dhi: update attestations

[craig-osterhout]

Description

• Added changelog attestation.
• Updated the wording to be less authoritative, noting that the actual attestations for a given image may differ and directing users to Docker Scout or the Docker Hub UI for the full list.

Related issues or tickets

https://docker.slack.com/archives/C04300R4G5U/p1785235912818699

Reviews

• Editorial review

[netlify]

✅ Deploy Preview for docsdocker ready!

Name	Link
🔨 Latest commit	4ca318a
🔍 Latest deploy log	https://app.netlify.com/projects/docsdocker/deploys/6a68d04e6947390008ef4505
😎 Deploy Preview	https://deploy-preview-25666--docsdocker.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[docker-agent]

Assessment: 🟢 APPROVE

This is a small, well-scoped update that adds a DHI changelog attestation row, notes that the actual attestation set may vary per image, and surfaces both Docker Scout and the Docker Hub UI as ways to inspect attestations. No high or medium issues were found.

Three minor (low) observations (not blocking):

1. Line 65 — Redundant caveat: "The actual set for a given image may differ." is slightly redundant with the preceding "may be included". Consider merging: "The following table lists attestations that may be included with a DHI; the actual set varies by image variant."

2. Line ~117 — Same pattern in Helm charts section: "The actual set for a given chart may differ." has the same redundancy.

3. Line 92 — Capitalisation inconsistency: The new row uses "DHI changelog" (lowercase c) while the sibling row uses "DHI Image Sources" (title case I, S). Align casing: either "DHI Changelog" or adjust "DHI Image Sources" to "DHI image sources".

[docker-agent]

Assessment: 🟡 NEEDS ATTENTION