`credsStore` in docker config causes unit test failures

Start with cmd/crossplane/validate/image_test.go and the TestFindImageTagForVersionConstraint cases, then inspect findImageTagForVersionConstraint in cmd/crossplane/validate/image.go. Run nix run .#test with and without an isolated DOCKER_CONFIG, and check TestKCLBuild and TestGoTemplatingBuild; done means these tests no longer depend on ambient Docker credentials and failures expose the underlying error.

What happened?

nix run .#test fails when running locally in a few tests like TestFindImageTagForVersionConstraint, TestKCLBuild, and TestGoTemplatingBuild for anyone whose ~/.docker/config.json sets a credsStore. CI never hits it, since the runner has no Docker config.

The test app runs with inheritPath = false, so PATH holds Go and nothing else. findImageTagForVersionConstraint calls crane.ListTags, which resolves auth through authn.DefaultKeychain. A configured credsStore sends that to docker-credential-<store>, which isn't on the stripped PATH:

cannot fetch tags for the image 127.0.0.1:62645/ubuntu: error getting credentials - err: exec: "docker-credential-desktop": executable file not found in $PATH, out: ``

The test never surfaces that error. The assertion only reports the empty got, so it reads like the local registry was unreachable rather than a credential lookup that never got that far.

How can we reproduce it?

With "credsStore" set in ~/.docker/config.json, run unit tests with:

nix run .#test

and you'll see failures like:

--- FAIL: TestFindImageTagForVersionConstraint (0.00s)
    --- FAIL: TestFindImageTagForVersionConstraint/Constraint (0.00s)
        image_test.go:120: [Constraint] expected: 127.0.0.1:53321/ubuntu:4.5.6, got:
    --- FAIL: TestFindImageTagForVersionConstraint/ConstraintV (0.00s)
        image_test.go:120: [ConstraintV] expected: 127.0.0.1:53322/ubuntu:4.5.6, got:
    --- FAIL: TestFindImageTagForVersionConstraint/ConstraintPreRelease (0.00s)
        image_test.go:120: [ConstraintPreRelease] expected: 127.0.0.1:53323/ubuntu:4.5.6, got:
    --- FAIL: TestFindImageTagForVersionConstraint/RangedConstraint (0.00s)
        image_test.go:120: [RangedConstraint] expected: 127.0.0.1:53326/ubuntu:4.5.6, got:
    --- FAIL: TestFindImageTagForVersionConstraint/CommaSeparatedRangedConstraint (0.00s)
        image_test.go:120: [CommaSeparatedRangedConstraint] expected: 127.0.0.1:53327/ubuntu:4.5.6, got:
...
--- FAIL: TestKCLBuild (0.06s)
    build_test.go:194: failed to fetch KCL base image: failed to pull image: error getting credentials - err: exec: "docker-credential-desktop": executable file not found in $PATH, out: ``
--- FAIL: TestGoTemplatingBuild (0.06s)
    build_test.go:264: failed to fetch go-templating base image: failed to pull image: error getting credentials - err: exec: "docker-credential-desktop": executable file not found in $PATH, out: ``

Isolating the Docker config is enough to make them pass, which confirms where the failure comes from:

DOCKER_CONFIG=$(mktemp -d) nix run .#test

Possible fix

The test probably shouldn't consult ambient Docker credentials at all. Perhaps t.Setenv("DOCKER_CONFIG", t.TempDir()) at the top of it, along with printing err in the failure message so the next person doesn't have to dig for the cause.