Configure Docker authentication for Artifact Registry

[yolocs]

🥞 Stacked PR (generated by git ns)

Use this link to review incremental changes.

• dar-configure-docker [Files changed]
  • dar-configure-docker-setup [Files changed]

---

Changes

Adds databricks auth configure-docker [PROFILE] --region REGION and the docker-credential-databricks shim.

The command selects a workspace profile through [PROFILE], --profile, or the normal default and interactive profile precedence. It rejects the inherited --host, --account-id, and --workspace-id selectors because the selected profile is the durable mapping from the registry host back to authentication. The profile must be a workspace-scoped U2M login created by databricks auth login.

If the profile has no workspace_id, the command resolves and saves one without allowing ambient workspace selectors or the CLI-only none sentinel to become SDK routing headers. --region is required and must equal the workspace home region because the CLI cannot currently infer that value reliably.

The registry hostname is generated as <workspace-id>.container.<region>.<databricks-dns-zone>. The DNS zone comes from the workspace host, preserving AWS, Azure, GCP, and non-production environments. The command then:

• merges credHelpers[registry-host] = "databricks" into the Docker config without changing unrelated entries;
• installs the helper beside the running Databricks CLI so the same PATH entry can discover it;
• writes a Unix wrapper or, on Windows, a copy of the CLI that dispatches by executable name; and
• rejects every credential-helper operation except get.

On success, the command prints the registry host, Docker config path, and helper path. Repeated setup is idempotent. It warns when another helper shadows the installed path.

Why

Docker must request a fresh workspace OAuth token for each Artifact Registry operation rather than storing a short-lived token in ~/.docker/config.json. This setup connects Docker's host-based helper lookup to the --format=docker token contract in the parent PR while preserving the user's existing Docker configuration.

Tests

• go test ./libs/dockercredentials ./cmd/auth ./cmd/root -count=1
• go test ./acceptance -run '^TestAccept/cmd/auth/configure-docker-help$' -count=1
• Docker config creation, merge, replacement, owner-only Unix and Windows permissions, long-path handling, and idempotency
• Unix wrapper execution and quoting, Windows copied-binary dispatch, PATH/PATHEXT resolution, replacement without truncating an existing helper, and unsupported operations
• Registry construction and profile handling across clouds and environments
• Profile-only selector validation and a real SDK request asserting that no invalid workspace routing header is sent
• Manual: databricks auth login TEST_WS_HOST
• Manual: databricks auth configure-docker --profile test --region <home-region> updates ~/.docker/config.json
• Manual: docker push <test-ws-id>.container.<home-region>.dev.databricks.com/cat/sch/img:tag succeeds

This PR was written by Codex.

[github-actions]

An authorized user can trigger integration tests manually by following the instructions below:

Trigger:
go/deco-tests-run/cli

Inputs:

• PR number: 6336
• Commit SHA: 2f38bceeee1b310bb78bcbfc3d8a6cd8edd53e91

Checks will be approved automatically on success.