Add Docker output format to auth token

[yolocs]

🥞 Stacked PR (generated by git ns)

Use this link to review incremental changes.

• dar-configure-docker [Files changed]
  • dar-configure-docker-setup [Files changed]

---

Changes

Adds the hidden databricks auth token --format=docker output mode used by the Databricks Docker credential helper.

The command accepts no positional argument and rejects --profile, --host, --account-id, and --workspace-id. It reads a Docker server address from stdin, normalizes and validates a registry host of the form <workspace-id>.container.<region>.<databricks-dns-zone>, and finds the matching workspace-scoped U2M profile. Profile selection uses both workspace_id and the workspace DNS zone so identical workspace IDs in different Databricks environments remain distinct.

On success, stdout contains Docker's get response:

{"Username":"oauthtoken","Secret":"<valid workspace OAuth token>"}

The OAuth token is returned unchanged. This mode does not implement credential-helper operation dispatch, store, or erase; the setup PR adds a shim that invokes it only for get.

Why

Docker provides a credential helper with only the registry address, while Databricks OAuth tokens are short-lived and profile-specific. Resolving the registry address back to a workspace profile lets the CLI load and refresh tokens through the existing auth token path for each Docker request without persisting a registry credential.

Tests

• go test ./libs/dockercredentials ./cmd/auth -count=1
• Registry parsing and validation for AWS, Azure, GCP, and environment-specific DNS zones
• Profile selection, duplicate and cross-environment workspace IDs, unsupported auth types, invalid input, rejected selectors, and exact Docker JSON output

This PR was written by Codex.

[renaudhartert-db]

Thanks @yolocs!

It is big PR with a lot of implicit decisions and behaviors. It would help if we could get more documentation about the intended behavior and usage. Could you maybe rewrite your PR description as if it were documentation intended for the user?

For example, the PR adds a new token format but this is documented nowhere currently. The only way to understand the intended usage is to reverse-guess it from the code.

Left a first round of quick feedback.

[github-actions]

An authorized user can trigger integration tests manually by following the instructions below:

Trigger:
go/deco-tests-run/cli

Inputs:

• PR number: 6194
• Commit SHA: 3ad7d11b87bbf594d726ff5bbca38a689cd40379

Checks will be approved automatically on success.