use the registry host for the scoped buildx config dir

__tests__/context.test.ts

@@ -3,7 +3,7 @@ import * as path from 'path';
 
 import {Buildx} from '@docker/actions-toolkit/lib/buildx/buildx.js';
 
-import {getAuthList, getInputs} from '../src/context.js';
+import {getAuthList, getInputs, scopeToConfigDir} from '../src/context.js';
 
 afterEach(() => {
   vi.restoreAllMocks();
@@ -168,3 +168,15 @@ test('getAuthList masks registry-auth password when present', async () => {
 
   expect(stdoutWriteSpy.mock.calls.map(call => call[0]).join('')).toContain('::add-mask::groundcontrol');
 });
+
+// prettier-ignore
+test.each([
+  ['ghcr.io', 'ghcr.io'],
+  ['https://ghcr.io', 'ghcr.io'],
+  ['https://ghcr.io/', 'ghcr.io'],
+  ['http://localhost:5000', 'localhost:5000'],
+  ['https://012345678910.dkr.ecr.eu-west-3.amazonaws.com', '012345678910.dkr.ecr.eu-west-3.amazonaws.com'],
+  ['https://docker.io', 'registry-1.docker.io']
+])('scopeToConfigDir uses the registry host for %s', async (registry, host) => {
+  expect(scopeToConfigDir(registry, 'myorg/myimage@push')).toBe(path.join(Buildx.configDir, 'config', host, 'myorg', 'myimage') + '@push');
+});

__tests__/docker.test.ts

@@ -1,8 +1,12 @@
 import {afterEach, expect, test, vi} from 'vitest';
+import * as path from 'path';
 
+import {Buildx} from '@docker/actions-toolkit/lib/buildx/buildx.js';
 import {Docker} from '@docker/actions-toolkit/lib/docker/docker.js';
 
-import {login, loginStandard, logout} from '../src/docker.js';
+import * as aws from '../src/aws.js';
+import {getAuthList} from '../src/context.js';
+import {login, loginECR, loginStandard, logout} from '../src/docker.js';
 import * as dockerhub from '../src/dockerhub.js';
 
 afterEach(() => {
@@ -92,3 +96,31 @@ test('logout calls exec', async () => {
     ignoreReturnCode: true
   });
 });
+
+test('loginECR writes scoped credentials to the config dir of the registry host', async () => {
+  const execSpy = vi.spyOn(Docker, 'getExecOutput').mockResolvedValue({
+    exitCode: 0,
+    stdout: '',
+    stderr: ''
+  });
+  // ECR returns the proxy endpoint as a URL, e.g. https://012345678910.dkr.ecr.eu-west-3.amazonaws.com
+  vi.spyOn(aws, 'getRegistriesData').mockResolvedValue([
+    {
+      registry: 'https://012345678910.dkr.ecr.eu-west-3.amazonaws.com',
+      username: 'AWS',
+      password: 'world'
+    }
+  ]);
+
+  const registry = '012345678910.dkr.ecr.eu-west-3.amazonaws.com';
+  const scope = 'myapp@push';
+  await loginECR(registry, 'CAFEBABE', 'DEADBEEF', scope);
+
+  const expectedConfigDir = path.join(Buildx.configDir, 'config', registry, 'myapp') + '@push';
+  expect(execSpy).toHaveBeenCalledTimes(1);
+  expect(execSpy.mock.calls[0][1]?.env?.DOCKER_CONFIG).toBe(expectedConfigDir);
+
+  // logout in the post step uses the config dir computed from the inputs
+  const [auth] = getAuthList({registry, username: 'CAFEBABE', password: 'DEADBEEF', scope, ecr: 'auto', logout: true, registryAuth: ''});
+  expect(auth.configDir).toBe(expectedConfigDir);
+});