Repository navigation
Conversation
0da3c8e to
06caae4
Compare
- add docs/README.md index and docs/signing.md signing hub - merge rhdh-architecture.md into self-service-portal.md (one portal reference) - update architecture-alignment.md: governance layer (interceptor default, APF signed) implements Phase II runtime enforcement; signing is APF-only; audit is partial (interceptor/APF logs, no OCSF pipeline) - note rootless podman as the default container runtime in bom-architecture.md - move the NetworkPolicy upgrade procedure into the upgrade section of deployment-guide.md, with a pointer from In-cluster NetworkPolicy - apf.md: images are private on ghcr.io/mkhaas/apf (public later); drop the personal GHCR-access contact note - signing.md: only harness-bundle images are cosign-signed; component verification still waits on the publisher key - untrack docs/jira (kept local via .gitignore) and relocate internal notes there Co-Authored-By: Claude
06caae4 to
46a2dc3
Compare
Hadar301
left a comment
Hadar301
left a comment
There was a problem hiding this comment.
Two small notes, both non-blocking:
-
Deleted docs hold no code (
cli-migration-gaps.md,jira/cli-report.md,jira/switch-podman-to-docker.md,rhdh-architecture.md,harness-implementation.md). All are documentation only; their content is either relocated or superseded by the newdocs/README.mdandself-service-portal.md. No code logic is removed. -
New
signing.mdkeyless claim (signing.md:3). The file says harness-bundle images are cosign-signed "keyless". Verify this against.github/workflows/harness-bundles.yml— if the signing step already uses the standardCOSIGN_PRIVATE_KEY/ key-based flow, update the doc to say "keyless (sigstore attachments)" or adjust the workflow. If the workflow truly uses keyless mode, add a short note explaining why no publisher key is needed.
Reconcile architecture-alignment.md with the per-tool-approval feature that landed on main (saw-tool-gate, charts/governance-policy/tool-actions.yaml, tool-actions.jsonl audit): keep the new per-tool approval and user/task audit facts, the signed-only-on-APF wording, credential proxying, and the Partial audit status. deployment-guide.md and README.md auto-merged. Co-Authored-By: Claude
…her key Addresses review on signing.md: verified harness-bundles.yml uses keyless cosign (id-token: write; cosign sign --yes, no --key). Note added that keyless signs with the workflow's GitHub OIDC identity via Fulcio/Rekor, so there is no publisher key to distribute — verification is by workflow identity, not a key. Co-Authored-By: Claude
2 participants
Co-Authored-By: Claude