Use Registry Credentials when passed to env

[jurre]

In order to allow us to pass centrally managed registry credentials, this PR implements a basic version that grabs the Base64 encoded credential blob from the environment and passes them to the Proxy.

Right now by default these credentials will not be passed.

[Copilot]

Pull Request Overview

This PR enables injecting centrally managed registry credentials via the GITHUB_REGISTRIES_PROXY environment variable and merges them with credentials fetched from the API.

• Import the new Credential type and default getCredentials() to an empty list.
• Add credentialsFromEnv() to decode, parse, and mask base64-encoded credentials from GITHUB_REGISTRIES_PROXY.
• Update tests to set GITHUB_REGISTRIES_PROXY for the new behavior.

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/main.ts	Imported Credential, updated credential merging logic, and added credentialsFromEnv
tests/main.test.ts	Set GITHUB_REGISTRIES_PROXY in the test setup

Comments suppressed due to low confidence (3)

tests/main.test.ts:45

• Tests currently only set a valid env var; consider adding cases for invalid base64, invalid JSON, and verifying that secrets are masked via core.setSecret.

process.env.GITHUB_REGISTRIES_PROXY = Buffer.from(

src/main.ts:222

• Add a JSDoc comment describing the expected format of GITHUB_REGISTRIES_PROXY (base64-encoded JSON array of Credentials) and the function’s behavior on parse errors.

function credentialsFromEnv(): Credential[] {

src/main.ts:223

• [nitpick] The variable name registriesProxyStr is a bit generic; consider renaming to encodedRegistryCredentials or similar for clarity.

const registriesProxyStr = process.env.GITHUB_REGISTRIES_PROXY

[jakecoffman]

At the rate we're adding ecosystems, some of which overlap (e.g. dotnet_sdk and nuget) I think we should inject all secrets to all job types.

[jakecoffman]

Or the filtering should be done in the UI somehow per-repo.

[jurre]

Seems like it should be fairly straight forward to figure out which ones we need? This is what Secret Scanning does:

https://github.com/github/codeql-action/blob/ac30a39d8c6142a41d62949496fef51750e6f1bf/src/start-proxy.ts#L83-L87

I'm ok punting for now and revisiting though