kcl-lang / kpm / 33313964311

47%

main: 47%

Pull #766

github

feat(auth): pluggable OCI credential providers for kpm login

Add a small pkg/auth package with a Provider interface and a
GCPProvider implementation that mints OCI credentials from the
GCE/GKE metadata server (Workload Identity). The existing
username/password flow becomes the default BasicProvider.

kpm login gains a --provider flag:

  kpm login gcr.io/<project> --provider=gcp   # WI federated
  kpm login ghcr.io -u u -p p                 # unchanged

Why: function-kcl #251 asks for OCI pulls without static
credentials. The OCI client is reached through kpm
(kcl-lang.io/kpm/pkg/client.LoginOci), so the provider abstraction
sits in kpm; function-kcl wires --provider in a follow-up.

No behaviour change for --provider=basic (the default).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

103 of 118 new or added lines in 4 files covered. (87.29%)

5069 of 10872 relevant lines covered (46.62%)

0.53 hits per line