Vercel Container Registry Adds GitHub OIDC Login Action for Credential-Free Image Pushes

Vercel has introduced a new GitHub Actions step, vercel/vcr-action/login, that allows developers to push container images to Vercel Container Registry (VCR) without managing long-lived credentials. The action leverages GitHub OIDC to authenticate workflows, exchanging the workflow’s OIDC token for a short-lived Vercel access token to log in to vcr.vercel.com. Once the job completes, the action automatically logs out and revokes the token.

Setup Requirements

To use the new authentication flow, teams must configure their environment with specific permissions and variables:

• Create an OIDC policy on the Vercel team that matches the GitHub repository and workflow, granting read-write access to VCR.
• Store the Vercel team ID as a GitHub repo variable (e.g., VERCEL_TEAM_ID), along with the team slug, project slug, and repo name for image tagging.
• Grant the workflow or job id-token: write permission.

Engine Support and Sandbox Integration

The action defaults to authenticating Docker, but users can pass the engines parameter to use Podman or Buildah instead. Once VCR prepares a linux/amd64 image, it can be referenced as a custom Vercel Sandbox image within the same project using the format <repository>:<tag>.