Test the Docker Task Workflow's Credential Check, Login, and Hook Inputs

[ptr727]

Fixes #3148

Change

Adds tests/test_docker_task_workflow.py, a stdlib-only structural test of .github/workflows/build-docker-task.yml. The job and step sets are read from the workflow by indentation, with no hard-coded indexes. Every job with a push-capable step (a step passing push, or a caller build hook) must:

• run a credential check step (both secrets through env, both tested empty, exit 1, no if or continue-on-error) before its first push-capable step;
• run the docker/login-action step fed both secrets, ungated, before its first push-capable step, and after the check;
• forward push, ref, branch, and platforms to the caller hook, with push, ref, and branch wired to the same-named input.

It also requires at least two pushing jobs, so a parse that silently loses a job fails.

Mutation proof

The test file holds these mutations in-memory against the real workflow text, and each asserts the specific violation. Also run once against a scratch copy:

Mutation	Result
drop login	no login before the first push step in docker-build-base and build-docker
drop credential check	no credential check before the first push step in both
login moved after the hook	docker-build-base: no login before the first push step
login moved after build-push	build-docker: no login before the first push step
check moved after login	docker-build-base: login before the credential check
drop hook push, ref, branch, platforms (each)	hook ... lacks <key>
ref wired to inputs.branch	does not forward inputs.ref
half the credential test, continue-on-error, if gate, commented-out password	caught

Local review

Three passes. Rounds 1 and 2 findings were fixed (move-helper newline glue, substring false passes on comments and gating, a mutation test that gated the wrong job's identical step, missing check-after-login and half-check mutations, hook input values). The third pass raised five findings, left unfixed per the two-round budget and handed here as known limits of an indentation-based reader:

• || joining the two empty tests is not checked (&& would pass).
• The login step is not checked for username/password wiring or a non-Hub registry:.
• Compact YAML (- name: at the same indent as steps:) and flow-style with: {push: true} are not parsed, so a new job written that way is unjudged beyond the two-job floor.
• Earlier, accepted: a run: step that pushes is not push-capable, and a step whose first key is not name: is unsupported.

Verified: ruff format and check, pyright, prose_lint, repo_gate --check eol, eol-coverage, spec/validate.py, 12 tests pass.

Co-authored in a Claude Code session.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: ptr727/ProjectTemplate/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 31ad28da-33af-48c2-9b2a-40599f1eefc9

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟡 Changes recommended

Unresolved findings leave important workflow validation gaps.

1 open finding

• Validate Docker login action username and password inputs · New

What changed in this PR

Adds stdlib-only structural regression tests for Docker workflow credential checks, login ordering, and hook inputs.

Changes:

• Parses workflow jobs and steps by indentation.
• Validates safeguards before push-capable steps.
• Adds mutation tests for missing, reordered, gated, or miswired elements.

File	Summary
tests/​test_docker_task_workflow.py	Adds workflow validation and mutation coverage; unresolved gaps remain in credential wiring, login inputs, failure semantics, and valid YAML shapes.

🧠 Review effort: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (develop@f8faecc). Learn more about missing BASE report.

Additional details and impacted files

@@            Coverage Diff             @@
##             develop    #3154   +/-   ##
==========================================
  Coverage           ?   63.97%           
==========================================
  Files              ?       17           
  Lines              ?     9151           
  Branches           ?        0           
==========================================
  Hits               ?     5854           
  Misses             ?     3297           
  Partials           ?        0           

Flag	Coverage Δ
python-3.13	63.97% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.