Push images to Vercel Container Registry from GitHub Actions

You can now push container images from GitHub Actions to Vercel Container Registry (VCR) without storing long-lived registry credentials.

The new vercel/vcr-action/login action authenticates your workflow using GitHub OIDC. It exchanges the workflow’s OIDC token for a short-lived Vercel access token, then uses that token to log in to vcr.vercel.com. When the job ends, the action logs out and revokes the Vercel token.

To start:

• Create an OIDC policy on your Vercel team that matches the GitHub repository and workflow, and grants read-write access to VCR.
• Store your Vercel team ID as a GitHub repo variable, for example VERCEL_TEAM_ID, along with the team slug, project slug, and repo name used in the image tag.
• Give the workflow or job id-token: write permission.

Then add the login step before you build and push and the image:

The action authenticates Docker by default. Pass engines to use Podman or Buildah instead.

After VCR finishes preparing a linux/amd64 image, you can use it as a custom Vercel Sandbox image. Within the same project, reference it as <repository>:<tag>.

Learn more in the VCR documentation and the GitHub Actions guide.

Read more