keep registry-auth ecr: false instead of falling back to auto

registry-auth is parsed as YAML, so `ecr: false` (unquoted) is the
boolean false, and `auth.ecr || 'auto'` turned it into 'auto'. For an
ECR registry this runs the AWS SDK login with the given username and
password as AWS access keys, instead of the plain docker login the user
asked for. Only the quoted string "false" worked.

Convert the value to a string and only default to 'auto' when it is
missing or empty.

Assisted-By: Claude
Signed-off-by: breken-ai <312387581+breken-ai@users.noreply.github.com>

__tests__/context.test.ts

@@ -168,3 +168,23 @@ test('getAuthList masks registry-auth password when present', async () => {
 
   expect(stdoutWriteSpy.mock.calls.map(call => call[0]).join('')).toContain('::add-mask::groundcontrol');
 });
+
+// prettier-ignore
+test.each([
+  ['false', 'false'],
+  ['"false"', 'false'],
+  ['true', 'true'],
+  ['auto', 'auto'],
+  ['""', 'auto']
+])('getAuthList keeps registry-auth ecr: %s', async (ecr, expected) => {
+  const [auth] = getAuthList({
+    registry: '',
+    username: '',
+    password: '',
+    scope: '',
+    ecr: '',
+    logout: true,
+    registryAuth: `- registry: 012345678910.dkr.ecr.eu-west-3.amazonaws.com\n  username: AWS\n  password: token\n  ecr: ${ecr}\n`
+  });
+  expect(auth.ecr).toBe(expected);
+});

__tests__/docker.test.ts

@@ -2,6 +2,8 @@ import {afterEach, expect, test, vi} from 'vitest';
 
 import {Docker} from '@docker/actions-toolkit/lib/docker/docker.js';
 
+import * as aws from '../src/aws.js';
+import {getAuthList} from '../src/context.js';
 import {login, loginStandard, logout} from '../src/docker.js';
 import * as dockerhub from '../src/dockerhub.js';
 
@@ -92,3 +94,30 @@ test('logout calls exec', async () => {
     ignoreReturnCode: true
   });
 });
+
+test('login uses standard login for an ECR registry with registry-auth ecr: false', async () => {
+  const execSpy = vi.spyOn(Docker, 'getExecOutput').mockResolvedValue({
+    exitCode: 0,
+    stdout: '',
+    stderr: ''
+  });
+  const ecrSpy = vi.spyOn(aws, 'getRegistriesData').mockRejectedValue(new Error('AWS SDK called'));
+
+  const [auth] = getAuthList({
+    registry: '',
+    username: '',
+    password: '',
+    scope: '',
+    ecr: '',
+    logout: true,
+    registryAuth: '- registry: 012345678910.dkr.ecr.eu-west-3.amazonaws.com\n  username: AWS\n  password: token\n  ecr: false\n'
+  });
+  await login(auth);
+
+  expect(ecrSpy).not.toHaveBeenCalled();
+  expect(execSpy).toHaveBeenCalledWith(['login', '--password-stdin', '--username', 'AWS', '012345678910.dkr.ecr.eu-west-3.amazonaws.com'], {
+    input: Buffer.from('token'),
+    silent: true,
+    ignoreReturnCode: true
+  });
+});

src/context.ts

@@ -62,7 +62,8 @@ export function getAuthList(inputs: Inputs): Array<Auth> {
         username: auth.username,
         password: auth.password,
         scope: auth.scope,
-        ecr: auth.ecr || 'auto',
+        // YAML parses an unquoted `ecr: false` as a boolean, keep it instead of falling back to auto
+        ecr: String(auth.ecr ?? '') || 'auto',
         configDir: scopeToConfigDir(registry, auth.scope)
       };
     });