[breken-ai]

registry-auth is parsed as YAML. An unquoted ecr: false is therefore the boolean false, and getAuthList maps it with auth.ecr || 'auto', so it turns into auto. For an ECR host, auto means the action uses the AWS SDK path, loginECR. That path treats the username and password as an AWS access key pair. A user who set ecr: false so that a token they got another way is used with a plain docker login gets an AWS SDK auth failure instead:

- uses: docker/login-action@v4
  with:
    registry-auth: |
      - registry: 012345678910.dkr.ecr.eu-west-3.amazonaws.com
        username: AWS
        password: ${{ steps.ecr.outputs.token }}
        ecr: false

Only the quoted ecr: "false" works today. The ecr input does not have this problem, because it is always a string.

Fix: convert the YAML value to a string. It falls back to auto only when it is missing or empty: String(auth.ecr ?? '') || 'auto'. Unquoted true now becomes the string 'true'. Before, it was the boolean true, which /true/i.test already accepted, so its behavior does not change.

Tests

• getAuthList keeps registry-auth ecr: %s (context.test.ts): covers false, "false", true, auto and "".
• login uses standard login for an ECR registry with registry-auth ecr: false (docker.test.ts): checks that getRegistriesData is not called and that docker login --username AWS <registry> runs.
• On master, false gives Received: "auto" and the login goes through the AWS SDK. With the fix, all 85 tests pass.
• yarn lint and tsc --noEmit pass. dist/ is rebuilt with yarn build.

AI disclosure: I found and fixed this with help from an AI assistant (Claude). I checked the change and the tests myself.

🤖 Generated with Claude Code