fix: resolve push auth at repository scope

[WoozyMasta]

Fixes #1008
Related to #1002
Related upstream fix: google/go-containerregistry#2411

Description

Kaniko currently resolves push credentials against the registry host, while pull authentication is resolved against the full repository.

This causes exact repository credentials to be ignored during push and can select the wrong credential when multiple repositories on the same registry use different credentials.

This change:

• resolves push authentication against the destination repository;
• uses the same repository-scoped credential for permission checks and the actual push;
• keeps repository credentials authoritative over host-level fallback;
• adds a minimal compatibility adapter for the current go-containerregistry CheckPushPermission behavior.

The issue was identified while working on #1002, but is independent of path-scoped authentication.

Submitter Checklist

• Adds integration tests if the output changes, or golden tests if the build plan changes.

Reviewer Notes

• The code flow looks good.
• Integration or golden tests added where appropriate.

Release Notes

- Push authentication now respects exact repository credentials instead of resolving credentials only at registry scope.

Summary by CodeRabbit

• Bug Fixes
  • Image pushes now consistently use destination repository credentials for permission checks and the push operation.
  • Repository-specific credentials take precedence over host-level credentials.
  • Credentials configured for sibling repositories are no longer incorrectly used.
  • Authentication resolution errors now provide clearer destination context.

[coderabbitai]

Warning

Review limit reached

@mzihlmann, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 19 minutes

Limit details: You’ve used all 2 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 32fa4155-2b7f-43b0-9734-5f6938148e6e

📥 Commits

Reviewing files that changed from the base of the PR and between 18d981b and 39b7aca.

📒 Files selected for processing (1)

• pkg/executor/push.go

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 27beaef7-4141-48d6-a009-e57e8efa9a35

📥 Commits

Reviewing files that changed from the base of the PR and between c8ed76b and 18d981b.

📒 Files selected for processing (1)

• integration/integration_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

• integration/integration_test.go

Included review availability: Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Push permission checks and image pushes now resolve authentication against the complete destination repository. Integration coverage verifies repository-specific credential precedence and sibling repository isolation.

Changes

Push authentication

Layer / File(s)	Summary
Destination authentication resolution pkg/executor/push.go	Adds helpers that resolve one authenticator against the full destination repository without fallback.
Push flow authentication pkg/executor/push.go	Uses the resolved authenticator for permission checks and image pushes, with destination-specific resolution errors.
Repository-scoped authentication validation integration/integration_test.go	Tests repository credential precedence, sibling repository isolation, TLS image pushes, and push execution.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 18d98

This localized change updates repository-scoped push authentication and adds integration coverage; no actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

• osscontainertools/kaniko#1002: Extends path-scoped authentication to push operations.
• osscontainertools/kaniko#1013: Modifies destination-repository authentication during push authorization.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The implementation satisfies #1008 by using destination-repository credentials consistently for permission checks and pushes.
Out of Scope Changes check	✅ Passed	The code and integration test changes directly support repository-scoped push authentication and contain no unrelated changes.
Description check	✅ Passed	The description covers the required sections, explains the repository-scoped authentication change, references related issues, and documents integration testing and release notes.
Title check	✅ Passed	The title clearly and concisely identifies the main change: resolving push authentication at repository scope.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mzihlmann]

this enabled integration testing of repository auth #1016 will integrate it here now

[codecov]

Codecov Report

❌ Patch coverage is 57.14286% with 3 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pkg/executor/push.go	57.14%	1 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!