Treat automatic package credentials as fallback auth

[JamieMagee]

What changed

Add proxy-only credentials for automatic GitHub Packages authentication. They are used only when explicit OIDC credentials, explicit static credentials, and request-provided authentication do not apply.

This covers npm, Maven/Gradle, RubyGems, NuGet, and Docker. It also:

• preserves explicit and native authentication;
• replaces Dependabot's redacted authorization placeholders;
• uses host-only Maven and NuGet fallback credentials, without NuGet discovery;
• adds safe path matching, including Docker /v2/<repository> paths;
• stops failed explicit OIDC authentication from falling through to automatic credentials.

This is the proxy prerequisite for dependabot/dependabot-core#15415. The published image must be pinned in github/dependabot-action before the feature is re-enabled.

Validation

Passed the full race, lint, build, vet, container, smoke, and production-image checks.

[Copilot]

Copilot review overview

🟡 Changes recommended

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 2 · 1

New issues introduced by this change (3)

Severity	Finding
	internal/​handlers/​docker_registry.go — Docker is the only proxy-only flow that bypasses proxyOnlyCredentialRequestAllowed. A proxy-only…
	internal/​handlers/​npm_registry.go — This refactor bypasses the lower-cased cred.host that the old loop passed to…
	internal/​oidc/​oidc_registry_test.go — This replacement removes the only test that concurrently registers OIDC entries while performing…

What changed in this PR

Adds fallback-only automatic GitHub Packages authentication across five package ecosystems while preserving higher-priority authentication methods.

Changes:

• Introduces proxy-only credential handling and authorization-placeholder detection.
• Adds traversal-safe, path-boundary-aware credential matching.
• Adds repository-scoped Docker authentication and NuGet discovery safeguards.

File	Description
internal/​config/​config.go	Adds boolean credential access.
internal/​config/​config_test.go	Tests boolean access.
internal/​helpers/​helpers.go	Adds safe canonical path matching.
internal/​helpers/​helpers_test.go	Tests path boundaries and encoding.
internal/​oidc/​oidc_registry.go	Uses canonical path specificity.
internal/​oidc/​oidc_registry_test.go	Updates OIDC path tests.
internal/​handlers/​credentials.go	Detects usable request authentication.
internal/​handlers/​credentials_test.go	Tests authorization detection.
internal/​handlers/​npm_registry.go	Adds npm fallback credentials.
internal/​handlers/​npm_registry_test.go	Tests npm fallback precedence.
internal/​handlers/​maven_repository.go	Adds Maven fallback credentials.
internal/​handlers/​maven_repository_test.go	Tests Maven fallback behavior.
internal/​handlers/​rubygems_server.go	Adds RubyGems fallback credentials.
internal/​handlers/​rubygems_server_test.go	Tests RubyGems fallback behavior.
internal/​handlers/​nuget_feed.go	Adds host-only NuGet fallback handling.
internal/​handlers/​nuget_feed_test.go	Tests NuGet fallback and discovery.
internal/​handlers/​docker_registry.go	Adds scoped Docker fallback authentication.
internal/​handlers/​docker_registry_test.go	Tests Docker scopes and conflicts.
internal/​handlers/​oidc_handling_test.go	Tests OIDC precedence and failure handling.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.