test: cover Docker Hub OIDC with registry-auth

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

__tests__/context.test.ts

@@ -54,6 +54,25 @@ test('getAuthList skips secret masking when registry-auth password is absent', a
   });
 });
 
+test('getAuthList supports password-less Docker Hub registry-auth for OIDC', async () => {
+  const [auth] = getAuthList({
+    registry: '',
+    username: '',
+    password: '',
+    scope: '',
+    ecr: '',
+    logout: true,
+    registryAuth: '- username: docker-org\n'
+  });
+
+  expect(auth).toMatchObject({
+    registry: 'docker.io',
+    username: 'docker-org',
+    password: undefined,
+    ecr: 'auto'
+  });
+});
+
 test('getAuthList masks registry-auth password when present', async () => {
   const stdoutWriteSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
   getAuthList({

__tests__/docker.test.ts

@@ -1,8 +1,14 @@
-import {expect, test, vi} from 'vitest';
+import {afterEach, expect, test, vi} from 'vitest';
 
 import {Docker} from '@docker/actions-toolkit/lib/docker/docker.js';
 
-import {loginStandard, logout} from '../src/docker.js';
+import {login, loginStandard, logout} from '../src/docker.js';
+import * as dockerhub from '../src/dockerhub.js';
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  delete process.env.DOCKERHUB_OIDC_CONNECTIONID;
+});
 
 test('loginStandard calls exec', async () => {
   const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
@@ -32,6 +38,37 @@ test('loginStandard calls exec', async () => {
   });
 });
 
+test('login exchanges Docker Hub OIDC token for password-less auth', async () => {
+  process.env.DOCKERHUB_OIDC_CONNECTIONID = '123e4567-e89b-42d3-a456-426614174000';
+  const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
+    return {
+      exitCode: 0,
+      stdout: '',
+      stderr: ''
+    };
+  });
+  const oidcSpy = vi.spyOn(dockerhub, 'getOIDCToken').mockResolvedValue({
+    username: 'docker-org',
+    token: 'hub-token'
+  });
+
+  await login({
+    registry: 'docker.io',
+    username: 'docker-org',
+    password: '',
+    scope: '',
+    ecr: 'auto',
+    configDir: ''
+  });
+
+  expect(oidcSpy).toHaveBeenCalledWith('docker.io', 'docker-org');
+  expect(execSpy).toHaveBeenCalledWith(['login', '--password-stdin', '--username', 'docker-org', 'docker.io'], {
+    input: Buffer.from('hub-token'),
+    silent: true,
+    ignoreReturnCode: true
+  });
+});
+
 test('logout calls exec', async () => {
   const execSpy = vi.spyOn(Docker, 'getExecOutput').mockImplementation(async () => {
     return {