Observed facts: Vercel says vercel/vcr-action/login@v1 exchanges a GitHub Actions OIDC token for a short-lived Vercel access token and uses it to authenticate to vcr.vercel.com. Vercel also says the action logs out and revokes that Vercel token when the job ends. The mechanism is an OIDC policy on the Vercel team that matches a GitHub repository and workflow, coupled with id-token: write permission in the workflow or job.
Why now: container publishing is increasingly part of ordinary application delivery, while stored CI registry credentials remain a recurring operational and security burden. The implications: teams can reduce the number of durable registry secrets present in GitHub repositories. The evidence boundary: Vercel’s changelog documents the intended authentication flow and configuration requirements, but does not provide independent adoption, reliability, or security-outcome data. Watch conditions: whether the policy controls offer sufficient granularity for branches, environments, and reusable workflows in production organizations. This starts a distinct analytical record because no prior New Runtime record was supplied, and the release specifically concerns credentialless VCR publishing from GitHub Actions.