jenkins: route cosign/crane helper images via PULL_REGISTRY

In Harbor modes (HARBOR_ENABLED=true) the controller has no cgr.dev
credentials, so pulling the cosign helper (cgSign/cgVerify) and the
crane agent (refresh-cgimages-digests) directly from cgr.dev failed.
Source them via $PULL_REGISTRY the same way cgImage() routes the
application build/test agents — cgr.dev/<org> in Mode A, anonymous
localhost/cgr-proxy/<org> in Modes B/C.

Also align the surrounding docs (cgImages README, refresh-cgimages-
digests README) with the real cgLogin/PULL_REGISTRY flow, and drop the
obsolete .secrets/ entry from .gitignore (the OIDC flow writes to
/tmp/cgjenkins-home/.docker, no in-repo secrets dir is created).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ericsmalling

jenkins/.gitignore

@@ -1,9 +1,6 @@
 # Local environment overrides (e.g. CHAINGUARD_ORG). Bootstrapped from .env.example.
 .env
 
-# Pull-token-derived Docker config — generated by setup.sh, must not be committed.
-.secrets/
-
 # Identity UIDP file — generated by setup.sh, ephemeral, must not be committed.
 shared-libraries/cg-images/IDENTITY
 

jenkins/ops/refresh-cgimages-digests/Jenkinsfile

@@ -27,7 +27,11 @@ pipeline {
     stage('Refresh digests') {
       agent {
         docker {
-          image "cgr.dev/${env.CHAINGUARD_ORG}/crane:latest-dev"
+          // Pull crane via PULL_REGISTRY (cgr.dev/<org> in Mode A,
+          // localhost/cgr-proxy/<org> in Modes B/C where the controller
+          // has no cgr.dev creds — same routing as cgImage() applies to
+          // the application build/test agents).
+          image "${env.PULL_REGISTRY ?: "cgr.dev/${env.CHAINGUARD_ORG}"}/crane:latest-dev"
           // The agent inherits the controller's mounts via `--volumes-from`
           // (Jenkins docker-workflow plugin default), so the shared-libraries
           // tree (rw) and the pull-token docker config are already visible at

jenkins/ops/refresh-cgimages-digests/README.md

@@ -6,11 +6,14 @@ Scheduled Jenkins job that re-resolves every digest in the [cgImages shared-libr
 
 | Stage | Image | Purpose |
 |-------|-------|---------|
-| Refresh digests | `cgr.dev/${CHAINGUARD_ORG}/crane:latest-dev` | Runs [refresh-digests.sh](../../shared-libraries/cg-images/refresh-digests.sh) which calls `crane digest` for each entry. |
+| Auth            | (controller)                         | Runs `cgLogin()` — in Mode A this exchanges a Jenkins OIDC token for a chainctl session and writes a fresh docker config to `$DOCKER_CONFIG`; in Modes B/C (Harbor) it's a no-op because pulls go anonymously through the Harbor proxy. |
+| Refresh digests | `${PULL_REGISTRY}/crane:latest-dev`  | Runs [refresh-digests.sh](../../shared-libraries/cg-images/refresh-digests.sh) which calls `crane digest` for each entry. |
 
-The agent container gets:
-- `DOCKER_CONFIG=/dockerconfig` pointed at the bind-mounted pull-token config (so `crane` can authenticate to `cgr.dev`)
-- `/tmp/cgjenkins-home/shared-libraries` mounted **read-write** at `/sources` so the script can rewrite `vars/cgImage.groovy`
+The agent container inherits the controller's mounts (Jenkins docker-workflow `--volumes-from`), so:
+- `DOCKER_CONFIG=/tmp/cgjenkins-home/.docker` points at the controller's docker config — populated by `cgLogin()` in Mode A so `crane` can authenticate to `cgr.dev`; unused in Modes B/C where the Harbor proxy serves manifests anonymously.
+- `/tmp/cgjenkins-home/shared-libraries` is bind-mounted **read-write** so the script can rewrite `vars/cgImage.groovy` in place.
+
+The crane image itself is pulled via `PULL_REGISTRY` (not `cgr.dev` directly), matching how `cgImage()` routes application build/test agents — so this job works in Harbor modes even though the controller has no cgr.dev creds.
 
 When digests change, the next sample-app pipeline picks them up automatically — the cgImages library is live-loaded from the same bind-mounted dir on every build. No Jenkins restart needed.
 

jenkins/shared-libraries/cg-images/README.md

@@ -48,7 +48,7 @@ To refresh the digests (e.g. to pick up a security patch in the underlying image
 ./refresh-digests.sh
 ```
 
-The script reads the current `repo:tag` portion of each pinned reference, calls `crane digest cgr.dev/$CHAINGUARD_ORG/<repo>:<tag>` for each, and rewrites the digest in place. Requires `crane`. It picks up `CHAINGUARD_ORG` from `../../.env` so refreshing matches the org the demo is configured for.
+The script reads the current `repo:tag` portion of each pinned reference, calls `crane digest $PULL_REGISTRY/<repo>:<tag>` for each, and rewrites the digest in place. Requires `crane`. It picks up `CHAINGUARD_ORG` (and, optionally, `PULL_REGISTRY`) from `../../.env` — so refreshing matches the org and pull routing the demo is configured for: `cgr.dev/<org>` directly in Mode A, or the anonymous `localhost/cgr-proxy/<org>` Harbor cache in Modes B/C.
 
 ## Adding a new token
 

jenkins/shared-libraries/cg-images/vars/cgSign.groovy

@@ -22,6 +22,12 @@
 // wrote earlier in the pipeline (Harbor admin creds in Mode C; nothing
 // needed in A/B since signatures push anonymously to ttl.sh).
 //
+// The cosign helper image itself is pulled from $PULL_REGISTRY (not
+// cgr.dev directly) — that's cgr.dev/<org> in Mode A but the anonymous
+// Harbor proxy at localhost/cgr-proxy/<org> in Modes B/C, where the
+// controller has no cgr.dev creds. Same routing as cgImage() uses for
+// the application build/test agents.
+//
 // Usage from a stage on `agent any`:
 //
 //   stage('Sign') {
@@ -43,7 +49,8 @@ def call(String image) {
   // Pass `image` through the sh step's environment rather than interpolating
   // it into the script body — otherwise an image ref containing a single
   // quote (or other shell metacharacter) could break out of the surrounding
-  // quoting. CHAINGUARD_ORG is already exposed to the shell by Jenkins.
+  // quoting. CHAINGUARD_ORG and PULL_REGISTRY are already exposed to the
+  // shell by Jenkins.
   withEnv(["IMAGE=${image}"]) {
     withCredentials([
       file(credentialsId: 'cosign-private-key', variable: 'COSIGN_KEY_FILE'),
@@ -71,13 +78,14 @@ def call(String image) {
         case "$DIGEST" in
           localhost/*) DIGEST="localhost:80/${DIGEST#localhost/}" ;;
         esac
+        COSIGN_IMAGE="${PULL_REGISTRY:-cgr.dev/${CHAINGUARD_ORG}}/cosign:latest-dev"
         docker run --rm --network host \
           -v "$COSIGN_KEY_FILE:/cosign.key:ro" \
           -v "$DOCKER_CONFIG:/jenkins-docker:ro" \
           -e "COSIGN_PASSWORD=$COSIGN_PASSWORD" \
           -e DOCKER_CONFIG=/jenkins-docker \
           --entrypoint=/usr/bin/cosign \
-          "cgr.dev/${CHAINGUARD_ORG}/cosign:latest-dev" \
+          "$COSIGN_IMAGE" \
           sign --yes --allow-http-registry --key /cosign.key "$DIGEST"
         echo "cgSign: signed $DIGEST"
       '''

jenkins/shared-libraries/cg-images/vars/cgVerify.groovy

@@ -8,7 +8,10 @@
 // the full sign-then-verify loop.
 //
 // Cosign runs in a one-shot container with --network host for the same
-// reason cgSign does — see that file for the full rationale.
+// reason cgSign does — see that file for the full rationale. The cosign
+// helper image itself is pulled from $PULL_REGISTRY so it works whether
+// the controller has cgr.dev creds (Mode A) or only the anonymous Harbor
+// proxy (Modes B/C).
 //
 // Usage from a stage on `agent any`:
 //
@@ -47,12 +50,13 @@ def call(String image) {
         case "$DIGEST" in
           localhost/*) DIGEST="localhost:80/${DIGEST#localhost/}" ;;
         esac
+        COSIGN_IMAGE="${PULL_REGISTRY:-cgr.dev/${CHAINGUARD_ORG}}/cosign:latest-dev"
         docker run --rm --network host \
           -v "$COSIGN_PUB_FILE:/cosign.pub:ro" \
           -v "$DOCKER_CONFIG:/jenkins-docker:ro" \
           -e DOCKER_CONFIG=/jenkins-docker \
           --entrypoint=/usr/bin/cosign \
-          "cgr.dev/${CHAINGUARD_ORG}/cosign:latest-dev" \
+          "$COSIGN_IMAGE" \
           verify --allow-http-registry --key /cosign.pub "$DIGEST" >/dev/null
         echo "cgVerify: signature OK for $DIGEST"
       '''