This is a good feature request, it needs little more thought though, maybe instead of having a disable switch, we implement a i don't care if it fails switch.

I'd like to see this implemented either way, just spit balling before settling on one solution.

By i don't care if it fails, do you suggest that the logic should be this?:

• always try to use builtin credential handling
• on success, use builtin credentials (this probably still leads to the external credential helper being called if it is configured, as far as I understand)
• if new i don't care if it fails flag is set and builtin credential handling fails, fall back to credential helper instead of failing

Just making sure I understand your request. The implementation I tried in #761 right now would disable the builtin logic completely. Happy to adapt it to the logic above, if that's what you have in mind.

Yes, exactly. --credential_helper flag already overrides whatever comes out of starlark side, so even if the builtin authorization succeeds, bazel never uses that information because --credential_helper takes precedence.

i dont care if it fails flag is more useful because it can be used for public repos where credential helper fails but authorization was not needed in the first place, so it covers your use case and public repo use case.

Cross ref: #750