You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The pure credential-transformation helpers on the registry auth path were entirely untested:
Credentials.AuthToken() — formats the username:secret pair used by the kubernetes pull-secret sync (pkg/driver/kubernetes/pullsecrets.go). The username-present vs. username-absent branches had no coverage.
credentialsFromAuthConfig() — converts a docker types.AuthConfig into the internal Credentials, including the non-obvious precedence rule where IdentityToken overrides Password as the secret. That precedence was untested.
fillFromContainerCredentials() — early-return path when the docker SDK already returned populated credentials.
These functions sit on the critical pull-secret auth path, and the IdentityToken-over-Password precedence is exactly the kind of non-obvious invariant that silently breaks if refactored.
Change
Added pkg/dockercredentials/credentials_test.go covering the above branches (no behavioral change, test-only):
No credentials are printed; tests use synthetic values only.
Verification performed
task cli:format — clean.
task cli:lint:ci — 0 new issues.
task cli:test — passes; the only failing package is pkg/git (TestRepoClone*), the known pre-existing stale-assertion failure on origin/main, unrelated to this change (which only touches pkg/dockercredentials).
go test ./pkg/dockercredentials/... — ok.
This PR was created by an AI agent as part of an automated daily package review job.
AI Reviewer: run a review on demand. To trigger the first review automatically, go to your organization or repository integration settings. AI can make mistakes. Always validate suggestions.
TIP This summary will be updated as you push new changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Package reviewed
pkg/dockercredentials(credential handling — Docker/OCI registry auth).Issue found
The pure credential-transformation helpers on the registry auth path were entirely untested:
Credentials.AuthToken()— formats theusername:secretpair used by the kubernetes pull-secret sync (pkg/driver/kubernetes/pullsecrets.go). The username-present vs. username-absent branches had no coverage.credentialsFromAuthConfig()— converts a dockertypes.AuthConfiginto the internalCredentials, including the non-obvious precedence rule whereIdentityTokenoverridesPasswordas the secret. That precedence was untested.fillFromContainerCredentials()— early-return path when the docker SDK already returned populated credentials.These functions sit on the critical pull-secret auth path, and the IdentityToken-over-Password precedence is exactly the kind of non-obvious invariant that silently breaks if refactored.
Change
Added
pkg/dockercredentials/credentials_test.gocovering the above branches (no behavioral change, test-only):AuthToken: username+secret pair, secret-only fallback, empty case.credentialsFromAuthConfig: password default, identity-token precedence, empty input.fillFromContainerCredentials: returns existing populated auth config unchanged.No credentials are printed; tests use synthetic values only.
Verification performed
task cli:format— clean.task cli:lint:ci— 0 new issues.task cli:test— passes; the only failing package ispkg/git(TestRepoClone*), the known pre-existing stale-assertion failure onorigin/main, unrelated to this change (which only touchespkg/dockercredentials).go test ./pkg/dockercredentials/...— ok.This PR was created by an AI agent as part of an automated daily package review job.