fix(36): helmvalues.NewAuthClient does not panick over HelmRegistry credentials

ocm-kit/helmvalues/credentials.go

@@ -45,6 +45,7 @@ func NewAuthClient(ctx context.Context, ocmConfigPath string) (*auth.Client, err
 	if err != nil {
 		return nil, err
 	}
+	credConfig.Consumers = filterOCIRegistryConsumers(credConfig.Consumers)
 
 	// Ensure the implicit docker config is resolvable by injecting a default
 	// (empty) DockerConfig/v1 repository when none is configured. An empty
@@ -118,6 +119,30 @@ func ociRegistryIdentity(hostport string) (runtime.Identity, error) {
 	return identity, nil
 }
 
+// filterOCIRegistryConsumers drops non-OCIRegistry identities from each
+// consumer, and the consumer entirely if none remain. OCM configs may declare
+// consumers for other systems (e.g. HelmChartRepository credentials for Helm
+// chart repos); this client only wires up plugin-based resolution for OCI
+// credential types, so leaving such consumers in would otherwise trip
+// plugin-based credential resolution against a nil CredentialPluginProvider.
+func filterOCIRegistryConsumers(consumers []credcfgruntime.Consumer) []credcfgruntime.Consumer {
+	filtered := make([]credcfgruntime.Consumer, 0, len(consumers))
+	for _, consumer := range consumers {
+		identities := make([]runtime.Identity, 0, len(consumer.Identities))
+		for _, identity := range consumer.Identities {
+			if typ, err := identity.ParseType(); err == nil && typ.Equal(ociidentityv1.Type) {
+				identities = append(identities, identity)
+			}
+		}
+		if len(identities) == 0 {
+			continue
+		}
+		consumer.Identities = identities
+		filtered = append(filtered, consumer)
+	}
+	return filtered
+}
+
 // loadCredentialConfig loads the credentials config from the resolved OCM config
 // path. A missing file yields an empty (non-nil) credentials config so the graph
 // can still be built with the implicit docker repository.

ocm-kit/helmvalues/helmvalues_test.go

@@ -4,16 +4,33 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	descriptor "ocm.software/open-component-model/bindings/go/descriptor/runtime"
 	v2 "ocm.software/open-component-model/bindings/go/descriptor/v2"
 	ociaccessv1 "ocm.software/open-component-model/bindings/go/oci/spec/access/v1"
 	"ocm.software/open-component-model/bindings/go/runtime"
 )
 
+const configWithHelmCredentials = `
+type: generic.config.ocm.software/v1
+configurations:
+  - type: credentials.config.ocm.software
+    consumers:
+      - identities:
+          - type: HelmChartRepository
+            hostname: example.org 
+        credentials:
+          - type: HelmHTTPCredentials/v1
+            username: anything
+            password: anything
+`
+
 // TestRender tests the Render function with various template scenarios
 func TestRender(t *testing.T) {
 	tests := []struct {
@@ -512,3 +529,13 @@ func TestGetRenderingInput_NativeOCIAccess(t *testing.T) {
 		}, input.OCIResources)
 	}
 }
+
+// Regression test for https://github.com/open-component-model/community/issues/36
+func TestNewAuthClient_WithHelmCredentialsInConfig(t *testing.T) {
+	configPath := filepath.Join(t.TempDir(), "ocmconfig")
+
+	require.NoError(t, os.WriteFile(configPath, []byte(configWithHelmCredentials), 0600))
+
+	_, err := NewAuthClient(t.Context(), configPath)
+	assert.NoError(t, err)
+}