test(Docker): cover getDockerCredentials() paths

[Dave Shoup (shouples)]

Summary of Changes

getDockerCredentials() (which reads the local Docker credential helper so the extension can authenticate to a private registry) shipped in #1940 without unit tests, because it called execSync imported straight from child_process and Sinon can only stub module exports. This PR closes that gap.

• Add a thin, stubbable execSync wrapper to src/utils/fsWrappers.ts (the same module getDockerCredentials() already imports readFileSync from) and route the credential lookup through it.
• Add a getDockerCredentials() test suite covering all eight branches: cache hit, missing/unreadable Docker config, no credsStore configured, the happy path (query + validate + cache), the docker-credential- prefix dedup, command failure, invalid credentials, and non-JSON output.
• Harden one path found while writing the tests: JSON.parse() of the helper's stdout now runs inside the command try/catch, so a helper that prints a plain-text error instead of JSON is handled like any other failure (log and return undefined) rather than throwing to the caller.

Click-testing instructions

Not applicable - this PR only adds tests and hardens one error path (see above), so there's nothing to click-test. Verified via the unit tests noted in the section below.

Optional: Any additional details or context that should be provided?

• Wrapper placement. The wrapper lives in fsWrappers.ts per the issue title. That module is already the home for stubbable native (C-backed) wrappers, not strictly filesystem ones - it also wraps os.tmpdir() - so its doc comment was broadened to say so. A separate, sidecar-specific child_process.spawn() wrapper exists in src/sidecar/utils.ts; consolidating the two child_process wrappers into one home is a reasonable follow-up but out of scope here.
• Wrapper contract. execSync always decodes as UTF-8 and returns a string, so encoding is intentionally not a caller-overridable option (Omit<ExecSyncOptions, "encoding">), keeping the : string return type honest.
• Testing. npx gulp check, npx gulp lint (0 errors), and npx gulp test -t "credentials" all pass - 30 tests, including the 8 new getDockerCredentials() cases.

Closes #1941

Pull request checklist

Please check if your PR fulfills the following (if applicable):

Tests

• Added new
• Updated existing
• Deleted existing

Release notes

• Does anything in this PR need to be mentioned in the user-facing CHANGELOG?

[Copilot]

Pull request overview

This PR adds unit test coverage for getDockerCredentials() (Docker credential helper lookup + SecretStorage caching) by introducing a stubbable execSync wrapper and hardening one error path so non-JSON helper stdout is handled gracefully.

Changes:

• Added a thin execSync wrapper in src/utils/fsWrappers.ts to enable Sinon stubbing.
• Updated getDockerCredentials() to use the wrapper and to perform JSON.parse() inside the command try/catch.
• Added a focused getDockerCredentials() unit test suite covering cache, config/read failures, helper invocation behavior, and invalid/non-JSON outputs.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/utils/fsWrappers.ts	Adds a stubbable execSync wrapper returning UTF-8 decoded output as a string.
src/docker/credentials.ts	Routes credential helper execution through the wrapper and catches non-JSON helper stdout by parsing inside try/catch.
src/docker/credentials.test.ts	Adds an 8-case test suite covering getDockerCredentials() control-flow branches and caching behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sonarqube-confluent]

Quality Gate passed

Issues
1 New issue
1 Fixed issue
0 Accepted issues

Measures
0 Security Hotspots
66.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube