Wait for proxy readiness before starting updater

[brettfo]

Why

The proxy can perform synchronous NuGet service-index discovery before it binds port 1080. A running proxy container therefore does not guarantee that the proxy is ready, and the collector or updater can start too early.

The CLI can run on Windows, macOS, or Linux, and custom proxy images should not need to add a readiness-specific executable or place their shell at /bin/sh.

What changed

• Inspect /proc/net/tcp and /proc/net/tcp6 inside the Linux proxy container through Docker's exec API before creating the collector or updater.
• Use only sh built-ins, resolving sh through the image's PATH just as proxy startup does.
• Avoid requiring nc, grep, or another additional executable in custom proxy images.
• Keep the credential-injecting proxy private to Docker networks rather than publishing it to a host socket.
• Poll every 100 ms for up to 60 seconds and wait for each probe process to finish before inspecting its exit code.
• Keep the internal readiness deadline from being classified as the user-configured update timeout, while preserving genuine parent-context deadlines and probe errors.
• Preserve the primary readiness or updater error when proxy cleanup also fails.
• Add unit coverage for readiness polling and timeout/error classification.
• Add Docker-backed coverage using a custom proxy image with no nc and no /bin/sh, proving updater startup waits for a delayed listener and failed updater connectivity aborts the fixture.

This provides the same startup sequencing guarantee as github/dependabot-action#1757 while remaining independent of the CLI host operating system and additional custom-image tooling.

Testing

• go test ./internal/...
• All non-script-test packages via go test after excluding cmd/dependabot
• Repeated readiness unit tests with -count=20
• Docker-backed TestDependabot/proxy with a custom proxy image that has neither nc nor /bin/sh

A full local go test ./... is blocked by the script-test harness exposing only PATH: Docker falls back to its legacy builder and rejects existing COPY --chmod instructions across unrelated fixtures. The targeted Docker test passed using a local legacy-builder-compatible form of the fixture, with no such compatibility change retained in this branch.

[Copilot]

Copilot review overview

🟡 Changes recommended

The published credential proxy lacks access control, and the integration fixture does not detect failed startup sequencing.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1 · 1

New issues introduced by this change (2)

Severity	Finding
	internal/​infra/​proxy.go — Avoid exposing the credential-injecting proxy without authentication View comment
	testdata/​scripts/​proxy.txt — Make a failed readiness connection fail the fixture View comment

What changed in this PR

Adds HTTP-level proxy readiness checks before starting dependent containers.

Changes:

• Publishes a loopback readiness port and polls it via Go HTTP.
• Preserves primary errors during proxy cleanup.
• Adds unit and Docker-backed readiness coverage.

File	Description
internal/​infra/​proxy.go	Implements proxy readiness probing.
internal/​infra/​run.go	Waits before starting dependent containers.
internal/​infra/​updater.go	Extracts reusable polling and port checks.
internal/​infra/​proxy_test.go	Tests HTTP-level readiness.
testdata/​scripts/​proxy.txt	Adds delayed-proxy integration coverage.
go.mod	Promotes Docker connections to a direct dependency.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

The readiness probe breaks custom proxy images that do not provide the previously undeclared nc dependency.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	internal/​infra/​updater.go — Preserve compatibility with custom proxy images View comment

Issues resolved since last review (2)

Severity	Finding
	testdata/​scripts/​proxy.txt — Make a failed readiness connection fail the fixture View resolved comment
	internal/​infra/​proxy.go — Avoid exposing the credential-injecting proxy without authentication View resolved comment

[Copilot]

Copilot review overview

🟡 Changes recommended

Internal timeout classification and shell-path compatibility can produce incorrect failures.

Get a fresh assessment by requesting another Copilot review.

Review tier: Balanced
Findings: 2

New issues introduced by this change (2)

Severity	Finding
	internal/​infra/​proxy.go — Do not expose the private readiness deadline as the update timeout View comment
	internal/​infra/​updater.go — Use the same shell contract as proxy startup View comment

Issues resolved since last review (1)

Severity	Finding
	internal/​infra/​updater.go — Preserve compatibility with custom proxy images View resolved comment

[Copilot]

Copilot review overview

🟡 Changes recommended

The key integration test does not deterministically verify startup ordering.

Get a fresh assessment by requesting another Copilot review.

Review tier: Balanced
Findings: 1

Open findings (1)

• Make the readiness regression test deterministic · New

Resolved findings (2)

• Use the same shell contract as proxy startup
• Do not expose the private readiness deadline as the update timeout