Skip network and proxy creation when no credentials are present #534

Copilot · 2025-11-06T16:37:06Z

Summary

Successfully implemented the optimization to skip creating Docker networks and starting the proxy container when there are no credentials to protect.

Changes Made

Technical Details

Modified Files

internal/infra/run.go:
- Added hasCredentials check to determine if proxy should be created
- Added needsNetwork check for both credentials and case-insensitive filesystem
- Networks are created when either credentials exist OR case-insensitive filesystem is needed
- Proxy is only created when credentials exist
- OpenTelemetry collector requires credentials (depends on proxy)
internal/infra/updater.go:
- Modified NewUpdater to handle nil network and proxy parameters
- Updated putUpdaterInputs to skip certificate copy when no proxy exists
- Made network configuration conditional on network availability
internal/infra/run_test.go:
- Added unit tests to verify credential checking logic
- Tests cover nil, empty, and populated credential scenarios
testdata/scripts/proxy.txt:
- Updated proxy integration test to provide credentials via job file
- Added new test case to verify proxy is NOT started when credentials are absent
- Ensures backward compatibility for tests that expect proxy behavior
testdata/scripts/pypi.txt:
- Updated to use job file with credentials
- Ensures proxy runs to generate and install certificate for HTTPS verification

Benefits

Performance: Avoids unnecessary proxy container creation when credentials aren't needed
Testing: Enables testing updater behavior in isolation without credential infrastructure
Compatibility: Networks still created for case-insensitive filesystem support
Production Safety: No impact on production, as credentials are always present there

Test Results

✅ SMB mount test passes (case-insensitive filesystem works)
✅ Proxy tests pass (with and without credentials)
✅ PyPI test updated to work with conditional proxy
✅ All unit tests pass
✅ All linting checks pass (gofmt, go vet)
✅ CodeQL security scan: 0 vulnerabilities

Original prompt

Please make a change in the running of the containers. If there are no credentials, don't create a network and don't start the Proxy. The only purpose of the Proxy (and thus network) is to keep the credentials from the Updater container. If there are no credentials, then there's no reason to do that work.

This will be helpful in testing Updater behavior where we don't care about credentials. Otherwise it will never happen in Production.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Co-authored-by: jakecoffman <[email protected]>

…ario Co-authored-by: jakecoffman <[email protected]>

Co-authored-by: jakecoffman <[email protected]>

jakecoffman · 2025-11-06T17:16:38Z

@copilot fix the CI errors

                cli | 2025/11/06 17:09:38 Preparing case insensitive filesystem
            panic: runtime error: invalid memory address or nil pointer dereference
            [signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0x78bd04]
            
            goroutine 1 [running]:
            github.com/dependabot/cli/internal/infra.createStorageVolumes(0xc000294488, {0x9ca528, 0xc0000ea8c0}, 0xc00024e000, 0x0, {0x9223eb, 0x25})
            	/home/runner/work/cli/cli/internal/infra/updater.go:166 +0x184
            github.com/dependabot/cli/internal/infra.NewUpdater({0x9ca528, 0xc0000ea8c0}, 0xc00024e000, 0x0, 0xc00014b710, 0x0, 0x0)
            	/home/runner/work/cli/cli/internal/infra/updater.go:105 +0x50b
            github.com/dependabot/cli/internal/infra.runContainers({_, _}, {{0x0, 0x0}, 0xc0001e4000, {0x0, 0x0, 0x0}, {0x0, 0x0}, ...})
            	/home/runner/work/cli/cli/internal/infra/run.go:444 +0x8d6
            github.com/dependabot/cli/internal/infra.Run({{0x0, 0x0}, 0xc0001e4000, {0x0, 0x0, 0x0}, {0x0, 0x0}, {0xcefbc0, 0x0, ...}, ...})
            	/home/runner/work/cli/cli/internal/infra/run.go:156 +0x4c8
            github.com/dependabot/cli/cmd/dependabot/internal/cmd.NewUpdateCommand.func1(0xc0000e8f00?, {0x90ec47?, 0x4?, 0x90ec4b?})
            	/home/runner/work/cli/cli/cmd/dependabot/internal/cmd/update.go:87 +0x445
            github.com/spf13/cobra.(*Command).execute(0xc0001c8608, {0xc0001da640, 0x4, 0x4})
            	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1015 +0xa94
            github.com/spf13/cobra.(*Command).ExecuteC(0xcc60c0)
            	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1148 +0x40c
            github.com/spf13/cobra.(*Command).Execute(...)
            	/home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1071
            github.com/dependabot/cli/cmd/dependabot/internal/cmd.Execute()
            	/home/runner/work/cli/cli/cmd/dependabot/internal/cmd/root.go:51 +0x1a
            main.main()
            	/home/runner/work/cli/cli/cmd/dependabot/dependabot.go:8 +0xf

Co-authored-by: jakecoffman <[email protected]>

Copilot · 2025-11-06T17:21:59Z

@copilot fix the CI errors

...

Fixed in commit 001ef59. The issue was that case-insensitive filesystem support requires networks to be created even when credentials are absent. Updated the logic to create networks when either credentials exist OR case-insensitive filesystem is needed, while the proxy is only created when credentials exist.

jakecoffman · 2025-11-06T19:18:46Z

@copilot Fix these tests as well:

--- FAIL: TestDependabot (0.65s)
    --- FAIL: TestDependabot/pypi (30.62s)
        scripttest.go:204: 2025-11-06T17:26:01Z
        scripttest.go:206: $WORK=/tmp/TestDependabotpypi4235719308/001
        scripttest.go:212: 
            # this test verifies the certificate generated allows us to connect to pypi.org (30.618s)
            > exec docker build -qt pypi-updater .
            [stdout]
            sha256:ccbf5129822d900928d0964ce6f74020c2472aeb394962a78f13389c03e51c2e
            > dependabot update go_modules dependabot/cli --updater-image pypi-updater
            [stderr]
                cli | 2025/11/06 17:26:31 Using hostname: github.com api endpoint: https://api.github.com/
            updater | Updating certificates in /etc/ssl/certs...
            updater | 0 added, 0 removed; done.
            updater | Running hooks in /etc/ca-certificates/update.d...
            updater | done.
            updater | Python 3.13.9
            updater | Python 3.13.9
            > stderr '200 [https://pypi.org:443/](https://pypi.org/)'
        scripttest.go:212: FAIL: ../../testdata/scripts/pypi.txt:5: stderr '200 [https://pypi.org:443/](https://pypi.org/)': no match for `(?m)200 [https://pypi.org:443/`](https://pypi.org/%60) in stderr
--- FAIL: TestDependabot (0.54s)
    --- FAIL: TestDependabot/pypi (2.13s)
        scripttest.go:204: 2025-11-06T17:26:32Z
        scripttest.go:206: $WORK=/tmp/TestDependabotpypi1395454129/001
        scripttest.go:212: 
            # this test verifies the certificate generated allows us to connect to pypi.org (2.132s)
            > exec docker build -qt pypi-updater .
            [stdout]
            sha256:ccbf5129822d900928d0964ce6f74020c2472aeb394962a78f13389c03e51c2e
            > dependabot update go_modules dependabot/cli --updater-image pypi-updater
            [stderr]
                cli | 2025/11/06 17:26:33 Using hostname: github.com api endpoint: https://api.github.com/
            updater | Updating certificates in /etc/ssl/certs...
            updater | 0 added, 0 removed; done.
            updater | Running hooks in /etc/ca-certificates/update.d...
            updater | done.
            updater | Python 3.13.9
            updater | Python 3.13.9
            > stderr '200 [https://pypi.org:443/](https://pypi.org/)'
        scripttest.go:212: FAIL: ../../testdata/scripts/pypi.txt:5: stderr '200 [https://pypi.org:443/](https://pypi.org/)': no match for `(?m)200 [https://pypi.org:443/`](https://pypi.org/%60) in stderr
FAIL

I think the issue here is we are expecting to see certain output from the Proxy, but we aren't running the proxy since there are no credentials. Is there another way to assert? Or can we add an unrelated credential to the test so the Proxy starts up?

Co-authored-by: jakecoffman <[email protected]>

Copilot · 2025-11-06T19:24:21Z

@copilot Fix these tests as well:

...

Fixed in commit d4a7a34. Added credentials to the pypi test via a job file. The test verifies that the proxy's certificate allows HTTPS connections to pypi.org, so it needs the proxy to run. This matches the approach used in the proxy test.

jakecoffman · 2025-12-05T14:41:33Z

Will revisit soon, still think this is a good idea but things are getting messy.

Initial plan

39166dd

Copilot AI assigned Copilot and jakecoffman Nov 6, 2025

Copilot started work on behalf of jakecoffman November 6, 2025 16:37 View session

Copilot AI and others added 3 commits November 6, 2025 16:47

Add conditional network and proxy creation based on credentials

b2f65ba

Co-authored-by: jakecoffman <[email protected]>

Update proxy test to provide credentials and test no-credentials scen…

307eb00

…ario Co-authored-by: jakecoffman <[email protected]>

Fix OpenTelemetry collector to only run when credentials are present

fd40805

Co-authored-by: jakecoffman <[email protected]>

Copilot AI changed the title ~~[WIP] Add condition to handle absence of credentials for container network~~ Skip network and proxy creation when no credentials are present Nov 6, 2025

Copilot AI requested a review from jakecoffman November 6, 2025 16:59

Copilot finished work on behalf of jakecoffman November 6, 2025 16:59

Copilot started work on behalf of jakecoffman November 6, 2025 17:17 View session

Fix network creation for case-insensitive filesystem without credentials

001ef59

Co-authored-by: jakecoffman <[email protected]>

Copilot finished work on behalf of jakecoffman November 6, 2025 17:23

Copilot started work on behalf of jakecoffman November 6, 2025 19:19 View session

Fix pypi test to include credentials for proxy certificate verification

d4a7a34

Co-authored-by: jakecoffman <[email protected]>

Copilot finished work on behalf of jakecoffman November 6, 2025 19:25

jakecoffman closed this Dec 5, 2025

jakecoffman deleted the copilot/conditional-network-start branch December 5, 2025 14:41

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Skip network and proxy creation when no credentials are present #534

Skip network and proxy creation when no credentials are present #534

Uh oh!

Copilot AI commented Nov 6, 2025 •

edited

Loading

Uh oh!

jakecoffman commented Nov 6, 2025

Uh oh!

Copilot AI commented Nov 6, 2025

Uh oh!

jakecoffman commented Nov 6, 2025

Uh oh!

Copilot AI commented Nov 6, 2025

Uh oh!

jakecoffman commented Dec 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Skip network and proxy creation when no credentials are present #534

Skip network and proxy creation when no credentials are present #534

Uh oh!

Conversation

Copilot AI commented Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes Made

Technical Details

Modified Files

Benefits

Test Results

Uh oh!

jakecoffman commented Nov 6, 2025

Uh oh!

Copilot AI commented Nov 6, 2025

Uh oh!

jakecoffman commented Nov 6, 2025

Uh oh!

Copilot AI commented Nov 6, 2025

Uh oh!

jakecoffman commented Dec 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Nov 6, 2025 •

edited

Loading