This run checks that the public configuration tools can be used inside a CI job without a ConfigHub account.
Result
PASS. A GitHub Actions job with no ConfigHub credentials anonymously pulled the public NGINX installer package, rendered and inspected six Kubernetes objects, packaged them as OCI, and pulled back the same object set.
The job pulled oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/bitnami-nginx:24.0.2 at sha256:08947210de607a6b9b8e7b8423b024e3fe89a0fc2b09581f80e2401008e445a1, selected the http-clusterip preset, and rendered 6 Kubernetes objects: Deployment, Namespace, NetworkPolicy, PodDisruptionBudget, Service, ServiceAccount.
It then packaged those reviewed files as a local OCI image layout. Pulling that layout back produced the same object-set hash, 1e7de3915db6173ff8e58022d8413ae87660c86fad8f1b4e33772526bd15cd74. The output manifest digest was sha256:d10ce8d07f7b9b276fe5758557c947166ce4cd6a77fc513e32072516bdd79a20.
Where it ran
- Provider: GitHub Actions
- Workflow: Anonymous OCI CI proof
- Run: https://github.com/confighub/helm-expt/actions/runs/30222445913
- Commit:
24912e2e0b94da24d60dd7114098d213e79f2b6b - Installer source:
0b553b3c35bd629bad1784e07dfe0bc77af7432c
What this proves
This is the OCI -> work -> OCI shape running as a CI job. The work is anonymous: the job had no ConfigHub token, account context, saved history, variant, approval, or release.
The same public tools can also be used as OCI -> work when a job only needs to inspect or test a package, or as work -> OCI when the starting point is a repository rather than an existing OCI package.
Limits
- The output is an OCI image layout uploaded as a GitHub Actions artifact, not a public registry package.
- This run uses no ConfigHub account, saved history, variant, approval, cluster, or delivery controller.
- A hosted public service that performs this work remains planned, not shipped.
- This NGINX preset has no Helm hooks or CRDs. Configurations with lifecycle work still need their recorded routes.