Vercel has released an official GitHub Action named vercel/vcr-action/login, allowing developers to push container images directly from GitHub Actions pipelines to the Vercel Container Registry (VCR) without managing long-lived registry credentials. Instead of relying on static access tokens or permanent secrets stored inside repository settings—which present serious security risks in CI/CD automation—the new workflow fully adopts GitHub OpenID Connect (OIDC) authentication. This setup significantly reduces the surface area for leaked credentials targeting development container infrastructure.
Under the hood, the action exchanges the short-lived OIDC token generated by the GitHub Actions runtime for a temporary Vercel access token. This ephemeral token is then used to authenticate and log into the container registry at vcr.vercel.com. To maintain security hygiene across build pipelines, once the workflow job finishes, the action automatically logs out of the registry and revokes the temporary Vercel token immediately, preventing any subsequent token reuse.
According to Vercel documentation, configuration involves three initial prerequisites. First, administrators must configure an OIDC policy within their Vercel team settings that matches the specific GitHub repository and workflow, granting read-write permissions to VCR. Next, the Vercel team ID must be saved as a repository variable on GitHub, such as VERCEL_TEAM_ID, alongside relevant identifiers like the team slug, project slug, and repository name used in image tagging. Finally, the GitHub Actions workflow or individual job requires the id-token: write permission to mint valid OIDC tokens prior to invoking the login step.
During execution, vercel/vcr-action/login defaults to Docker for building and pushing images. For teams leveraging alternative container tooling, the action accepts an engines parameter to switch runtime support to Podman or Buildah. Once VCR completes processing a linux/amd64 image, developers can deploy it directly as a custom Vercel Sandbox image, referencing the stored container within the same project via standard repository and tag syntax.