kcl-lang / kpm / 33460338772

47%

main: 47%

Build Type

Pull #772

github

Committed by Peefy

Commit Message

fix(auth): allow plaintext credential storage on headless CI (fixes #769)

LoginOci only enabled AllowPlaintextPut when plain-HTTP mode was on,
conflating transport security with the credential storage policy. On a
headless CI runner there is no credential helper, so the ORAS file
store refused to persist credentials ("putting plaintext credentials
is disabled") unless OCI_REG_PLAIN_HTTP=on was set — a flag that also
forces PlainHTTP=true and therefore cannot work against HTTPS-only
registries such as ghcr.io. Login was impossible on CI for public
registries (kcl-lang/modules had to hand-write the config.json).

Decouple the two concerns:

- AllowPlaintextPut is now always set, matching `docker login`: when
  the config file configures credsStore/credHelpers, oras-go delegates
  to the helper and plaintext is never touched; when no helper exists,
  the config file is the only backend and refusing it breaks login.
- Plain HTTP settings continue to govern only the transport
  (registry.PlainHTTP).

Adds a regression test that persists a credential through the store
built by LoginOci without any helper configured — it fails with the
exact error from the issue before the fix.

Signed-off-by: Peefy <peefy@qq.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Pull Request Pull Request #772: fix(auth): allow plaintext credential storage on headless CI

Coverage Stats

7 of 7 new or added lines in 1 file covered. (100.0%)

7 existing lines in 1 file now uncovered.

5173 of 11057 relevant lines covered (46.78%)

0.53 hits per line