Add early return in _resolve_basic_credentials when password is None
to prevent TypeError on base64.b64decode. Move DockerHubAdapter import
from local scope to top-level in image_provider.py per PEP 8. Add
one-time 401 retry with token refresh in _authed_request to handle
per-repository-scoped bearer tokens on strict OCI registries.
Remove unused detect_registry_type() function and _ECR_PATTERN constant
from factory.py, along with their corresponding tests. Move requests
import behind TYPE_CHECKING guard in oci_adapter.py and
dockerhub_adapter.py since it is only used for type annotations.
- Fix shared dict mutation in ImageBaseException (thread-safety)
- Handle unexpected status codes in OCI adapter auth flow
- Force TLS verification for Docker Hub endpoints
- Add credential-safe __repr__ to RegistryAdapter
- Rename _next_page_url override to _next_tag_page_url in DockerHubAdapter
- Distinguish rate-limit from connection errors in retry logic
- Add type hints to all public adapter methods
- Remove unused imports in test files (flake8)
Update test patches from adapter-level to base-level module paths since
requests and time are now imported in base.py. Consolidate separate
requests.post/requests.get patches into requests.request since all HTTP
calls now go through _request_with_retry.
- Add test_registry_list_without_registry_fails: validates that
--registry-list without --registry returns an error
- Add test_registry_list_with_registry_passes: validates the happy path
- Add clarifying comment in factory.py about ECR using OCI adapter
- Move _request_with_retry, _next_page_url, _MAX_RETRIES, _BACKOFF_BASE
from OciRegistryAdapter and DockerHubAdapter into RegistryAdapter base
- Add context_label parameter to _request_with_retry for contextual
error/warning messages (defaults to self.registry_url)
- Route _hub_login and _get_registry_token through retry logic
- Change 404 exception in _check_hub_response from ImageRegistryAuthError
to ImageRegistryCatalogError (missing namespace is not an auth failure)
- Remove redundant time, requests imports from leaf adapters
- Use public /v2/repositories/{ns}/ endpoint when unauthenticated
- Fall back to namespace API when JWT is available for private repos
- Add test for unauthenticated public namespace listing
Add Registry Scan Mode section covering --registry, --image-filter,
--tag-filter, --max-images, --registry-insecure, and the new
--registry-list flag for image discovery.
Add --registry-list flag that enumerates registry repositories and tags,
then prints a structured listing and exits without scanning. This helps
users discover available images before building --image-filter or
--tag-filter regexes.
Add pluggable registry adapter pattern for enumerating and scanning all
container images in a private registry. Supports:
- Generic OCI registries (Harbor, GitLab, JFrog) via /v2/_catalog
- Docker Hub via Hub REST API with namespace-based enumeration
- AWS ECR via standard OCI endpoints with ECR auth token
New CLI flags: --registry, --image-filter, --tag-filter, --max-images,
--registry-insecure
The pre-commit hook stash/restore cycle during the first merge caused
some auto-merged changes to be excluded from the merge commits. This
commit includes the remaining changes: error code renumbering (9000→11000
range), input validation, image config scanners, and docs branch updates.
Andoni A.