Update docs for contacts.yaml

README.md

@@ -322,6 +322,7 @@ The `contacts.yaml` file has the following schema:
 | notify | False | Dict[str, List[str]] | Who and how to notify about the build progress. |
 | notify.emails | False | List[str] | List of emails that should receive notifications. |
 | notify.mattermost-channels | False | List[str] | Mattermost channel **IDs**. |
+| maintainers | False | List[str] | The maintainers' GitHub usernames who can trigger workflows against this image. |
 
 ##### Example: *contacts.yaml*
 
@@ -332,6 +333,9 @@ notify:
 
   mattermost-channels:
     - fbdezwkcxpfofpysjore1wpfoc
+
+maintainers:
+  - octocat
 ```
 
 #### Vulnerability Filtering

oci/mock-rock/contacts.yaml

@@ -8,4 +8,11 @@ notify:
   # These are channel IDs and not names.
   # opt, type: List[str]
   mattermost-channels:
-    - fbdezwkcxpfofpysjore1wpfoc
+    - fbdezwkcxpfofpysjore1wpfoc
+
+maintainers:
+  - cjdc
+  - clay-lake
+  - linostar
+  - rebornplusplus
+  - zhijie-yang

tools/cli-client/README.md

@@ -10,13 +10,13 @@ A CLI client that triggers GitHub workflows for building, uploading and releasin
 
 See ["How to Contribute as a Maintainer"](https://github.com/canonical/oci-factory?tab=readme-ov-file#as-a-maintainer--).
 
-Upon finishing the onboarding, the user should receive a GitHub Personal Access Token. This token grants you proper
-permissions to trigger the build, upload and release of your rocks. This token should never be shared with 
-third-parties, nor put anywhere that is publicly available.
+Upon finishing the onboarding, the user should add their GitHub username to the `contacts.yaml` file in the
+[`maintainers` field](../../README.md#contacts) field of the corresponding rock. This field is a list of GitHub
+usernames that are allowed to trigger the build, upload, and release workflows. The onboarded user needs to 
+generate a GitHub Personal Access Token to authenticate themselves when using the CLI client.
 
-The user will be asked to input the GitHub Personal Access Token upon triggering a workflow. For a non-interactive
-terminal, it is possible to assign the token to the environmental variable `export GITHUB_TOKEN=<your token>`, and pass
-`-y` to confirm the triggering by default.
+For a non-interactive terminal of the CLI client, it is possible to assign the token to the environmental variable 
+`export GITHUB_TOKEN=<your token>`, and pass `-y` to confirm the triggering by default.
 
 ### Install using Snap