ci: bump docker/login-action from 3 to 4

[dependabot]

Bumps docker/login-action from 3 to 4.

Release notes

Sourced from docker/login-action's releases.

v4.0.0

• Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @​crazy-max in docker/login-action#929
• Switch to ESM and update config/test wiring by @​crazy-max in docker/login-action#927
• Bump @​actions/core from 1.11.1 to 3.0.0 in docker/login-action#919
• Bump @​aws-sdk/client-ecr from 3.890.0 to 3.1000.0 in docker/login-action#909 docker/login-action#920
• Bump @​aws-sdk/client-ecr-public from 3.890.0 to 3.1000.0 in docker/login-action#909 docker/login-action#920
• Bump @​docker/actions-toolkit from 0.63.0 to 0.77.0 in docker/login-action#910 docker/login-action#928
• Bump @​isaacs/brace-expansion from 5.0.0 to 5.0.1 in docker/login-action#921
• Bump js-yaml from 4.1.0 to 4.1.1 in docker/login-action#901

Full Changelog: docker/login-action@v3.7.0...v4.0.0

v3.7.0

• Add scope input to set scopes for the authentication token by @​crazy-max in docker/login-action#912
• Add support for AWS European Sovereign Cloud ECR by @​dphi in docker/login-action#914
• Ensure passwords are redacted with registry-auth input by @​crazy-max in docker/login-action#911
• build(deps): bump lodash from 4.17.21 to 4.17.23 in docker/login-action#915

Full Changelog: docker/login-action@v3.6.0...v3.7.0

v3.6.0

• Add registry-auth input for raw authentication to registries by @​crazy-max in docker/login-action#887
• Bump @​aws-sdk/client-ecr to 3.890.0 in docker/login-action#882 docker/login-action#890
• Bump @​aws-sdk/client-ecr-public to 3.890.0 in docker/login-action#882 docker/login-action#890
• Bump @​docker/actions-toolkit from 0.62.1 to 0.63.0 in docker/login-action#883
• Bump brace-expansion from 1.1.11 to 1.1.12 in docker/login-action#880
• Bump undici from 5.28.4 to 5.29.0 in docker/login-action#879
• Bump tmp from 0.2.3 to 0.2.4 in docker/login-action#881

Full Changelog: docker/login-action@v3.5.0...v3.6.0

v3.5.0

• Support dual-stack endpoints for AWS ECR by @​Spacefish @​crazy-max in docker/login-action#874 docker/login-action#876
• Bump @​aws-sdk/client-ecr to 3.859.0 in docker/login-action#860 docker/login-action#878
• Bump @​aws-sdk/client-ecr-public to 3.859.0 in docker/login-action#860 docker/login-action#878
• Bump @​docker/actions-toolkit from 0.57.0 to 0.62.1 in docker/login-action#870
• Bump form-data from 2.5.1 to 2.5.5 in docker/login-action#875

Full Changelog: docker/login-action@v3.4.0...v3.5.0

v3.4.0

• Bump @​actions/core from 1.10.1 to 1.11.1 in docker/login-action#791
• Bump @​aws-sdk/client-ecr to 3.766.0 in docker/login-action#789 docker/login-action#856
• Bump @​aws-sdk/client-ecr-public to 3.758.0 in docker/login-action#789 docker/login-action#856
• Bump @​docker/actions-toolkit from 0.35.0 to 0.57.0 in docker/login-action#801 docker/login-action#806 docker/login-action#858
• Bump cross-spawn from 7.0.3 to 7.0.6 in docker/login-action#814
• Bump https-proxy-agent from 7.0.5 to 7.0.6 in docker/login-action#823
• Bump path-to-regexp from 6.2.2 to 6.3.0 in docker/login-action#777

Full Changelog: docker/login-action@v3.3.0...v3.4.0

... (truncated)

Commits

• b45d80f Merge pull request #929 from crazy-max/node24
• 176cb9c node 24 as default runtime
• cad8984 Merge pull request #920 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
• 92cbcb2 chore: update generated content
• 5a2d6a7 build(deps): bump the aws-sdk-dependencies group with 2 updates
• 44512b6 Merge pull request #928 from docker/dependabot/npm_and_yarn/docker/actions-to...
• 28737a5 chore: update generated content
• dac0793 build(deps): bump @​docker/actions-toolkit from 0.76.0 to 0.77.0
• 62029f3 Merge pull request #919 from docker/dependabot/npm_and_yarn/actions/core-3.0.0
• 08c8f06 chore: update generated content
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[claude]

PR Review: ci: bump docker/login-action from 3 to 4

This is a routine Dependabot dependency update — a single-line change in .github/workflows/docker.yml. Overall it looks fine to merge, with one thing worth being aware of.

What's changing

docker/login-action v4 upgrades the action's Node.js runtime from Node 20 to Node 24. The main notable changes in v4:

• Node 24 as default runtime
• Switched internals to ESM
• @actions/core bumped from 1.x → 3.0.0 (internal to the action)
• AWS SDK and @docker/actions-toolkit updates

Notes

Runner version requirement: The Node 24 runtime requires Actions Runner v2.327.1 or later. If the project uses GitHub-hosted runners (which auto-update), this is a non-issue. If using self-hosted runners, verify they are at that version or newer before merging.

Floating tag (@v4) vs SHA pinning: The action is pinned to the mutable @v4 tag rather than a specific commit SHA (e.g., docker/login-action@b45d80f...). This is consistent with the existing pattern in the workflow, so no change is needed here — just noting it as a general GitHub Actions security best practice worth considering in the future.

No functional impact: The change to Node 24 runtime is internal to the action and should have no effect on login behavior or workflow outputs.

Verdict

✅ Safe to merge. Low-risk CI dependency bump with no functional changes expected.

[claude]

PR Review: Bump docker/login-action from 3 to 4

This is a routine Dependabot dependency update with a single-line change. Overall it looks good and safe to merge.

Summary of Change

Upgrades docker/login-action from v3 to v4 in .github/workflows/docker.yml.

Key Changes in v4.0.0

• Node 24 runtime -- requires Actions Runner v2.327.1 or later. GitHub-hosted ubuntu-latest runners should meet this requirement.
• Updated @actions/core from 1.x to 3.0.0 and AWS SDK/toolkit bumps (no functional impact for GHCR usage).
• No breaking changes to the login interface or inputs used here (registry, username, password).

Observations

No issues with the change itself. Two pre-existing notes worth considering:

1. SHA pinning -- The workflow uses floating major-version tags (@v4, @v6, @v7) across all Docker actions. Security best practice for CI is to pin actions to a specific commit SHA (e.g. docker/login-action@b45d80f) to prevent supply-chain attacks. This pattern is pre-existing and not introduced by this PR.

2. actions/checkout@v6 -- This appears to be a very recent version. Worth confirming it is a valid, stable release before relying on it in production workflows.

Verdict

Safe to merge. The update is low-risk, the login action interface is unchanged, and ubuntu-latest runners support Node 24.