build(deps): Bump docker/login-action from 4.4.0 to 4.5.1

[dependabot]

Bumps docker/login-action from 4.4.0 to 4.5.1.

Release notes

Sourced from docker/login-action's releases.

v4.5.1

• Support dhi.io as Docker Hub OIDC registry by @​crazy-max in docker/login-action#1054

Full Changelog: docker/login-action@v4.5.0...v4.5.1

v4.5.0

• Docker Hub OIDC login support by @​crazy-max in docker/login-action#1048
• Bump @​aws-sdk/client-ecr and @​aws-sdk/client-ecr-public to 3.1091.0 in docker/login-action#1037
• Bump @​docker/actions-toolkit from 0.92.0 to 0.94.0 in docker/login-action#1044 docker/login-action#1050
• Bump brace-expansion from 1.1.13 to 1.1.16 in docker/login-action#1046
• Bump js-yaml from 5.2.0 to 5.2.1 in docker/login-action#1038

Full Changelog: docker/login-action@v4.4.0...v4.5.0

Commits

• abd2ef4 Merge pull request #1055 from crazy-max/test-registry-auth-oidc
• d49d3a9 Merge pull request #1054 from crazy-max/oidc-missing-dhi
• b58b17c test: cover Docker Hub OIDC with registry-auth
• be646c2 chore: update generated content
• d77c059 support dhi.io as Docker Hub OIDC registry
• 06fb636 Merge pull request #1037 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
• a8bc953 [dependabot skip] chore: update generated content
• f54b901 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
• 77f18f6 Merge pull request #1049 from docker/dependabot/github_actions/codeql-actions...
• ec0bf28 Merge pull request #1050 from docker/dependabot/npm_and_yarn/docker/actions-t...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[hermes-exosphere]

Automated code review started - full review. Results will be posted here.

[hermes-exosphere]

🔍 Automated Code Review — PR #603

📋 Executive Summary

Dependabot bumps docker/login-action from v4.4.0 to v4.5.1 in .github/workflows/build-image.yml. This is a trivial, single-line, pinned-SHA GitHub Actions dependency bump. The new commit SHA has been verified against the upstream tag. All CI checks (10/10) pass green.

---

📊 Change Architecture

graph TD
    A[".github/workflows/build-image.yml"] -->|"docker/login-action v4.4.0 → v4.5.1"| B["GHCR Login Step"]
    B --> C["build-image workflow"]
    C --> D["hook-sync container build & push"]
    style A fill:#87CEEB
    style B fill:#90EE90

Loading

Legend: 🟢 New/Updated | 🔵 Modified

---

🔴 Breaking Changes

✅ No breaking changes detected. This is a patch-level dependency bump of a GitHub Action. The input interface (registry, username, password) is unchanged. The v4.5.1 release adds dhi.io as a Docker Hub OIDC registry — no effect on GHCR logins.

---

⚠️ Issues Found

✅ No issues found.

---

🔬 Logical / Bug Analysis

• SHA verification: The new pinned SHA abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 was verified against the upstream docker/login-action repo tag v4.5.1 — match confirmed.
• Previous SHA verification: af1e73f918a031802d376d3c8bbc3fe56130a9b0 confirmed against tag v4.4.0.
• No interface changes: The with: block (registry, username, password) is unchanged — no risk of misconfiguration.
• No new permissions required: The action does not request additional permissions.
• Changelog review: v4.5.0 added Docker Hub OIDC support and bumped internal AWS SDK dependencies. v4.5.1 added dhi.io OIDC registry support. None affect this workflow's GHCR login usage.

---

🧪 Evidence — Build & Test Results

CI Status (10/10 passing)

OSV-Scanner                        pass  24s
Socket Security: Project Report    pass  4s
Socket Security: Pull Request Alerts pass 25s
build                              pass  56s
docs                               pass  1m27s
quality                            pass  1m4s
test (default)                     pass  1m14s
test (hook-log-file, 1)            pass  1m14s
test (log-debug, debug)            pass  1m14s
test-e2e                           pass  51s

SHA Verification

$ gh api repos/docker/login-action/git/ref/tags/v4.5.1 --jq '.object.sha'
abd2ef45e78c5afb21d64d4ca52ee8550d9572c7  ← matches PR line 50

$ gh api repos/docker/login-action/git/ref/tags/v4.4.0 --jq '.object.sha'
af1e73f918a031802d376d3c8bbc3fe56130a9b0  ← matches the replaced line

---

🔗 Issue Linkage

⚠️ No issue linked. This is a standard Dependabot dependency bump and does not require a separate issue.

---

👥 Human Review Feedback

No human review comments exist on this PR. One bot comment from hermes-exosphere (prior review initiation) — no blocking feedback.

---

💡 Suggestions

None — this is a clean, single-line version bump with pinned commit SHA. Standard dependabot best practice.

---

🏆 Verdict

VERDICT: APPROVED

---

Automated code review · 2026-07-28 UTC

[hermes-exosphere]

Automated review: Approved. Dependabot bump docker/login-action v4.4.0 -> v4.5.1. SHA verified against upstream tag. CI all green (10/10). No breaking changes. Clean.

[hermes-exosphere]

Automated review: Approved. ✅