{"type":"post","id":"push-images-from-github-actions-to-vercel-container-4c4328","slug":"push-images-from-github-actions-to-vercel-container-4c4328","title":"Push images from GitHub Actions to Vercel Container Registry without stored credentials.","description":"The thesis: Vercel’s new GitHub Actions login action moves VCR publishing from repository-held registry credentials toward policy-scoped, ephemeral workload identity.","retrieval_nugget":"The thesis: Vercel’s new GitHub Actions login action moves VCR publishing from repository-held registry credentials toward policy-scoped, ephemeral workload identity.","published_at":"2026-09-25","updated_at":"2026-09-25","record_date":"2026-09-25","date_kind":"published_at","topics":[],"source_urls":["https://vercel.com/changelog/vcr-login-github-action"],"schema_version":"newruntime-agent-readable-v0.2","stable_id":"post:push-images-from-github-actions-to-vercel-container-4c4328","status":"published","visuals":[],"editorial_provenance":{"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:5cba9cf81c7c1db689b97159e4b74f9a0d130f7160876484a7bf95c784917e4b","reviewed_at":"2026-09-26T00:04:51.216Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":2,"watch_condition_count":2,"related_record_count":0},"analysis":{"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"Vercel’s new GitHub Actions login action moves VCR publishing from repository-held registry credentials toward policy-scoped, ephemeral workload identity.","observed_facts":[{"text":"Vercel says `vercel/vcr-action/login@v1` exchanges a GitHub Actions OIDC token for a short-lived Vercel access token and uses it to authenticate to `vcr.vercel.com`.","source_urls":["https://vercel.com/changelog/vcr-login-github-action"]},{"text":"Vercel says the action logs out and revokes the Vercel token when the GitHub Actions job ends.","source_urls":["https://vercel.com/changelog/vcr-login-github-action"]},{"text":"Vercel requires an OIDC policy matching the GitHub repository and workflow, plus `id-token: write` permission and VCR read-write access.","source_urls":["https://vercel.com/changelog/vcr-login-github-action"]}],"mechanism":"The mechanism is an OIDC policy on the Vercel team that matches a GitHub repository and workflow, coupled with `id-token: write` permission in the workflow or job.","why_now":"Why now: container publishing is increasingly part of ordinary application delivery, while stored CI registry credentials remain a recurring operational and security burden.","implications":["The implications: teams can reduce the number of durable registry secrets present in GitHub repositories.","The release makes VCR a more direct fit for CI pipelines that already use GitHub OIDC-based federation."],"evidence_boundary":"The evidence boundary: Vercel’s changelog documents the intended authentication flow and configuration requirements, but does not provide independent adoption, reliability, or security-outcome data.","watch_conditions":["Watch conditions: whether the policy controls offer sufficient granularity for branches, environments, and reusable workflows in production organizations.","Whether Vercel extends the same short-lived authentication model to additional CI systems or registry operations."],"related_records":[],"new_branch_reason":"This starts a distinct analytical record because no prior New Runtime record was supplied, and the release specifically concerns credentialless VCR publishing from GitHub Actions."},"editor":{"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"routes":{"html":"https://newruntime.com/posts/push-images-from-github-actions-to-vercel-container-4c4328/","markdown":"https://newruntime.com/posts/push-images-from-github-actions-to-vercel-container-4c4328.md","json":"https://newruntime.com/posts/push-images-from-github-actions-to-vercel-container-4c4328.json"},"next_reads":[{"type":"collection","path":"/posts/","url":"https://newruntime.com/posts/","title":"Field Notes","reason":"Open the latest editorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/posts.json"},{"type":"collection","path":"/source-ledger.json","url":"https://newruntime.com/source-ledger.json","title":"Source Ledger","reason":"Inspect the public source evidence graph.","media_type":"application/json"}]}