From 53732034f949b7f5a840d900a4a6c86f205926a0 Mon Sep 17 00:00:00 2001 From: Xiaoyi Shi Date: Wed, 13 May 2026 00:34:10 -0700 Subject: [PATCH] fix(authn): run credential helper from the workspace root MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Without `working_directory`, the credential helper subprocess inherits whatever CWD Bazel picks (typically an internal output-base path). Any helper that reads workspace-relative config — `.aws/config`, project-local credential files, custom helpers that resolve paths off the workspace root — currently fails to find them. Fixes #895. --- oci/private/authn.bzl | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/oci/private/authn.bzl b/oci/private/authn.bzl index bd590d89..6ec4d0db 100644 --- a/oci/private/authn.bzl +++ b/oci/private/authn.bzl @@ -127,7 +127,10 @@ echo %1 | docker-credential-{} get """.format(helper_name), #!/usr/bin/env bash exec "docker-credential-{}" get <<< "$1" """.format(helper_name), ) - result = rctx.execute([rctx.path(executable), raw_host]) + result = rctx.execute( + [rctx.path(executable), raw_host], + working_directory = str(rctx.workspace_root), + ) if result.return_code: if not allow_fail: fail("credential helper failed: \nSTDOUT:\n{}\nSTDERR:\n{}".format(result.stdout, result.stderr))