From 3fe1e41a4b73d3f446276150800380e9f758756e Mon Sep 17 00:00:00 2001 From: Ilia Mogilevsky Date: Thu, 25 Jun 2026 09:42:36 +1000 Subject: [PATCH 1/5] docs: route pulls through Scarf gateway and add anonymized analytics disclosure Switches the documented `docker run` commands from the canonical `pactfoundation/pact-broker` to the Scarf Docker gateway URL `docker.pactflow.io/pactfoundation/pact-broker`, so installs are counted by default. Canonical `docker pull pactfoundation/pact-broker` is now the documented opt-out, mirroring the swagger-ui anonymized-analytics section style. Adds a Scarf README pixel (HTML form recommended by Scarf for GitHub READMEs, pixel UUID f0adca49-1631-4f0b-8914-366ea390b5c8) and an "Anonymized analytics" section disclosing what's collected and how to opt out. Part of PACT-6978. No application, image, or CI changes. --- CHANGELOG.md | 7 +++++++ README.md | 18 +++++++++++++++--- 2 files changed, 22 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 727ecb3..def605f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ + +### Unreleased + +#### Features + +* add Scarf analytics pixel to README and document telemetry / opt-out + ### 2.139.0-pactbroker2.119.0 (2026-06-17) diff --git a/README.md b/README.md index 5af77ac..543fb9f 100644 --- a/README.md +++ b/README.md @@ -17,6 +17,8 @@ This repository contains a Dockerized version of the [Pact Broker][pact-broker]. [![size: arm64](https://badgen.net/docker/size/pactfoundation/pact-broker/latest-multi/arm64?icon=docker&label=size%3Aarm64)](https://hub.docker.com/r/pactfoundation/pact-broker) [![size: arm](https://badgen.net/docker/size/pactfoundation/pact-broker/latest-multi/arm?icon=docker&label=size%3Aarm)](https://hub.docker.com/r/pactfoundation/pact-broker) + + ## In a hurry? If you want to try out a Pact Broker that can be accessed by all your teams, without having to fill in requisition forms and wait for 3 months, you can get a free trial at pactflow.io. Built by a group of core Pact maintainers, PactFlow is a fork of the OSS Pact Broker with extra goodies like an improved UI, user and team management, secrets, field level verification results and federated login. It's also fully supported, and that means when something goes wrong, *someone else* gets woken up in the middle of the afternoon to fix it... @@ -36,7 +38,7 @@ Multi-platform images are available - `--platform=linux/arm64` ```sh - docker run --rm -it --entrypoint /bin/sh pactfoundation/pact-broker:latest -c 'uname -sm' + docker run --rm -it --entrypoint /bin/sh docker.pactflow.io/pactfoundation/pact-broker:latest -c 'uname -sm' ``` ## Prerequisites @@ -276,7 +278,7 @@ docker run --rm \ -e PACT_BROKER_DATABASE_URL= \ -e PACT_BROKER_MIGRATION_TARGET= \ --entrypoint db-migrate \ - pactfoundation/pact-broker + docker.pactflow.io/pactfoundation/pact-broker ``` To get the current version of the database run: @@ -285,7 +287,7 @@ To get the current version of the database run: docker run --rm \ -e PACT_BROKER_DATABASE_URL= \ --entrypoint db-version \ - pactfoundation/pact-broker + docker.pactflow.io/pactfoundation/pact-broker ``` # Vulnerability scanning @@ -319,6 +321,16 @@ Until May 2023, the versioning scheme used the `M.m.p` from the Pact Broker gem, See the [Troubleshooting][troubleshooting] page on the docs site. +## Anonymized analytics + +`pactfoundation/pact-broker` uses [Scarf](https://scarf.sh/) to collect [anonymized download analytics](https://about.scarf.sh/about). These analytics help support the maintainers of this image and ONLY run when you pull the image through the Scarf gateway (the pull commands shown throughout this README). To opt out, pull the image directly from Docker Hub: + +```sh +docker pull pactfoundation/pact-broker +``` + +Alternatively, block `static.scarf.sh` at the network level (or disable image loading in your browser when viewing this README) to disable the README impression pixel. + [docker]: https://docs.docker.com/install/ [pact-broker]: https://github.com/pact-foundation/pact_broker [pact-broker-docker]: https://hub.docker.com/r/pactfoundation/pact-broker/ From 9c788c9852d2b738c7635455456eb994592d46a6 Mon Sep 17 00:00:00 2001 From: Ilia Mogilevsky Date: Thu, 25 Jun 2026 10:47:19 +1000 Subject: [PATCH 2/5] docs: add page=README.md param to Scarf pixel for GitHub obfuscation Per Scarf's GitHub obfuscation guidance (https://docs.scarf.sh/web-traffic/#obfuscation-on-github), GitHub's camo image proxy rewrites image URLs to camo.githubusercontent.com, which both strips the referrer and obscures which page is being viewed. Adding the `page=README.md` query param tags the pixel impression with its source page so it still attributes correctly. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 543fb9f..6848603 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ This repository contains a Dockerized version of the [Pact Broker][pact-broker]. [![size: arm64](https://badgen.net/docker/size/pactfoundation/pact-broker/latest-multi/arm64?icon=docker&label=size%3Aarm64)](https://hub.docker.com/r/pactfoundation/pact-broker) [![size: arm](https://badgen.net/docker/size/pactfoundation/pact-broker/latest-multi/arm?icon=docker&label=size%3Aarm)](https://hub.docker.com/r/pactfoundation/pact-broker) - + ## In a hurry? From 69f659e0052036bf48dd111ccb124ac8880b2073 Mon Sep 17 00:00:00 2001 From: Ilia Mogilevsky Date: Thu, 25 Jun 2026 10:52:04 +1000 Subject: [PATCH 3/5] docs: enumerate what Scarf captures for Docker pulls and README impressions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replaces the vague "anonymized download analytics" line with Scarf's documented categories — system and OS statistics, company information, and downloads by versions/tags — plus the explicit "no IP storage, no cookies, no PII" reassurance from Scarf's privacy policy. Links to the authoritative Scarf docs pages for both mechanisms (Docker Package and web-traffic pixel) so the disclosure stays accurate as their policy evolves. --- README.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 6848603..e618bb4 100644 --- a/README.md +++ b/README.md @@ -323,7 +323,11 @@ See the [Troubleshooting][troubleshooting] page on the docs site. ## Anonymized analytics -`pactfoundation/pact-broker` uses [Scarf](https://scarf.sh/) to collect [anonymized download analytics](https://about.scarf.sh/about). These analytics help support the maintainers of this image and ONLY run when you pull the image through the Scarf gateway (the pull commands shown throughout this README). To opt out, pull the image directly from Docker Hub: +`pactfoundation/pact-broker` uses [Scarf](https://scarf.sh/) to collect anonymized analytics about how the image is being used. + +When you pull through the Scarf gateway (the pull commands shown throughout this README), Scarf records [**system and OS statistics, company information, and downloads by versions/tags**](https://docs.scarf.sh/packages/) — derived from your Docker client's User-Agent and an ASN lookup on your IP at request time. When you view this README on github.com or Docker Hub, a [1x1 pixel](https://docs.scarf.sh/web-traffic/) records a coarse-grained impression with country and organisation attribution. **No IP address is stored, no cookies are set, and no other personally identifiable information is retained.** + +To opt out of pull-event analytics, pull the image directly from Docker Hub: ```sh docker pull pactfoundation/pact-broker From 3b65188a8437d9dab2382832f65214b7235e94eb Mon Sep 17 00:00:00 2001 From: Ilia Mogilevsky Date: Thu, 25 Jun 2026 10:52:52 +1000 Subject: [PATCH 4/5] docs: link to docs.pact.io/telemetry for full telemetry policy Adds a "For more information" pointer to the Pact Foundation's central telemetry page from the Anonymized analytics section, so readers can find the canonical Pact-wide telemetry policy without having to chase Scarf's docs in isolation. --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index e618bb4..bd9b05c 100644 --- a/README.md +++ b/README.md @@ -335,6 +335,8 @@ docker pull pactfoundation/pact-broker Alternatively, block `static.scarf.sh` at the network level (or disable image loading in your browser when viewing this README) to disable the README impression pixel. +For more information, see [docs.pact.io/telemetry](https://docs.pact.io/telemetry). + [docker]: https://docs.docker.com/install/ [pact-broker]: https://github.com/pact-foundation/pact_broker [pact-broker-docker]: https://hub.docker.com/r/pactfoundation/pact-broker/ From 075c3c486606a236e9b18cbaae10a9c6fa194bd3 Mon Sep 17 00:00:00 2001 From: Ilia Mogilevsky Date: Thu, 25 Jun 2026 10:54:27 +1000 Subject: [PATCH 5/5] docs: revert Anonymized analytics paragraph to the concise version Reverts the enumerated Scarf-categories paragraph back to the tighter "anonymized download analytics" wording that mirrors swagger-ui's style. The data-categories detail belongs on docs.pact.io/telemetry, which is already linked from this section. --- README.md | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/README.md b/README.md index bd9b05c..cb85a62 100644 --- a/README.md +++ b/README.md @@ -323,11 +323,7 @@ See the [Troubleshooting][troubleshooting] page on the docs site. ## Anonymized analytics -`pactfoundation/pact-broker` uses [Scarf](https://scarf.sh/) to collect anonymized analytics about how the image is being used. - -When you pull through the Scarf gateway (the pull commands shown throughout this README), Scarf records [**system and OS statistics, company information, and downloads by versions/tags**](https://docs.scarf.sh/packages/) — derived from your Docker client's User-Agent and an ASN lookup on your IP at request time. When you view this README on github.com or Docker Hub, a [1x1 pixel](https://docs.scarf.sh/web-traffic/) records a coarse-grained impression with country and organisation attribution. **No IP address is stored, no cookies are set, and no other personally identifiable information is retained.** - -To opt out of pull-event analytics, pull the image directly from Docker Hub: +`pactfoundation/pact-broker` uses [Scarf](https://scarf.sh/) to collect [anonymized download analytics](https://about.scarf.sh/about). These analytics help support the maintainers of this image and ONLY run when you pull the image through the Scarf gateway (the pull commands shown throughout this README). To opt out, pull the image directly from Docker Hub: ```sh docker pull pactfoundation/pact-broker