From b4bb2a4ec0ef4819f4389c2089c7c1472ac97313 Mon Sep 17 00:00:00 2001
From: breken-ai <312387581+breken-ai@users.noreply.github.com>
Date: Fri, 25 Sep 2026 18:51:56 -0700
Subject: [PATCH] keep registry-auth ecr: false instead of falling back to auto

registry-auth is parsed as YAML, so `ecr: false` (unquoted) is the
boolean false, and `auth.ecr || 'auto'` turned it into 'auto'. For an
ECR registry this runs the AWS SDK login with the given username and
password as AWS access keys, instead of the plain docker login the user
asked for. Only the quoted string "false" worked.

Convert the value to a string and only default to 'auto' when it is
missing or empty.

Assisted-By: Claude
Signed-off-by: breken-ai <312387581+breken-ai@users.noreply.github.com>
---
 __tests__/context.test.ts | 20 ++++++++++++++++++++
 __tests__/docker.test.ts  | 29 +++++++++++++++++++++++++++++
 src/context.ts            |  3 ++-
 3 files changed, 51 insertions(+), 1 deletion(-)

diff --git a/__tests__/context.test.ts b/__tests__/context.test.ts
index da67084..f91af93 100644
--- a/__tests__/context.test.ts
+++ b/__tests__/context.test.ts
@@ -168,3 +168,23 @@ test('getAuthList masks registry-auth password when present', async () => {
 
   expect(stdoutWriteSpy.mock.calls.map(call => call[0]).join('')).toContain('::add-mask::groundcontrol');
 });
+
+// prettier-ignore
+test.each([
+  ['false', 'false'],
+  ['"false"', 'false'],
+  ['true', 'true'],
+  ['auto', 'auto'],
+  ['""', 'auto']
+])('getAuthList keeps registry-auth ecr: %s', async (ecr, expected) => {
+  const [auth] = getAuthList({
+    registry: '',
+    username: '',
+    password: '',
+    scope: '',
+    ecr: '',
+    logout: true,
+    registryAuth: `- registry: 012345678910.dkr.ecr.eu-west-3.amazonaws.com\n  username: AWS\n  password: token\n  ecr: ${ecr}\n`
+  });
+  expect(auth.ecr).toBe(expected);
+});
diff --git a/__tests__/docker.test.ts b/__tests__/docker.test.ts
index 4ad2d90..8df7e77 100644
--- a/__tests__/docker.test.ts
+++ b/__tests__/docker.test.ts
@@ -2,6 +2,8 @@ import {afterEach, expect, test, vi} from 'vitest';
 
 import {Docker} from '@docker/actions-toolkit/lib/docker/docker.js';
 
+import * as aws from '../src/aws.js';
+import {getAuthList} from '../src/context.js';
 import {login, loginStandard, logout} from '../src/docker.js';
 import * as dockerhub from '../src/dockerhub.js';
 
@@ -92,3 +94,30 @@ test('logout calls exec', async () => {
     ignoreReturnCode: true
   });
 });
+
+test('login uses standard login for an ECR registry with registry-auth ecr: false', async () => {
+  const execSpy = vi.spyOn(Docker, 'getExecOutput').mockResolvedValue({
+    exitCode: 0,
+    stdout: '',
+    stderr: ''
+  });
+  const ecrSpy = vi.spyOn(aws, 'getRegistriesData').mockRejectedValue(new Error('AWS SDK called'));
+
+  const [auth] = getAuthList({
+    registry: '',
+    username: '',
+    password: '',
+    scope: '',
+    ecr: '',
+    logout: true,
+    registryAuth: '- registry: 012345678910.dkr.ecr.eu-west-3.amazonaws.com\n  username: AWS\n  password: token\n  ecr: false\n'
+  });
+  await login(auth);
+
+  expect(ecrSpy).not.toHaveBeenCalled();
+  expect(execSpy).toHaveBeenCalledWith(['login', '--password-stdin', '--username', 'AWS', '012345678910.dkr.ecr.eu-west-3.amazonaws.com'], {
+    input: Buffer.from('token'),
+    silent: true,
+    ignoreReturnCode: true
+  });
+});
diff --git a/src/context.ts b/src/context.ts
index ba09b8b..e03973b 100644
--- a/src/context.ts
+++ b/src/context.ts
@@ -62,7 +62,8 @@ export function getAuthList(inputs: Inputs): Array<Auth> {
         username: auth.username,
         password: auth.password,
         scope: auth.scope,
-        ecr: auth.ecr || 'auto',
+        // YAML parses an unquoted `ecr: false` as a boolean, keep it instead of falling back to auto
+        ecr: String(auth.ecr ?? '') || 'auto',
         configDir: scopeToConfigDir(registry, auth.scope)
       };
     });