Propagate credential helper failures during downloads

[fzlzjerry]

Description

Propagate request-metadata lookup failures through the HTTP downloader instead of warning and continuing without authentication. A checked request-header provider now resolves credentials before proxy or socket creation, while preserving per-URL header computation for redirects.

Add regressions covering both layers of the failure path: credential exceptions reach the caller unchanged, and a failed header lookup does not open a connection or enter the network retry loop.

Motivation

Fixes #24548.

A failing scoped credential helper could previously be reduced to a warning and followed by an anonymous registry request. The later registry response could then mask the actionable helper exit code and stderr. Credential helper failures should abort the operation instead.

Build API Changes

No

Checklist

• I have added tests for the new use cases (if any).
• I have updated the documentation (not applicable: no public API or configuration change).

Tests

• bazel test //src/test/java/com/google/devtools/build/lib/authandtls/credentialhelper:credentialhelper //src/test/java/com/google/devtools/build/lib/bazel/repository/downloader:DownloaderTestSuite
• bazel build //src:bazel-dev
• Manual HTTP registry replay with a host-scoped helper that exits with code 2: the helper diagnostic was surfaced and the registry received no request.

Release Notes

RELNOTES: Credential helper failures now abort HTTP downloads instead of continuing without authentication.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[Copilot]

Pull request overview

This PR fixes credential-helper error handling in Bazel’s HTTP downloader by propagating request-metadata (credential) lookup failures to callers, instead of warning and proceeding with an unauthenticated request that can mask the real failure.

Changes:

• Introduces a checked request-headers provider (RequestHeadersProvider) so header/credential computation can throw and abort the download.
• Resolves request headers (including credentials) before proxy/socket creation in HttpConnector, preventing retries/anonymous requests after credential failures.
• Adds/updates unit tests to ensure credential/header lookup failures propagate unchanged and do not initiate connections or retries.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
src/main/java/com/google/devtools/build/lib/bazel/repository/downloader/HttpConnector.java	Adds a checked header provider and evaluates headers before opening connections to avoid retrying credential failures as network errors.
src/main/java/com/google/devtools/build/lib/bazel/repository/downloader/HttpConnectorMultiplexer.java	Removes warning-on-metadata-failure behavior and propagates Credentials.getRequestMetadata I/O failures via the new header provider path.
src/test/java/com/google/devtools/build/lib/bazel/repository/downloader/HttpConnectorTest.java	Adds a regression test ensuring header lookup failure aborts without proxy/socket creation or retrying.
src/test/java/com/google/devtools/build/lib/bazel/repository/downloader/HttpConnectorMultiplexerTest.java	Updates tests for the new provider type and adds coverage asserting credential failures propagate without emitting warnings.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.