Documentation request: clarify why use this action about docker-login HOT 1 CLOSED

When you use the above command, the secrets are exposed through the commandline for the process. So if your runner is compromised, your docker credentials are compromised.

The major use of this action is to avoid the above security issue.

We avoid it by creating the file which the same command eventually generates without logging your secrets anywhere; we create that file in a temp directory instead of the home of the runner. This triggers a clean up as soon as the workflow context ends.

The alternative for this action is using the command like this cat ~/my_password.txt | docker login --username foo --password-stdin also additionally cleaning up the my_password.txt file after your workflow is done.

from docker-login.