What happened?
nix run .#test fails when running locally in a few tests like TestFindImageTagForVersionConstraint, TestKCLBuild, and TestGoTemplatingBuild for anyone whose ~/.docker/config.json sets a credsStore. CI never hits it, since the runner has no Docker config.
The test app runs with inheritPath = false, so PATH holds Go and nothing else. findImageTagForVersionConstraint calls crane.ListTags, which resolves auth through authn.DefaultKeychain. A configured credsStore sends that to docker-credential-<store>, which isn't on the stripped PATH:
cannot fetch tags for the image 127.0.0.1:62645/ubuntu: error getting credentials - err: exec: "docker-credential-desktop": executable file not found in $PATH, out: ``
The test never surfaces that error. The assertion only reports the empty got, so it reads like the local registry was unreachable rather than a credential lookup that never got that far.
How can we reproduce it?
With "credsStore" set in ~/.docker/config.json, run unit tests with:
and you'll see failures like:
--- FAIL: TestFindImageTagForVersionConstraint (0.00s)
--- FAIL: TestFindImageTagForVersionConstraint/Constraint (0.00s)
image_test.go:120: [Constraint] expected: 127.0.0.1:53321/ubuntu:4.5.6, got:
--- FAIL: TestFindImageTagForVersionConstraint/ConstraintV (0.00s)
image_test.go:120: [ConstraintV] expected: 127.0.0.1:53322/ubuntu:4.5.6, got:
--- FAIL: TestFindImageTagForVersionConstraint/ConstraintPreRelease (0.00s)
image_test.go:120: [ConstraintPreRelease] expected: 127.0.0.1:53323/ubuntu:4.5.6, got:
--- FAIL: TestFindImageTagForVersionConstraint/RangedConstraint (0.00s)
image_test.go:120: [RangedConstraint] expected: 127.0.0.1:53326/ubuntu:4.5.6, got:
--- FAIL: TestFindImageTagForVersionConstraint/CommaSeparatedRangedConstraint (0.00s)
image_test.go:120: [CommaSeparatedRangedConstraint] expected: 127.0.0.1:53327/ubuntu:4.5.6, got:
...
--- FAIL: TestKCLBuild (0.06s)
build_test.go:194: failed to fetch KCL base image: failed to pull image: error getting credentials - err: exec: "docker-credential-desktop": executable file not found in $PATH, out: ``
--- FAIL: TestGoTemplatingBuild (0.06s)
build_test.go:264: failed to fetch go-templating base image: failed to pull image: error getting credentials - err: exec: "docker-credential-desktop": executable file not found in $PATH, out: ``
Isolating the Docker config is enough to make them pass, which confirms where the failure comes from:
DOCKER_CONFIG=$(mktemp -d) nix run .#test
Possible fix
The test probably shouldn't consult ambient Docker credentials at all. Perhaps t.Setenv("DOCKER_CONFIG", t.TempDir()) at the top of it, along with printing err in the failure message so the next person doesn't have to dig for the cause.
What happened?
nix run .#testfails when running locally in a few tests likeTestFindImageTagForVersionConstraint,TestKCLBuild, andTestGoTemplatingBuildfor anyone whose~/.docker/config.jsonsets acredsStore. CI never hits it, since the runner has no Docker config.The test app runs with
inheritPath = false, soPATHholds Go and nothing else.findImageTagForVersionConstraintcallscrane.ListTags, which resolves auth throughauthn.DefaultKeychain. A configuredcredsStoresends that todocker-credential-<store>, which isn't on the strippedPATH:The test never surfaces that error. The assertion only reports the empty
got, so it reads like the local registry was unreachable rather than a credential lookup that never got that far.How can we reproduce it?
With
"credsStore"set in~/.docker/config.json, run unit tests with:and you'll see failures like:
Isolating the Docker config is enough to make them pass, which confirms where the failure comes from:
Possible fix
The test probably shouldn't consult ambient Docker credentials at all. Perhaps
t.Setenv("DOCKER_CONFIG", t.TempDir())at the top of it, along with printingerrin the failure message so the next person doesn't have to dig for the cause.