Add the docker-hub secret mechanism to the audit manifest - #23
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@## develop #23 +/- ##
========================================
Coverage 44.96% 44.96% ========================================
Files 25 25 Lines 3398 3398 Branches 259 259 ========================================
Hits 1528 1528 Misses 1824 1824 Partials 46 46 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
Updates the repository self-audit baseline to account for Docker Hub publishing credentials introduced by the release pipeline, so the audit manifest and the audit instructions match the repo's current publish configuration.
Changes:
- Add a
docker-hubsecret mechanism (username + access token) and route thedockerpublish target to it inspec/secrets.json. - Update
AUDIT.mdto include the Docker Hub secret pair in the names-only secrets presence check and related prose.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| spec/secrets.json | Adds docker-hub mechanism and routes docker target to it; updates manifest note accordingly. |
| AUDIT.md | Extends the secrets audit command to require the Docker Hub secret pair in both stores. |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
ptr727 added a commit
that referenced
this pull request
Aug 3, 2026
The release pipeline (#22) stood up Docker Hub publishing, so the self-audit must now expect its credentials: - spec/secrets.json: add the docker-hub mechanism (DOCKER_HUB_USERNAME + DOCKER_HUB_ACCESS_TOKEN, both stores) and the docker ->docker-hub target routing; update the note (publish mechanisms are configured). - AUDIT.md: include the Docker Hub pair in the names-only secrets check (both stores) and the prose. Both secrets are already provisioned in both stores, so the self-audit stays green. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The release pipeline (#22) stood up Docker Hub publishing, so the self-audit manifest must expect its credentials. Surfaced by the fresh Copilot review of the promotion PR (#20).
docker-hubmechanism (DOCKER_HUB_USERNAME+DOCKER_HUB_ACCESS_TOKEN, both stores, static-secret - Docker Hub has no OIDC) and thedocker -> docker-hubtarget routing; update the note to reflect that publish mechanisms are now configured.Both secrets are already provisioned in both the Actions and Dependabot stores, so
AUDIT.md's self-audit stays green.Note
This closes a gap I should have caught when building #22: standing up a docker publish target requires the
docker-hubmechanism in the audit manifest per the hub secrets model. The manifest matches the fleet reference shape (PlexCleaner carries the same docker-hub mechanism).🤖 Generated with Claude Code