---
type: "post"
id: "push-images-from-github-actions-to-vercel-container-4c4328"
slug: "push-images-from-github-actions-to-vercel-container-4c4328"
title: "Push images from GitHub Actions to Vercel Container Registry without stored credentials."
description: "The thesis: Vercel’s new GitHub Actions login action moves VCR publishing from repository-held registry credentials toward policy-scoped, ephemeral workload identity."
retrieval_nugget: "The thesis: Vercel’s new GitHub Actions login action moves VCR publishing from repository-held registry credentials toward policy-scoped, ephemeral workload identity."
published_at: "2026-09-25"
updated_at: "2026-09-25"
record_date: "2026-09-25"
date_kind: "published_at"
topics: []
source_urls: ["https://vercel.com/changelog/vcr-login-github-action"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:push-images-from-github-actions-to-vercel-container-4c4328"
status: "published"
visuals: []
editorial_provenance: {"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:5cba9cf81c7c1db689b97159e4b74f9a0d130f7160876484a7bf95c784917e4b","reviewed_at":"2026-09-26T00:04:51.216Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":2,"watch_condition_count":2,"related_record_count":0}
analysis: {"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"Vercel’s new GitHub Actions login action moves VCR publishing from repository-held registry credentials toward policy-scoped, ephemeral workload identity.","observed_facts":[{"text":"Vercel says `vercel/vcr-action/login@v1` exchanges a GitHub Actions OIDC token for a short-lived Vercel access token and uses it to authenticate to `vcr.vercel.com`.","source_urls":["https://vercel.com/changelog/vcr-login-github-action"]},{"text":"Vercel says the action logs out and revokes the Vercel token when the GitHub Actions job ends.","source_urls":["https://vercel.com/changelog/vcr-login-github-action"]},{"text":"Vercel requires an OIDC policy matching the GitHub repository and workflow, plus `id-token: write` permission and VCR read-write access.","source_urls":["https://vercel.com/changelog/vcr-login-github-action"]}],"mechanism":"The mechanism is an OIDC policy on the Vercel team that matches a GitHub repository and workflow, coupled with `id-token: write` permission in the workflow or job.","why_now":"Why now: container publishing is increasingly part of ordinary application delivery, while stored CI registry credentials remain a recurring operational and security burden.","implications":["The implications: teams can reduce the number of durable registry secrets present in GitHub repositories.","The release makes VCR a more direct fit for CI pipelines that already use GitHub OIDC-based federation."],"evidence_boundary":"The evidence boundary: Vercel’s changelog documents the intended authentication flow and configuration requirements, but does not provide independent adoption, reliability, or security-outcome data.","watch_conditions":["Watch conditions: whether the policy controls offer sufficient granularity for branches, environments, and reusable workflows in production organizations.","Whether Vercel extends the same short-lived authentication model to additional CI systems or registry operations."],"related_records":[],"new_branch_reason":"This starts a distinct analytical record because no prior New Runtime record was supplied, and the release specifically concerns credentialless VCR publishing from GitHub Actions."}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/push-images-from-github-actions-to-vercel-container-4c4328/","markdown":"https://newruntime.com/posts/push-images-from-github-actions-to-vercel-container-4c4328.md","json":"https://newruntime.com/posts/push-images-from-github-actions-to-vercel-container-4c4328.json"}
---

# Push images from GitHub Actions to Vercel Container Registry without stored credentials.

## Retrieval answer

The thesis: Vercel’s new GitHub Actions login action moves VCR publishing from repository-held registry credentials toward policy-scoped, ephemeral workload identity.

The thesis: Vercel’s new GitHub Actions login action moves VCR publishing from repository-held registry credentials toward policy-scoped, ephemeral workload identity.

Observed facts: Vercel says `vercel/vcr-action/login@v1` exchanges a GitHub Actions OIDC token for a short-lived Vercel access token and uses it to authenticate to `vcr.vercel.com`. Vercel also says the action logs out and revokes that Vercel token when the job ends. The mechanism is an OIDC policy on the Vercel team that matches a GitHub repository and workflow, coupled with `id-token: write` permission in the workflow or job.

Why now: container publishing is increasingly part of ordinary application delivery, while stored CI registry credentials remain a recurring operational and security burden. The implications: teams can reduce the number of durable registry secrets present in GitHub repositories. The evidence boundary: Vercel’s changelog documents the intended authentication flow and configuration requirements, but does not provide independent adoption, reliability, or security-outcome data. Watch conditions: whether the policy controls offer sufficient granularity for branches, environments, and reusable workflows in production organizations. This starts a distinct analytical record because no prior New Runtime record was supplied, and the release specifically concerns credentialless VCR publishing from GitHub Actions.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)