Add OpenTofu registry handler#115
Conversation
dependabot-core's OpenTofu ecosystem accepts credentials with type `opentofu_registry`, but the proxy had no matching handler to credential-stuff requests. Without it, requests against private OpenTofu registries reach the upstream anonymously and fail with authentication errors. Add an `OpenTofuRegistryHandler` modeled on the Terraform handler (same wire protocol — Terraform Module Registry HTTP API), and register it after the Terraform handler in the proxy chain.
There was a problem hiding this comment.
Pull request overview
Adds first-class proxy support for Dependabot’s opentofu_registry credential type by introducing a dedicated OpenTofu registry handler (mirroring the existing Terraform registry handler) and wiring it into the proxy request pipeline, with accompanying tests to validate matching and precedence behavior.
Changes:
- Added
OpenTofuRegistryHandlerto injectAuthorization: Bearer <token>for OpenTofu registry requests, supporting both host-based and URL-prefix matching plus OIDC auth. - Registered the new handler in
proxy.goimmediately after the Terraform registry handler. - Added comprehensive unit tests covering host/url matching, path-boundary behavior, and credential filtering.
Show a summary per file
| File | Description |
|---|---|
| proxy.go | Registers the OpenTofu registry request handler in the proxy chain. |
| internal/handlers/opentofu_registry.go | Implements OpenTofu registry auth injection (static + OIDC), modeled on Terraform registry behavior. |
| internal/handlers/opentofu_registry_test.go | Verifies authorization injection, URL/host matching, and path-boundary credential selection. |
Copilot's findings
- Files reviewed: 3/3 changed files
- Comments generated: 0
|
Required follow‑up work
|
Summary
type: opentofu_registry, but the proxy had no matching handler. Requests against private OpenTofu registries reached the upstream anonymously and failed authentication.OpenTofuRegistryHandlerininternal/handlers/opentofu_registry.gomodeled on the existing Terraform handler. The wire protocol is identical (Terraform Module Registry HTTP API), so the logic is the same — only the credential-type filter, log message, and OIDC label are renamed.proxy.goafter the Terraform handler.