refactor(docker): simplify FindDevContainer user label assignment

[skevetter]

Summary

• Extract ensureUserLabel helper from dockerDriver.FindDevContainer in pkg/driver/docker/docker.go.
• Reduce cyclomatic complexity of FindDevContainer from 9 to clean threshold (CodeScene score 10.0).
• Preserve container ID priority, workspace ID label queries, error/nil propagation, and user-label fallback semantics.
• Add focused test coverage in pkg/driver/docker/docker_test.go for nil details, user-label fallback/injection, and container discovery paths.

Validation

• go test -v -run TestDockerDriverSuite/TestEnsureUserLabel ./pkg/driver/docker
• go test -v -run TestDockerDriverSuite/TestFindDevContainer ./pkg/driver/docker
• task cli:lint:ci
• CodeScene local review: 10.0 score (0 findings)
• CodeRabbit CLI local review: passed with 0 findings

Summary by CodeRabbit

• Bug Fixes
  • Docker container discovery now retains available container details when an error occurs, allowing callers to access that information while handling the error. Container lookup continues to stop when an error occurs or no container is found.

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	fef3c91
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6ac72c82b33d2b0008a42e49

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9c01f8e1-0482-412f-86bc-74e05832a3e0

📥 Commits

Reviewing files that changed from the base of the PR and between 017e389 and fef3c91.

📒 Files selected for processing (2)

• pkg/driver/docker/docker.go
• pkg/driver/docker/docker_test.go

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

---

📝 Walkthrough

Walkthrough

The Docker driver now returns container details alongside lookup errors. User-label handling moved to a helper that safely handles nil details and preserves existing labels.

Changes

Docker container lookup

Layer / File(s)	Summary
User-label normalization pkg/driver/docker/docker.go, pkg/driver/docker/docker_test.go	ensureUserLabel handles nil details, skips empty configured users, initializes missing labels, and preserves existing user labels. Tests cover these cases.
Container lookup behavior pkg/driver/docker/docker.go, pkg/driver/docker/docker_test.go	FindDevContainer returns lookup details with errors and applies user-label normalization to found containers. Tests cover pinned container IDs, workspace-label discovery, no matching container, and Docker command failure.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Refactor

Merge Risk: ⚪ Minimal · up to fef3c

This is a small refactor of Docker container lookup with added tests. No concrete merge-blocking risk was found.

Security Architecture Review

Security architecture risk: ⚪ Minimal · up to fef3c

The refactor preserves container selection and user-label precedence. Current lookup paths return no details on failure, and consumers reject lookup errors before executing container operations. No material security risk was found to be introduced or worsened.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The effective scope remains the container selected through the existing pinned-ID or workspace-label path. The refactor does not introduce another selection path or increase the authority used by the inspected container operations.

Trust Boundaries and Controls

• observed — The inspected runner and Docker lifecycle consumers reject lookup errors before consuming details. Command execution, commit, deletion, start, and stop therefore remain behind the existing successful-lookup gate.

Resilience and Maintainability Implications

• observed — Inspection decodes into a fresh per-call details slice. Normalization mutates only that returned snapshot, performs no persistent label update, and is sequentially idempotent. Lookup failures bypass normalization, and subsequent calls obtain fresh snapshots; the extraction introduces no shared state between concurrent lookups.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately identifies the main change: simplifying user-label assignment in FindDevContainer through refactoring.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	fef3c91
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6ac72c826fbc2f0008a63351

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.