docs: document OCI/docker registry credential discovery

cmd/kosli/root.go

@@ -59,6 +59,19 @@ a freshly built image (just ^docker build^) will not have one. If the image is a
 a registry, prefer ^--artifact-type=oci^, which fetches the digest directly from the
 registry without needing a local Docker daemon.
 
+For ^--artifact-type=oci^ (and for ^--artifact-type=docker^ when ^--registry-username^
+is set), registry credentials are resolved as follows:
+  1) If ^--registry-username^ (and optionally ^--registry-password^) is set, it is used directly.
+  2) Otherwise, credentials are discovered automatically from:
+     - the Docker config file (^~/.docker/config.json^, populated by ^docker login^)
+     - the Podman/containers auth file (^~/.config/containers/auth.json^, or ^$REGISTRY_AUTH_FILE^)
+     - any Docker credential helper configured in that config (e.g. ^docker-credential-ecr-login^
+       for AWS ECR, ^docker-credential-gcloud^ for GCR/Artifact Registry, an ACR helper for Azure,
+       or a local keychain helper), invoked as an external binary on ^$PATH^
+     - if none of the above yield credentials, the registry is accessed anonymously, which works
+       for public images
+  ^--registry-provider^ is deprecated and no longer used.
+
 `
 
 	attestationBindingDesc = `
@@ -199,8 +212,8 @@ The ^.kosli_ignore^ will be treated as part of the artifact like any other file,
 	gitlabOrgFlag                   = "Gitlab organization. (defaulted if you are running in Gitlab Pipelines: https://docs.kosli.com/integrations/ci_cd )."
 	gitlabBaseURLFlag               = "[optional] Gitlab base URL (only needed for on-prem Gitlab installations)."
 	registryProviderFlag            = "[deprecated] The docker registry provider or url. Only required if you want to read docker image SHA256 digest from a remote docker registry."
-	registryUsernameFlag            = "[conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry."
-	registryPasswordFlag            = "[conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry."
+	registryUsernameFlag            = "[conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper."
+	registryPasswordFlag            = "[conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper."
 	resultsDirFlag                  = "[defaulted] The path to a directory with JUnit test results. By default, the directory will be uploaded to Kosli's evidence vault."
 	snykJsonResultsFileFlag         = "The path to Snyk SARIF or JSON scan results file from 'snyk test' and 'snyk container test'. By default, the Snyk results will be uploaded to Kosli's evidence vault."
 	snykSarifResultsFileFlag        = "The path to Snyk scan SARIF results file from 'snyk test' and 'snyk container test'. By default, the Snyk results will be uploaded to Kosli's evidence vault."

cmd/kosli/testdata/output/docs/mintlify/artifact.md

@@ -30,6 +30,19 @@ a freshly built image (just `docker build`) will not have one. If the image is a
 a registry, prefer `--artifact-type=oci`, which fetches the digest directly from the
 registry without needing a local Docker daemon.
 
+For `--artifact-type=oci` (and for `--artifact-type=docker` when `--registry-username`
+is set), registry credentials are resolved as follows:
+  1) If `--registry-username` (and optionally `--registry-password`) is set, it is used directly.
+  2) Otherwise, credentials are discovered automatically from:
+     - the Docker config file (`~/.docker/config.json`, populated by `docker login`)
+     - the Podman/containers auth file (`~/.config/containers/auth.json`, or `$REGISTRY_AUTH_FILE`)
+     - any Docker credential helper configured in that config (e.g. `docker-credential-ecr-login`
+       for AWS ECR, `docker-credential-gcloud` for GCR/Artifact Registry, an ACR helper for Azure,
+       or a local keychain helper), invoked as an external binary on `$PATH`
+     - if none of the above yield credentials, the registry is accessed anonymously, which works
+       for public images
+  `--registry-provider` is deprecated and no longer used.
+
 
 
 ## Flags
@@ -45,8 +58,8 @@ registry without needing a local Docker daemon.
 |    `-g`, `--git-commit` string  |  [defaulted] The git commit from which the artifact was created. (defaulted in some CIs: [docs](/integrations/ci_cd), otherwise defaults to HEAD ).  |
 |    `-h`, `--help`  |  help for artifact  |
 |    `-n`, `--name` string  |  [optional] Artifact display name, if different from file, image or directory name.  |
-|        `--registry-password` string  |  [conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry.  |
-|        `--registry-username` string  |  [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry.  |
+|        `--registry-password` string  |  [conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.  |
+|        `--registry-username` string  |  [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.  |
 |        `--repo-root` string  |  [defaulted] The directory where the source git repository is available. (default ".")  |
 
 

cmd/kosli/testdata/output/docs/mintlify/snyk.md

@@ -50,8 +50,8 @@ In other CI systems, set them explicitly to capture repository metadata.
 |    `-n`, `--name` string  |  The name of the attestation as declared in the flow or trail yaml template.  |
 |    `-o`, `--origin-url` string  |  [optional] The url pointing to where the attestation came from or is related. (defaulted to the CI url in some CIs: [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) ).  |
 |        `--redact-commit-info` strings  |  [optional] The list of commit info to be redacted before sending to Kosli. Allowed values are one or more of [author, message, branch].  |
-|        `--registry-password` string  |  [conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry.  |
-|        `--registry-username` string  |  [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry.  |
+|        `--registry-password` string  |  [conditional] The container registry password or access token. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.  |
+|        `--registry-username` string  |  [conditional] The container registry username. Only required if you want to read container image SHA256 digest from a remote container registry and it is not already accessible via Docker/Podman auth files or a credential helper.  |
 |        `--repo-id` string  |  [conditional] The stable, unique identifier for the repository in your VCS provider (e.g. a numeric ID). Do not use the repository name as it can change if the repo is renamed. All three of `--repo-id`, `--repo-url` and `--repository` must be set to record repository information (defaulted in some CIs: [docs](/integrations/ci_cd) ).  |
 |        `--repo-provider` string  |  [optional] The source code hosting provider. One of: github, gitlab, bitbucket, azure-devops (defaulted in some CIs: [docs](/integrations/ci_cd) ).  |
 |        `--repo-root` string  |  [defaulted] The directory where the source git repository is available. Only used if `--commit` is used or defaulted in CI, see [docs](/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables) . (default ".")  |