From 97c92790cce80fa35a782aceeb89b011470c792f Mon Sep 17 00:00:00 2001
From: "devsy-app[bot]" <277138668+devsy-app[bot]@users.noreply.github.com>
Date: Sun, 9 Aug 2026 21:57:53 +0000
Subject: [PATCH 1/2] test(dockercredentials): cover auth token helpers

---
 pkg/dockercredentials/credentials_test.go | 68 +++++++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 pkg/dockercredentials/credentials_test.go

diff --git a/pkg/dockercredentials/credentials_test.go b/pkg/dockercredentials/credentials_test.go
new file mode 100644
index 0000000000..d597d079cb
--- /dev/null
+++ b/pkg/dockercredentials/credentials_test.go
@@ -0,0 +1,68 @@
+package dockercredentials
+
+import (
+	"testing"
+
+	"github.com/docker/cli/cli/config/types"
+	"github.com/stretchr/testify/suite"
+)
+
+type CredentialsTestSuite struct {
+	suite.Suite
+}
+
+func TestCredentialsSuite(t *testing.T) {
+	suite.Run(t, new(CredentialsTestSuite))
+}
+
+func (s *CredentialsTestSuite) TestAuthTokenPrefersUsernameSecretPair() {
+	creds := &Credentials{Username: "user", Secret: "pass"}
+	s.Equal("user:pass", creds.AuthToken())
+}
+
+func (s *CredentialsTestSuite) TestAuthTokenFallsBackToSecretWhenNoUsername() {
+	creds := &Credentials{Secret: "token-only"}
+	s.Equal("token-only", creds.AuthToken())
+}
+
+func (s *CredentialsTestSuite) TestAuthTokenEmptyWhenBothMissing() {
+	creds := &Credentials{}
+	s.Equal("", creds.AuthToken())
+}
+
+func (s *CredentialsTestSuite) TestCredentialsFromAuthConfigUsesPasswordByDefault() {
+	ac := types.AuthConfig{
+		Username:      "user",
+		Password:      "pass",
+		ServerAddress: "ghcr.io",
+	}
+	creds := credentialsFromAuthConfig(ac, "ghcr.io")
+	s.Equal("ghcr.io", creds.ServerURL)
+	s.Equal("user", creds.Username)
+	s.Equal("pass", creds.Secret)
+}
+
+func (s *CredentialsTestSuite) TestCredentialsFromAuthConfigPrefersIdentityToken() {
+	ac := types.AuthConfig{
+		Username:      "user",
+		Password:      "pass",
+		IdentityToken: "identity-token",
+		ServerAddress: "registry.example.com",
+	}
+	creds := credentialsFromAuthConfig(ac, "registry.example.com")
+	s.Equal("identity-token", creds.Secret)
+}
+
+func (s *CredentialsTestSuite) TestCredentialsFromAuthConfigEmptySecretWhenNothingSet() {
+	creds := credentialsFromAuthConfig(types.AuthConfig{}, "registry.example.com")
+	s.Equal("registry.example.com", creds.ServerURL)
+	s.Empty(creds.Username)
+	s.Empty(creds.Secret)
+}
+
+func (s *CredentialsTestSuite) TestFillFromContainerCredentialsReturnsExistingWhenPopulated() {
+	ac := types.AuthConfig{Username: "user", Password: "pass"}
+	result, err := fillFromContainerCredentials(ac, "ghcr.io")
+	s.NoError(err)
+	s.Equal(ac, result)
+}

From f99768483535862aa08959d71a7244fb8a2852ed Mon Sep 17 00:00:00 2001
From: "devsy-app[bot]" <277138668+devsy-app[bot]@users.noreply.github.com>
Date: Sun, 9 Aug 2026 22:06:00 +0000
Subject: [PATCH 2/2] fix: extract test string constants for goconst

---
 pkg/dockercredentials/credentials_test.go | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/pkg/dockercredentials/credentials_test.go b/pkg/dockercredentials/credentials_test.go
index d597d079cb..3468c1a0c5 100644
--- a/pkg/dockercredentials/credentials_test.go
+++ b/pkg/dockercredentials/credentials_test.go
@@ -7,6 +7,11 @@ import (
 	"github.com/stretchr/testify/suite"
 )
 
+const (
+	testUsername = "user"
+	testPassword = "pass"
+)
+
 type CredentialsTestSuite struct {
 	suite.Suite
 }
@@ -16,7 +21,7 @@ func TestCredentialsSuite(t *testing.T) {
 }
 
 func (s *CredentialsTestSuite) TestAuthTokenPrefersUsernameSecretPair() {
-	creds := &Credentials{Username: "user", Secret: "pass"}
+	creds := &Credentials{Username: testUsername, Secret: testPassword}
 	s.Equal("user:pass", creds.AuthToken())
 }
 
@@ -32,20 +37,20 @@ func (s *CredentialsTestSuite) TestAuthTokenEmptyWhenBothMissing() {
 
 func (s *CredentialsTestSuite) TestCredentialsFromAuthConfigUsesPasswordByDefault() {
 	ac := types.AuthConfig{
-		Username:      "user",
-		Password:      "pass",
+		Username:      testUsername,
+		Password:      testPassword,
 		ServerAddress: "ghcr.io",
 	}
 	creds := credentialsFromAuthConfig(ac, "ghcr.io")
 	s.Equal("ghcr.io", creds.ServerURL)
-	s.Equal("user", creds.Username)
-	s.Equal("pass", creds.Secret)
+	s.Equal(testUsername, creds.Username)
+	s.Equal(testPassword, creds.Secret)
 }
 
 func (s *CredentialsTestSuite) TestCredentialsFromAuthConfigPrefersIdentityToken() {
 	ac := types.AuthConfig{
-		Username:      "user",
-		Password:      "pass",
+		Username:      testUsername,
+		Password:      testPassword,
 		IdentityToken: "identity-token",
 		ServerAddress: "registry.example.com",
 	}
@@ -61,7 +66,7 @@ func (s *CredentialsTestSuite) TestCredentialsFromAuthConfigEmptySecretWhenNothi
 }
 
 func (s *CredentialsTestSuite) TestFillFromContainerCredentialsReturnsExistingWhenPopulated() {
-	ac := types.AuthConfig{Username: "user", Password: "pass"}
+	ac := types.AuthConfig{Username: testUsername, Password: testPassword}
 	result, err := fillFromContainerCredentials(ac, "ghcr.io")
 	s.NoError(err)
 	s.Equal(ac, result)