docker: complete Kyverno policy, digest note, identity scope

Claude-Session: https://claude.ai/code/session_01A5zMqzaUg1Snur4Yg8xJGa

docker/README.md

@@ -42,20 +42,36 @@ cosign verify \
   chrislusf/seaweedfs:latest
 ```
 
-The identity ends in the git ref the workflow ran for: `refs/tags/<version>` for a release, `refs/heads/master` when a variant was republished by hand. The other images name the workflow that built them. `dev` is `container_dev.yml`, a `latest` rebuilt by hand is `container_latest.yml`, the `_large_disk_foundationdb` release image is `container_release_foundationdb.yml`, and the per-version FoundationDB and RocksDB builds are `container_foundationdb_version.yml` and `container_rocksdb_version.yml`.
+cosign prints the digest it verified. Deploy by that digest, or let an admission controller resolve the tag, so what runs is what was checked.
 
-The same check as a Kyverno policy:
+The identity is `https://github.com/seaweedfs/seaweedfs/.github/workflows/<workflow>@<ref>`. The ref is `refs/tags/<version>` for a release and `refs/heads/master` when a variant was republished by hand. The workflow is `container_release_unified.yml` for the release images, `container_dev.yml` for `dev`, `container_latest.yml` for a `latest` rebuilt by hand, `container_release_foundationdb.yml` for the `_large_disk_foundationdb` release image, and `container_foundationdb_version.yml` or `container_rocksdb_version.yml` for the per-version builds. The regexp above accepts release images only; `container_[a-z_]+\.yml@` accepts everything this repository publishes, `dev` included.
+
+The same check as a Kyverno policy, release images only:
 
 ```yaml
-verifyImages:
-  - imageReferences:
-      - "chrislusf/seaweedfs:*"
-      - "ghcr.io/chrislusf/seaweedfs:*"
-    attestors:
-      - entries:
-          - keyless:
-              issuer: https://token.actions.githubusercontent.com
-              subject: https://github.com/seaweedfs/seaweedfs/.github/workflows/container_release_unified.yml@refs/tags/*
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: verify-seaweedfs-images
+spec:
+  validationFailureAction: Enforce
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: signed-by-the-release-workflow
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "docker.io/chrislusf/seaweedfs:*"
+            - "ghcr.io/chrislusf/seaweedfs:*"
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    subject: https://github.com/seaweedfs/seaweedfs/.github/workflows/container_release_unified.yml@refs/tags/*
 ```
 
 ## Local Development