[#3078] Kept 'auth.json' out of the container build context and image. - #3084
Open
AlexSkrypnyk wants to merge 4 commits into
Open
[#3078] Kept 'auth.json' out of the container build context and image.#3084AlexSkrypnyk wants to merge 4 commits into
AlexSkrypnyk wants to merge 4 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: ASSERTIVE Plan: Team Run ID: ⛔ Files ignored due to path filters (32)
📒 Files selected for processing (3)
Included review availability: 6 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 8 reviews per hour. WalkthroughThe Docker build now excludes ChangesDocker credential exclusion
Estimated code review effort: 2 (Simple) | ~5 minutes Merge Risk: ⚪ Minimal · up to Docker builds no longer include local auth files in the build context or image while Composer authentication remains available through configured secret or token inputs. The change is ready to merge. Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Linked Issues checkExplanation The changes satisfy issue Full details: Docstring CoverageExplanation Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (2 skipped: 2 unsupported.) ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
2 similar comments
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3084 +/- ##
==========================================
- Coverage 87.28% 87.00% -0.28%
==========================================
Files 99 100 +1
Lines 4679 4925 +246
Branches 49 3 -46
==========================================
+ Hits 4084 4285 +201
- Misses 595 640 +45 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
📖 Documentation preview for this pull request has been deployed to Netlify: https://6a992b632a7ef500e6925781--vortex-docs.netlify.app This preview is rebuilt on every commit and is not the production documentation site. |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
2 similar comments
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
AlexSkrypnyk
added
the
Needs review
AlexSkrypnyk
force-pushed
the
feature/dockerignore-auth
branch
from
September 3, 2026 07:56
d53cfa1 to
95320e6
Compare
|
Code coverage (threshold: 90%) Per-class coverage |
This comment has been minimized.
This comment has been minimized.
2 similar comments
Member
Author
|
Code coverage (threshold: 90%) Per-class coverage |
Member
Author
|
Code coverage (threshold: 90%) Per-class coverage |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3078
Summary
.dockerignoredid not excludeauth*, and.docker/cli.dockerfilecopied it explicitly, so a project with a localauth.jsonbaked its Composer package token into the built image through two paths: the explicitCOPY ... auth* /app/and the laterCOPY . /app. The build does not need the file: credentials for the Composer install come fromCOMPOSER_AUTH, assembled inside theRUNfrom thepackage_tokenbuild secret or thePACKAGE_TOKENbuild arg. The file is now excluded from the build context and dropped from the copy, so it can no longer reach the image, and a test asserts that it does not.Changes
auth*to.dockerignoreunder a new credentials group, placed to follow the header's deny-list ordering (VCS internals, then secrets).auth*from theCOPY composer.json composer.* patches.lock.* .env* /app/instruction in.docker/cli.dockerfile.str_replace()needle in.vortex/tests/phpunit/Traits/SutTrait.phpthat anchors the test-only toolingCOPYinjection to this instruction, so the injection keeps matching.testDockerComposePackageToken()in.vortex/tests/phpunit/Functional/DockerComposeWorkflowTest.phpto write anauth.jsoninto the build context and assert that the built image does not contain/app/auth.json.ahoy update-snapshots: the baseline.dockerignoreandcli.dockerfilecarry the change, and the per-scenario diff fixtures shift their hunk offsets accordingly.Adding
auth.jsonto the template's.gitignoreis a possible follow-up not included here.Test coverage
testDockerComposePackageToken()already covered the credential path itself: it requiresdrevops/test-private-package(a private repository), asserts that the image build fails withoutPACKAGE_TOKEN, and asserts that it succeeds with it. Because the system under test is a freshly installed template that carries noauth.json, that pair of builds already demonstrated that a private package resolves during the build from thepackage_tokenbuild secret alone.What was not covered is the exclusion this change introduces. The test now writes an
auth.jsoninto the build context before both builds and asserts that the file is absent from the resulting image. Its token is deliberately invalid, which leaves both existing build outcomes unchanged: the no-token build still fails, and the token build still succeeds because Composer re-appliesCOMPOSER_AUTHover any project-levelauth.json. The only condition the new assertion can fail on isauth*no longer being excluded from the build context.That isolation was confirmed by removing the
.dockerignoreentry and re-running the test: both builds behaved exactly as before and only the new assertion failed.Before / After