feat(cli): support file or stdin input for registry credentials

[bodapatisaikrishna]

TL;DR

Adds --secret-file to nvcf-cli registry-credential add (accepting a file path or - for stdin) so sensitive credentials don't have to be passed directly in process arguments.

Additional Details

Reads base64 credentials from a file or stdin, trims trailing line endings while preserving formatting, validates base64 format, and rejects conflicting authentication flags.

For the Reviewer

The main logic is in src/clis/nvcf-cli/cmd/registry.go and accompanying unit tests in registry_test.go.

For QA

Ran unit tests covering file/stdin reading, line ending trimming, base64 validation, and mutual exclusivity via go test ./cmd.

Issues

Closes #2028

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for Developer Certificate of Origin (DCO) compliance.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

Summary by CodeRabbit

• New Features
  • Registry credential setup now accepts a base64-encoded secret from a file or standard input, alongside inline secrets and username/password credentials.
  • Secret input is checked for valid, nonempty base64, with clear errors for invalid input, unreadable sources, or conflicting credential options. One trailing line ending is removed from file or standard-input secrets before validation.
• Documentation
  • Added an example showing how to provide registry credentials using a secret file, standard input, and the CONTAINER artifact type.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: NVIDIA/nvcf/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: caa90247-b7b8-4628-8380-b103095da2aa

📥 Commits

Reviewing files that changed from the base of the PR and between 6a49c02 and 112dd4d.

📒 Files selected for processing (2)

• src/clis/nvcf-cli/cmd/registry.go
• src/clis/nvcf-cli/cmd/registry_test.go

🚧 Files skipped from review as they are similar to previous changes (1)

• src/clis/nvcf-cli/cmd/registry.go

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The registry credential add command now accepts base64 secrets from a file or standard input. It validates credential sources, rejects conflicting methods, and documents the new option.

Changes

Registry Credential Input

Layer / File(s)	Summary
Secret-file option and examples src/clis/nvcf-cli/cmd/registry.go, src/clis/nvcf-cli/USAGE-GUIDE.md	The command help and flag describe --secret-file, including - for standard input. Command examples and the usage guide show file and standard-input input.
Credential resolution and command integration src/clis/nvcf-cli/cmd/registry.go, src/clis/nvcf-cli/cmd/registry_test.go	The add command resolves inline secrets, file or standard-input secrets, and username/password credentials. It trims one trailing line ending for file and standard-input input, validates base64, and rejects conflicts and invalid input. Tests cover supported and rejected cases.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 112dd

The new file and stdin credential paths appear correctly connected. No actionable merge-blocking risk remains after normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title follows Conventional Commits format with the required scoped feat prefix. It accurately describes the main feature: file or stdin input for registry credentials.
Linked Issues check	✅ Passed	Issue [#2028] requires file or stdin input, conflicting authentication checks, one trailing line-ending trim, base64 validation, unit tests, and help examples. The PR adds --secret-file, supports `-…
Out of Scope Changes check	✅ Passed	The changes remain within issue [#2028]. The implementation, tests, help text, and usage-guide example support the requested non-argument credential input method or preserve related authentication beh…
Docstring Coverage	✅ Passed	Docstring coverage is 85.71% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 2 files.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}