Unify safe dialer use

[joniumGit]

This PR is co-authored by Copilot

What are you trying to accomplish?

I am trying to unify the safeDialer use in the codebase. I noticed that there were plenty of user input going into Http Clients in some parameters and them not using the safe dialer that the proxy explicitly creates in the beginning. This will prevent any config parameters from being used to reach unintended destinations. The way I did it is a bit ugly and ends up with the transport being added to all of the registry handler constructors.

Anything you want to highlight for special attention from reviewers?

Please check if this change is needed. I am not sure if the initial state of not using safe dialer in some of the registry handlers was intended.

How will you know you've accomplished your goal?

No user input should reach a raw HTTP Client.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR threads a shared http.RoundTripper/http.Client through OIDC token acquisition and multiple registry handlers so outbound OIDC exchanges can use the proxy’s configured transport.

Changes:

• Add transport http.RoundTripper to many handler constructors and pass it from proxy.go.
• Extend OIDCRegistry and CreateOIDCCredential to carry/create an HTTP client using the provided transport.
• Update Actions OIDC token-exchange helpers to accept an injected *http.Client, and adjust tests accordingly.

Reviewed changes

Copilot reviewed 33 out of 33 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
proxy.go	Passes the shared transport into more registry handlers.
internal/oidc/oidc_registry.go	Stores transport in the registry and uses it when creating OIDC credentials.
internal/oidc/oidc_registry_test.go	Updates registry construction for new transport parameter.
internal/oidc/oidc_credential.go	Adds an HTTP client to OIDC credentials and routes token fetches through it.
internal/oidc/oidc_credential_test.go	Updates credential creation calls for new transport parameter.
internal/oidc/actions_oidc.go	Injects *http.Client into token-exchange functions instead of creating local clients.
internal/oidc/actions_oidc_test.go	Passes http.DefaultClient to updated token-exchange signatures.
internal/handlers/terraform_registry.go	Adds transport param and passes it into OIDC registry.
internal/handlers/terraform_registry_test.go	Updates handler construction for new transport parameter.
internal/handlers/rubygems_server.go	Adds transport param and passes it into OIDC registry.
internal/handlers/rubygems_server_test.go	Updates handler construction for new transport parameter.
internal/handlers/python_index.go	Adds transport param and uses it for OIDC credential creation/registration.
internal/handlers/python_index_test.go	Updates handler construction for new transport parameter.
internal/handlers/pub_repository.go	Adds transport param and uses it for OIDC credential creation/registration.
internal/handlers/pub_repository_test.go	Updates handler construction for new transport parameter.
internal/handlers/oidc_handling_test.go	Updates many handler factories to pass the new transport argument.
internal/handlers/nuget_feed.go	Adds transport param, uses it in HTTP client and OIDC registry.
internal/handlers/nuget_feed_test.go	Updates handler construction for new transport parameter.
internal/handlers/npm_registry.go	Adds transport param and passes it into OIDC registry.
internal/handlers/npm_registry_test.go	Updates handler construction for new transport parameter.
internal/handlers/maven_repository.go	Adds transport param and passes it into OIDC registry.
internal/handlers/maven_repository_test.go	Updates handler construction for new transport parameter.
internal/handlers/hex_repository.go	Adds transport param and uses it for OIDC credential creation/registration.
internal/handlers/hex_repository_test.go	Updates handler construction for new transport parameter.
internal/handlers/helm_registry.go	Adds transport param and passes it into OIDC registry.
internal/handlers/helm_registry_test.go	Updates handler construction for new transport parameter.
internal/handlers/goproxy_server_handler.go	Adds transport param and passes it into OIDC registry.
internal/handlers/goproxy_server_handler_test.go	Updates handler construction for new transport parameter.
internal/handlers/docker_registry.go	Constructs OIDC registry with the provided transport.
internal/handlers/composer.go	Adds transport param and passes it into OIDC registry.
internal/handlers/composer_test.go	Updates handler construction for new transport parameter.
internal/handlers/cargo_registry.go	Adds transport param and uses it for OIDC credential creation/registration.
internal/handlers/cargo_registry_test.go	Updates handler construction for new transport parameter.

[joniumGit]

These are now unified in the call before this where the actual client is created. This alert is only half-correct in my opinion, there could be a nil check for the value.