[sjmiller609]

Summary

• Add one small shared SSM credential action for CI and Ansible. It masks values, rejects invalid/unsecured parameter data, and does not replace caller AWS credentials.
• Switch public image publication/e2e pulls from GitHub secrets to SSM through the existing browser-image role.
• Run credential-bearing builds on trusted branch pushes/dispatches, not public PR merge refs. Same-repository branches get the full build/e2e path; fork PRs remain credential-free with unit tests.

Prerequisites

The SSM read permissions must deploy and the production SecureString /kernel/dockerhub/credentials must be populated first. Other consumers pin the shared action commit from this PR.

Validation

• Workflow lint passed
• Synthetic helper checks: successful delivery/masking, empty/multiline credential rejection, and rejection of non-SecureString parameters
• No new test framework or runtime image changes

Live SSM reads, image builds, and e2e tests were not run locally.

---

Note

Medium Risk
Changes how registry credentials are sourced and which CI events can reach AWS/Docker Hub; misconfigured SSM or workflow guards could block builds or widen credential exposure.

Overview
Adds a shared composite action dockerhub-credentials that loads username/password from SSM (/kernel/dockerhub/credentials), masks them in logs, validates SecureString JSON shape, and optionally assumes an IAM role without clobbering the caller’s existing AWS session env.

Chromium image and server e2e workflows now log into Docker Hub via that action (using github-actions-kernel-images) instead of vars.DOCKERHUB_* / secrets.DOCKERHUB_TOKEN, with id-token: write where OIDC is needed. Credential-bearing image builds are gated to trusted non–pull_request runs on kernel/kernel-images (replacing the fork-PR skip based on head repo). server-test also runs on push to all branches, not only main.

^{Reviewed by Cursor Bugbot for commit 230a381. Bugbot is set up for automated code reviews on this repo. Configure here.}