mz668: add integration test for build context

[mzihlmann]

Refs #668.

Background

Per codecov, only three of the seven pkg/buildcontext implementations are exercised by the integration suite: git://, dir://, and tar://stdin. And inside git.go, several ref-handling branches are unhit even though git:// is "covered" at the package level. This PR plugs both gaps.

What's added

TestHTTPSBuildcontext — integration/integration_with_https_test.go

First integration coverage for pkg/buildcontext/https.go.

• Builds a tar.gz on the fly in t.TempDir() via util.CreateTarballOfDirectory.
• Reuses the self-signed cert at /tmp/kaniko-tls-registry/tls.{crt,key} that scripts/setup-tls-registry-creds.sh already generates for TestAlpineTLS. CN/SAN is IP:127.0.0.2.
• Runs an http.Server bound to 127.0.0.2:0 serving the tarball.
• Builds with docker by piping the same tarball over stdin (docker build - < tarball), so the docker daemon does not need to trust the self-signed cert.
• Builds with kaniko via -c https://127.0.0.2:<port>/..., bind-mounting the cert into /kaniko/ssl/certs/ (kaniko's image already sets SSL_CERT_DIR there — same pattern as TestAlpineTLS).
• Compares with the existing containerDiff helper.

CreateTarballOfDirectory strips only the leading /, so the Dockerfile path inside the tarball is the host's absolute path minus the slash. Both docker and kaniko receive that as -f.

Three new git-context tests — integration/integration_git_refs_test.go

The existing TestGitBuildcontext* only hit two of the four ref-handling branches in UnpackTarFromBuildContext. New coverage:

Test	Code path exercised
TestGitBuildcontextPlainBranch	bare branch name with no refs/heads/ prefix (the trailing else around line 88-91)
TestGitBuildcontextTag	refs/tags/<tag> — the post-clone fetch flow (lines 84-87 + 108-124)
TestGitBuildcontextBranchFlag	--git=branch=<name> flag → getGitReferenceName + gitRefExists (lines 94-100, 152-179)

A small helper testGitBuildcontextRawHelper is introduced because the existing KanikoGitRepo always prepends refs/heads/, which doesn't fit any of the three new shapes.

Coverage notes

Coverage instrumentation flows through addCoverageFlags, so the happy path of pkg/buildcontext/https.go (status check + io.Copy + UnpackCompressedTar) and the previously-untouched branches in pkg/buildcontext/git.go (plain branch, refs/tags/, getGitReferenceName, gitRefExists tag-match) all land in codecov.

Test plan

• LOCAL=1 ./scripts/integration-test.sh -run 'TestHTTPSBuildcontext$' -v passes locally, diffoci reports an empty diff.
• LOCAL=1 ./scripts/integration-test.sh -run 'TestGitBuildcontextPlainBranch$|TestGitBuildcontextTag$|TestGitBuildcontextBranchFlag$' -v passes locally, all three diffoci runs are empty.
• Wait for CI to confirm under the integration-test-misc matrix.

Follow-ups

Other coverage gaps worth their own PRs: AzureBlob branch of the HTTPS dispatcher (cheap, no cloud), s3:// (MinIO sidecar), gs:// (currently no good fake). Within git.go: GitDepth, GitSingleBranch, GitRecurseSubmodules, InsecureSkipTLS, and the third-segment parts[2] checkout override are still untested.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!