details: Stable And Deterministic Test Names

Explanation

PASS. The pull request changes only three GitHub Actions workflow files. The complete diff contains only three docker/login-action reference updates. It adds no Ginkgo test declarations or test titles, so it introduces no unstable or overly specific test name.

Full details: Test Structure And Quality

Explanation

PASS: The pull request changes only three GitHub Actions/workflow references from older docker/login-action versions to v4.6.0. The diff contains no Ginkgo tests, Go files, or test-related changes. Therefore, the listed Ginkgo test quality requirements are not applicable.

Full details: Microshift Test Compatibility

Explanation

PASS: The pull-request commit changes only three GitHub Actions login-action references from older versions to the pinned v4.6.0 commit. It adds no Ginkgo declarations, test files, OpenShift API references, or MicroShift assumptions. Therefore, the MicroShift test compatibility check is not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The pull request changes only three GitHub Actions/workflow references for docker/login-action versions. The parent-to-HEAD diff contains no deployment manifests, operator code, controllers, or scheduling settings such as affinity, topology spread, replica counts, node selectors, tolerations, or PDBs. The topology-aware scheduling check is therefore not applicable.

Full details: Ote Binary Stdout Contract

Explanation

PASS. The PR changes only three GitHub workflow/composite-action YAML references for docker/login-action. The diff adds no OTE binary code or process-level stdout writes, and no changed lines match the listed violation patterns. The custom check is therefore not applicable.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The pull request changes only three GitHub Actions/workflow files and updates docker/login-action references. The diff adds no Ginkgo tests, IPv4 assumptions, or test connectivity to external services. The custom check is therefore not applicable.

Full details: No-Weak-Crypto

Explanation

The pull request changes only three docker/login-action version pins. The changed lines add no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret/token comparison. The exact v4.6.0 action bundle has the same MD5/SHA1 dependency usages as the existing v4.4.0 bundle, while the v3.7.0 bundle already contained more such usages. The action source uses standard Docker login and token handling without weak-crypto code or non-constant-time secret/token comparison.

Full details: Container-Privileges

Explanation

PASS: The pull request changes only three docker/login-action references. The exact diff adds no privileged: true, hostPID, hostNetwork, hostIPC, SYS_ADMIN capability, allowPrivilegeEscalation: true, or root-user setting. The affected files are GitHub Actions workflows and a composite action, not container or Kubernetes manifests.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS. The pull request changes only three pinned docker/login-action references. It adds no workflow logging. All changed uses authenticate to ghcr.io with secret-backed passwords. The pinned v4.6.0 entrypoint passes the password through --password-stdin with silent execution, logs only registry/status messages, and masks generated tokens with setSecret. Its new Docker Hub OIDC path is not activated for these GHCR uses.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/mintmaker/main/docker-login-action-4.x

---

_{Comment @coderabbitai help to get the list of available commands.}