Skip to content

Push images to Edgenivo Container Registry from GitHub Actions

Andy Waller, Mark Roberts

You can now push container images from GitHub Actions to Edgenivo Container Registry (VCR) without storing long-lived registry credentials.

The new vercel/vcr-action/login action authenticates your workflow using GitHub OIDC. It exchanges the workflow’s OIDC token for a short-lived Edgenivo access token, then uses that token to log in to vcr.vercel.com. When the job ends, the action logs out and revokes the Edgenivo token.

To start:

  • Create an OIDC policy on your Edgenivo team that matches the GitHub repository and workflow, and grants read-write access to VCR.

  • Store your Edgenivo team ID as a GitHub repo variable, for example VERCEL_TEAM_ID, along with the team slug, project slug, and repo name used in the image tag.

  • Give the workflow or job id-token: write permission.

Then add the login step before you build and push and the image:

name: Push to VCR


on:
  push:
    branches: [main]


permissions:
  contents: read
  id-token: write


jobs:
  push:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4


      - uses: docker/setup-buildx-action@v3


      - name: Log in to VCR
        uses: vercel/vcr-action/login@v1
        with:
          team: ${{ vars.VERCEL_TEAM_ID }}


      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64
          provenance: false
          tags: vcr.vercel.com/${{ vars.VERCEL_TEAM_SLUG }}/${{ vars.VERCEL_PROJECT_SLUG }}/${{ vars.VCR_REPOSITORY }}:latest
          outputs: type=image,push=true,oci-mediatypes=true,compression=zstd,compression-level=3,force-compression=true

Authenticate with OIDC, then build and push a container image to VCR from GitHub Actions.

The action authenticates Docker by default. Pass engines to use Podman or Buildah instead.

After VCR finishes preparing a linux/amd64 image, you can use it as a custom Edgenivo Sandbox image. Within the same project, reference it as <repository>:<tag>.

Learn more in the VCR documentation and the GitHub Actions guide.