From 6dce2ebe6f0357bda4aed2567c4ceb1b72edee1b Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Mon, 23 Feb 2026 16:04:08 +0100
Subject: [PATCH] add opt-in skip for missing login credentials

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 __tests__/docker.test.ts | 68 ++++++++++++++++++++++++++++++++++++++--
 src/docker.ts            | 12 +++++++
 2 files changed, 77 insertions(+), 3 deletions(-)

diff --git a/__tests__/docker.test.ts b/__tests__/docker.test.ts
index 99cd6ef..1efcd5b 100644
--- a/__tests__/docker.test.ts
+++ b/__tests__/docker.test.ts
@@ -1,4 +1,4 @@
-import {expect, jest, test} from '@jest/globals';
+import {afterEach, beforeEach, expect, jest, test} from '@jest/globals';
 import * as path from 'path';
 
 import {loginStandard, logout} from '../src/docker';
@@ -7,6 +7,14 @@ import {Docker} from '@docker/actions-toolkit/lib/docker/docker';
 
 process.env['RUNNER_TEMP'] = path.join(__dirname, 'runner');
 
+beforeEach(() => {
+  delete process.env.DOCKER_LOGIN_SKIP_IF_MISSING_CREDS;
+});
+
+afterEach(() => {
+  delete process.env.DOCKER_LOGIN_SKIP_IF_MISSING_CREDS;
+});
+
 test('loginStandard calls exec', async () => {
   // eslint-disable-next-line @typescript-eslint/ban-ts-comment
   // @ts-ignore
@@ -20,7 +28,7 @@ test('loginStandard calls exec', async () => {
 
   const username = 'dbowie';
   const password = 'groundcontrol';
-  const registry = 'https://ghcr.io';
+  const registry = 'ghcr.io';
 
   await loginStandard(registry, username, password);
 
@@ -37,6 +45,60 @@ test('loginStandard calls exec', async () => {
   });
 });
 
+test('loginStandard throws if username and password are missing', async () => {
+  // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+  // @ts-ignore
+  const execSpy = jest.spyOn(Docker, 'getExecOutput');
+  await expect(loginStandard('ghcr.io', '', '')).rejects.toThrow('Username and password required');
+  expect(execSpy).not.toHaveBeenCalled();
+});
+
+test('loginStandard throws if username is missing', async () => {
+  // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+  // @ts-ignore
+  const execSpy = jest.spyOn(Docker, 'getExecOutput');
+  await expect(loginStandard('ghcr.io', '', 'groundcontrol')).rejects.toThrow('Username required');
+  expect(execSpy).not.toHaveBeenCalled();
+});
+
+test('loginStandard throws if password is missing', async () => {
+  // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+  // @ts-ignore
+  const execSpy = jest.spyOn(Docker, 'getExecOutput');
+  await expect(loginStandard('ghcr.io', 'dbowie', '')).rejects.toThrow('Password required');
+  expect(execSpy).not.toHaveBeenCalled();
+});
+
+test('loginStandard skips if both credentials are missing and env opt-in is enabled', async () => {
+  process.env.DOCKER_LOGIN_SKIP_IF_MISSING_CREDS = 'true';
+  // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+  // @ts-ignore
+  const execSpy = jest.spyOn(Docker, 'getExecOutput');
+
+  await expect(loginStandard('ghcr.io', '', '')).resolves.toBeUndefined();
+  expect(execSpy).not.toHaveBeenCalled();
+});
+
+test('loginStandard skips if username is missing and env opt-in is enabled', async () => {
+  process.env.DOCKER_LOGIN_SKIP_IF_MISSING_CREDS = 'true';
+  // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+  // @ts-ignore
+  const execSpy = jest.spyOn(Docker, 'getExecOutput');
+
+  await expect(loginStandard('ghcr.io', '', 'groundcontrol')).resolves.toBeUndefined();
+  expect(execSpy).not.toHaveBeenCalled();
+});
+
+test('loginStandard skips if password is missing and env opt-in is enabled', async () => {
+  process.env.DOCKER_LOGIN_SKIP_IF_MISSING_CREDS = 'true';
+  // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+  // @ts-ignore
+  const execSpy = jest.spyOn(Docker, 'getExecOutput');
+
+  await expect(loginStandard('ghcr.io', 'dbowie', '')).resolves.toBeUndefined();
+  expect(execSpy).not.toHaveBeenCalled();
+});
+
 test('logout calls exec', async () => {
   // eslint-disable-next-line @typescript-eslint/ban-ts-comment
   // @ts-ignore
@@ -48,7 +110,7 @@ test('logout calls exec', async () => {
     };
   });
 
-  const registry = 'https://ghcr.io';
+  const registry = 'ghcr.io';
 
   await logout(registry, '');
 
diff --git a/src/docker.ts b/src/docker.ts
index fcb057b..b1ea949 100644
--- a/src/docker.ts
+++ b/src/docker.ts
@@ -4,6 +4,7 @@ import * as aws from './aws';
 import * as context from './context';
 
 import {Docker} from '@docker/actions-toolkit/lib/docker/docker';
+import {Util} from '@docker/actions-toolkit/lib/util';
 
 export async function login(auth: context.Auth): Promise<void> {
   if (/true/i.test(auth.ecr) || (auth.ecr == 'auto' && aws.isECR(auth.registry))) {
@@ -34,6 +35,10 @@ export async function logout(registry: string, configDir: string): Promise<void>
 }
 
 export async function loginStandard(registry: string, username: string, password: string, scope?: string): Promise<void> {
+  if ((!username || !password) && skipLoginIfMissingCredsEnabled()) {
+    core.info(`Skipping login to ${registry}. Username or password is not set and DOCKER_LOGIN_SKIP_IF_MISSING_CREDS is enabled.`);
+    return;
+  }
   if (!username && !password) {
     throw new Error('Username and password required');
   }
@@ -79,3 +84,10 @@ async function loginExec(registry: string, username: string, password: string, s
     core.info('Login Succeeded!');
   });
 }
+
+function skipLoginIfMissingCredsEnabled(): boolean {
+  if (process.env.DOCKER_LOGIN_SKIP_IF_MISSING_CREDS) {
+    return Util.parseBool(process.env.DOCKER_LOGIN_SKIP_IF_MISSING_CREDS);
+  }
+  return false;
+}