cargo: strip credential-provider from .cargo/config.toml via TOML parsing

[jeffwidman]

Problem

PR #14340 set CARGO_REGISTRY_GLOBAL_CREDENTIAL_PROVIDERS to an empty string to disable Cargo's credential lookup globally. However, per-registry credential-provider settings in .cargo/config.toml override the global env var:

[registries.artifactory]
credential-provider = "cargo:token"

Cargo then tries to look up tokens locally and fails with no token found.

Solution

Parse .cargo/config.toml with TomlRB and remove credential-provider keys from both per-registry ([registries.*]) and global ([registry]) sections before writing the config to the temporary working directory.

Combined with the existing CARGO_REGISTRY_GLOBAL_CREDENTIAL_PROVIDERS="" from #14340, this ensures Cargo never tries to authenticate on its own. All HTTP requests go through the dependabot proxy unauthenticated, and the proxy injects the real credentials transparently.

Why this works

Dependabot always proxies all Cargo HTTP traffic. The proxy intercepts requests and injects the real registry credentials. Cargo itself never needs to authenticate — it just needs to not try to look up tokens. This PR + #14340 together ensure that:

1. Global providers disabled (via CARGO_REGISTRY_GLOBAL_CREDENTIAL_PROVIDERS="") — cargo: Bypass Cargo credential providers, rely on proxy for registry auth #14340
2. Per-registry providers removed (via TOML parsing in this PR)

Approach

Uses TomlRB to properly parse and rewrite the config rather than regex, avoiding edge cases with TOML formatting. Falls back to the original content if parsing fails.

See also

• Comparison PRs exploring alternative approaches: cargo: strip per-registry credential-provider from .cargo/config.toml #14356, cargo: restore placeholder tokens for private registry auth (Option B) #14357, cargo: disable per-registry credential providers via env vars (Option C) #14358

Fixes #14354
Related: #14030, #14094

[Copilot]

Pull request overview

This PR ensures Dependabot’s Cargo integration doesn’t trigger Cargo’s local credential lookup when a repo’s .cargo/config(.toml) sets credential-provider, so authentication is handled exclusively by the Dependabot proxy.

Changes:

• Add Helpers.sanitize_cargo_config to parse TOML and remove credential-provider from [registries.*] and [registry].
• Write a sanitized Cargo config into the temporary working directory in both the lockfile updater and version resolver paths.
• Add RSpec coverage for sanitizing per-registry, global, mixed, and malformed TOML configs.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
cargo/lib/dependabot/cargo/helpers.rb	Adds TOML-based sanitization to remove credential-provider (with parse-error fallback).
cargo/lib/dependabot/cargo/file_updater/lockfile_updater.rb	Writes sanitized Cargo config into the temp workspace before running Cargo.
cargo/lib/dependabot/cargo/update_checker/version_resolver.rb	Writes sanitized Cargo config into the temp workspace before running Cargo.
cargo/spec/dependabot/cargo/helpers_spec.rb	Adds tests for sanitization behavior and malformed TOML fallback.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

---

You can also share your feedback on Copilot code review. Take the survey.

[jeffwidman]

This is Sorbet variable narrowing... so that we don't have to have another T.must() call... this is arguably more readable.

[jeffwidman]

This is a well-known error that we display to users so that if they hit problems, they can hopefully self-diagnose.