docs: document OCI/docker registry credential discovery

[sofusalbertsen]

Explain how registry credentials are resolved for --artifact-type=oci (and docker with --registry-username set): explicit flags first, then Docker/Podman auth files and credential helpers, then anonymous access. Also note --registry-provider is deprecated and no longer used.

[claude]

Claude finished @sofusalbertsen's task in 1m 47s —— View job

---

Review: PR #1001 — document OCI/docker registry credential discovery

• Read the PR diff and relevant code
• Verify accuracy of credential-resolution docs against implementation
• Check docs fixtures are consistent with the generated-docs test
• Post review feedback

Verdict: LGTM ✅ — accurate, and the earlier blockers are resolved

Accuracy vs. implementation — the doc text now matches the code exactly:

• cmd/kosli/cli_utils.go:385-390 — oci always uses digest.OciSha256 (credential discovery), while docker only takes that path when o.registryUsername != ""; otherwise it uses DockerImageSha256 (local daemon, no auth files). The doc's qualifier "and for --artifact-type=docker when --registry-username is set" is correct.
• internal/digest/digest.go:90-100 — when no explicit creds are passed, DockerAuthConfig is left nil and containers/image falls back to auth files + credential helpers, then anonymous access. The step 1→2 resolution order in the doc mirrors this precisely.

Fixtures fixed — the concern from the earlier review runs (mine + @mbevc1's "we'll need to update fixtures") is now addressed by commit 3a122df8:

• artifact.md has both the new credential-resolution paragraph and the updated flag text.
• snyk.md has the updated flag text (correctly without the paragraph, since snyk doesn't embed fingerprintDesc).
• TestDocsCommandTestSuite only generates/compares artifact and snyk docs, and the fixture text matches root.go verbatim, so the exact-file comparison should pass. go build ./... is clean. (I couldn't run the test suite here — it needs the local Kosli server — but the fixture/source text is byte-consistent.)

Minor nit (non-blocking)

Step 1 reads "If --registry-username (and optionally --registry-password) is set". For --artifact-type=oci, the explicit-credentials branch at internal/digest/digest.go:95 actually fires when either username or password is non-empty (registryUsername != "" || registryPassword != "") — so setting only --registry-password also skips discovery. The username-centric phrasing is fine for the common case and reads clearly; only worth tightening if you want to be exhaustive.

Nice touches

• Documenting the deprecation of --registry-provider inline where users will actually look.
• Concrete credential-helper examples (ECR / GCR / ACR) make the "discovered automatically" step actionable rather than hand-wavy.

[mbevc1]

Minor nit and we'll need to update fixtures for testing. But looks good otherwise