ci: replace registry container action reference

[quentin-laplanche-docker]

Summary

• replace the unsupported uses: docker://docker reference with a local docker-pull container action
• pin the Docker CLI base image by digest in the local action's Dockerfile
• preserve the existing integration coverage for credentials used from a GitHub Actions container action

Why

Organization action allowlists do not support container actions referenced with docker:// notation.

The initial approach used a manual docker run, but that was not equivalent: it bypassed GitHub Runner's container-action handling and manually supplied the socket and Docker configuration mounts.

This revision instead invokes a narrowly scoped local action:

uses: ./.github/actions/docker-pull

The local action declares runs.using: docker, so GitHub Runner still builds and executes a real container action with its standard Docker socket, temporary home, workspace, and environment mounts. This retains the behavior the test is intended to cover while allowing the organization action allowlist to be enforced.

Validation

• actionlint .github/workflows/ci.yml
• docker build -t login-action-docker-pull-test .github/actions/docker-pull
• docker run --rm login-action-docker-pull-test --version
• git diff --check
• verified no uses: docker:// references remain

[crazy-max]

I don't think we can replace this with docker run without losing the test coverage this job was added for.

This step is intentionally using a docker://... container action to verify that credentials written by docker/login-action are usable from an action container. A shell step that runs docker run with hand-written socket and config mounts tests a different integration path: our own manual container invocation, not GitHub Actions' container-action behavior.

The allowlist issue is real, but this PR removes the only coverage for the failing case instead of fixing support for it. If org allowlisting cannot support docker:// actions, we should either keep this workflow exempted, move this check somewhere enforcement does not apply, or replace it with another test that still exercises a real GitHub container action. A manual docker run is not an equivalent replacement.

[quentin-laplanche-docker]

Good point—the manual docker run was not equivalent because it bypassed GitHub Runner’s container-action handling and therefore reduced the intended test coverage.

I’ve updated the PR to use a local Docker container action instead:

uses: ./.github/actions/docker-cli

The local action uses runs.using: docker, with the Docker CLI image pinned by digest in its Dockerfile. This means GitHub Runner still builds and executes a real container action with its standard Docker socket, temporary home, workspace, and environment mounts.

This preserves the integration path the test was designed to cover while removing the unsupported uses: docker://... reference so the organization action allowlist can be enforced.

Could you take another look?