stacklok / toolhive / 20027588429

60%

push

github

Add build auth file injection for protocol builds (#2909)

* Add build auth file injection for protocol builds

Add support for injecting authentication files (npmrc, netrc, yarnrc)
into container builds for protocol schemes (npx://, uvx://, go://).

This solves the problem that NPM registry-scoped authentication cannot
be configured via environment variables because the format
(//registry.example.com/:_authToken=TOKEN) contains characters that
are invalid as environment variable names.

Key features:
- New CLI commands: set-build-auth-file, get-build-auth-file, unset-build-auth-file
- Files are injected into the builder stage only and NOT included in
  the final container image for security
- Supports npmrc (npm/npx), netrc (pip/Go), and yarnrc (Yarn)
- Credentials are hidden by default in CLI output (use --show-content
  to display)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Add CLI documentation for build auth file commands

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Add --stdin flag to read auth file content from stdin

This avoids exposing secrets in shell history and process listings.

Examples:
  cat ~/.npmrc | thv config set-build-auth-file npmrc --stdin
  thv config set-build-auth-file npmrc --stdin < ~/.npmrc

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Store build auth file content in encrypted secrets

Refactor build auth file storage to use ToolHive's encrypted secrets
provider instead of storing credentials in plain text config files.

- Config now stores only markers (e.g., "secret:BUILD_AUTH_FILE_npmrc")
- Actual content stored in keyring/encrypted secrets provider
- CLI commands updated to use secrets manager for storage/retrieval
- protocol.go resolves secrets at build time
- Updated interface methods and all provider implem... (continued)

80 of 401 new or added lines in 5 files covered. (19.95%)

26405 of 53240 relevant lines covered (49.6%)

58.9 hits per line