This is really interesting! So the idea is that with this change, krane auth get 12345.dkr.ecr.us-east-1.amazonaws.com will print out the auth token, possibly as derived from a compiled-in cred helper like ecr-login etc.

I think we'll want a simple end-to-end test of this behavior, for GHCR and ECR at least.

For ECR, that means calling krane auth get ${{ env.AWS_ACCOUNT }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com and checking that it doesn't fail, and that it prints something -- though we should be careful not to print that out to logs.

Could you add that to this PR?

Codecov Report

Merging #1413 (cce8f74) into main (f79ec21) will decrease coverage by 0.00%.
The diff coverage is 40.00%.

@@            Coverage Diff             @@
##             main    #1413      +/-   ##
==========================================
- Coverage   73.38%   73.38%   -0.01%     
==========================================
  Files         115      115              
  Lines        8747     8750       +3     
==========================================
+ Hits         6419     6421       +2     
- Misses       1687     1688       +1     
  Partials      641      641              

@imjasonh Sure. I have just added the tests.
In addition, I also added small extension.

Previously, crane and krane get a registry address through stdio only, like:

$ echo "example.registry.com" | krane auth get

But, I added to another way to specify the registry address as an argument as follows:

$ krane auth get example.registry.com

Thanks for this change, this is awesome.

If I had the time, I would set up workload identity so that we could test gcrane auth get and krane auth get against GCP, but I'm fine without it 😅

Looks like you just need to regenerate the docs for the presubmit.