Repository navigation
Conversation
✅ Deploy Preview for docsdocker ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
7bb8506 to
6902318
Compare
6902318 to
7b241e7
Compare
craig-osterhout
left a comment
craig-osterhout
left a comment
There was a problem hiding this comment.
Thanks @brianru.
For the additions to the DHI manual, one suggestion about content location/framing, and the rest lgtm.
| > | ||
| > Run `docker login dhi.io` to authenticate. | ||
|
|
||
| ## Authenticate with OIDC in GitHub Actions |
There was a problem hiding this comment.
This section seems misplaced because most of its content and framing focuses on OIDC authentication. As written, I suggest moving it to use.md under Use a DHI in CI/CD pipelines.
If you want to keep it in verify.md, consider reframing it as Verify DHI attestations with OIDC, and open with a small intro about verification while treating OIDC as the authentication method. Then, add an actual attestation verification command to the workflow.
There was a problem hiding this comment.
Agreed. Moved the OIDC section into use.md under “Use a DHI in CI/CD pipelines,” retained a short authentication link in verify.md, and updated the customization and OIDC setup references. The workflow remains focused on authentication and attestation discovery. Addressed in 8d809d4.
Description
Document how to use Docker-issued OIDC access tokens for DHI image and attestation reads, and explain the destination-repository permissions required for customization reads and changes.
The GitHub Actions example reads a mirrored Docker Hub image and its private Scout attestations. Separate instructions cover free images served through
dhi.io. The permissions reference explains additive grants, pull-only public access, and the distinction between registry push and customization permissions.Compatibility limitations are documented once in the permissions reference, rather than repeated throughout the tutorials. This section identifies authenticated free-DHI access and names the Scout GraphQL operations that remain available independently of image grants:
listEnabledRepos,listBlockedRepos, andingestImagePackages. It explains their organization boundary and distinguishes those operations from repository-filtered queries, customization changes, and registry push.This replaces the closed draft #26306. The corrected Packit, Jynx, Regirock policy, and dhi-proxy releases have been deployed to production. Rollout health and ordinary traffic were verified; the full production OIDC smoke remains unverified.
Related issues or tickets
DXT-1716, previous draft #26306, Packit #1565, Jynx #1616, rego-policy #174, and dhi-proxy #131.
Reviews
Rebased onto main at
f90928eb2040c4638e188868a612fd47e6a061a4; range-diff confirms all four patches are unchanged. Scoped rumdl and Vale 3.17.0 checks pass across all five changed Markdown files, with no new warnings. Existing warnings and one suggestion are outside changed lines.git diff --checkpasses. No full Hugo build was run; preview CI will run on the pushed head.The named Scout compatibility behavior is covered by the Packit data-ingestion and Jynx repository-inventory regression tests. Independent correctness review checked the preceding draft against source; the explicit compatibility documentation has not received a separate independent review.