You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
pkg/image (container/Docker category) � specifically acr.go, the Azure Container Registry credential handling.
Issue found
isACRRegistry � the pure function that decides whether a server URL is an ACR/MCR registry (so the credential helper routes to Azure exchange auth instead of the default keychain) � had 0% coverage. Its regex (^.+\.azurecr\.(io|cn|de|us)$) plus the mcr.microsoft.com special-case and port-suffixed host parsing had no tests, so a regression that mis-routed a non-ACR registry to Azure auth (or dropped a sovereign-cloud TLD) would not be caught. The ACR credential helper's non-ACR rejection path and its unimplemented Add/Delete/List mutation methods were also untested.
Change
Added pkg/image/acr_test.go (test-only, no behavioral change):
TestIsACRRegistry � table-driven cases covering all four ACR TLDs (io/cn/de/us), mcr.microsoft.com, port-suffixed hosts (foo.azurecr.io:443), and rejections: Docker Hub, GHCR, bare azurecr.io apex, wrong TLD (azurecr.com), lookalike (notazurecr.io), and empty input.
TestACRCredHelper_GetRejectsNonACRRegistry � asserts Get rejects a non-ACR registry (e.g. docker.io) locally with a clear "Azure Container Registry" error and returns empty credentials, without touching the network or Azure tokens.
TestACRCredHelper_UnimplementedMutations � asserts Add/Delete/List report unimplemented rather than silently succeeding.
TestNewACRCredentialsHelperSatisfiesInterface � confirms the constructor returns a value satisfying credentials.Helper.
Coverage impact: isACRRegistry 0% � 83.3% (remaining branch is the url.Parse error path, unreachable for valid https://-prefixed inputs); package pkg/image 17.7% � 23.4%.
Verification performed
task cli:format � clean (no changes to the new file)
task cli:lint:ci � 0 issues
task cli:test � pkg/image passes. The only failure is pkg/git (TestRepoClone*), a known pre-existing stale-assertion failure on origin/main, unrelated to this change (this PR does not touch pkg/git).
go test ./pkg/image/ � PASS
This PR was created by an AI agent as part of an automated daily package review job.
Add edge-case tests for pkg/image ACR credential handling. isACRRegistry was at 0% coverage; cover its regex (all 4 azure TLDs, mcr.microsoft.com), port-suffixed hosts, apex/wrong-TLD/lookalike rejections, and empty input. Also assert the ACR cred helper rejects non-ACR registries locally (no network), and that Add/Delete/List report unimplemented. Package coverage 17.7% -> 23.4%.
AI Reviewer: run a review on demand. To trigger the first review automatically, go to your organization or repository integration settings. AI can make mistakes. Always validate suggestions.
TIP This summary will be updated as you push new changes.
Use a short variable declaration in TestNewACRCredentialsHelperSatisfiesInterface; newACRCredentialsHelper already returns credentials.Helper, so the explicit type is redundant (staticcheck ST1023). Lint fix only; no behavior change.
This commit was created by an AI agent (OpenHands) on behalf of the user.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Package reviewed
pkg/image(container/Docker category) � specificallyacr.go, the Azure Container Registry credential handling.Issue found
isACRRegistry� the pure function that decides whether a server URL is an ACR/MCR registry (so the credential helper routes to Azure exchange auth instead of the default keychain) � had 0% coverage. Its regex (^.+\.azurecr\.(io|cn|de|us)$) plus themcr.microsoft.comspecial-case and port-suffixed host parsing had no tests, so a regression that mis-routed a non-ACR registry to Azure auth (or dropped a sovereign-cloud TLD) would not be caught. The ACR credential helper's non-ACR rejection path and its unimplementedAdd/Delete/Listmutation methods were also untested.Change
Added
pkg/image/acr_test.go(test-only, no behavioral change):TestIsACRRegistry� table-driven cases covering all four ACR TLDs (io/cn/de/us),mcr.microsoft.com, port-suffixed hosts (foo.azurecr.io:443), and rejections: Docker Hub, GHCR, bareazurecr.ioapex, wrong TLD (azurecr.com), lookalike (notazurecr.io), and empty input.TestACRCredHelper_GetRejectsNonACRRegistry� assertsGetrejects a non-ACR registry (e.g.docker.io) locally with a clear "Azure Container Registry" error and returns empty credentials, without touching the network or Azure tokens.TestACRCredHelper_UnimplementedMutations� assertsAdd/Delete/Listreport unimplemented rather than silently succeeding.TestNewACRCredentialsHelperSatisfiesInterface� confirms the constructor returns a value satisfyingcredentials.Helper.Coverage impact:
isACRRegistry0% � 83.3% (remaining branch is theurl.Parseerror path, unreachable for validhttps://-prefixed inputs); packagepkg/image17.7% � 23.4%.Verification performed
task cli:format� clean (no changes to the new file)task cli:lint:ci� 0 issuestask cli:test�pkg/imagepasses. The only failure ispkg/git(TestRepoClone*), a known pre-existing stale-assertion failure onorigin/main, unrelated to this change (this PR does not touchpkg/git).go test ./pkg/image/� PASSThis PR was created by an AI agent as part of an automated daily package review job.