docs(image-build): add pull-token trust contract

Authored-By: Codex (GPT-5) <noreply@openai.com>
This commit is contained in:
Dave Kowalski
2026-08-26 13:39:16 +00:00
parent e20e59ad0d
commit 925be5d5e3
2 changed files with 27 additions and 10 deletions
+7 -5
View File
@@ -37,11 +37,13 @@ inputs:
default: ''
token:
description: |
Registry token with `read:package` capability for
`docker login code.fritzlab.net`. Required when the Dockerfile's FROM is a
PRIVATE fritzlab image (e.g. FROM code.fritzlab.net/fritzlab/base) — the
org is `limited`, so buildx can't pull it anonymously. Omit for public-base
builds (e.g. base itself = FROM debian).
ci-bot access token with `read:package` capability for
`docker login code.fritzlab.net`. The login username is fixed to `ci-bot`,
so a token issued to another account will fail. Required when the
Dockerfile's FROM is a PRIVATE fritzlab image (e.g. FROM
code.fritzlab.net/fritzlab/base) — the org is `limited`, so buildx can't
pull it anonymously. Omit for public-base builds (e.g. base itself = FROM
debian).
required: false
default: ''
outputs: