fix(docker): nil-guard remaining convertFrom*/convertToMount helpers

[CybotTM]

Summary

Closes #654. Sibling-hunt completion of the convert.go family of nil-guard gaps that #619 / #626 / #632 / #648 started.

PR #648 added nil-guards to the convertFrom* swarm/event helpers and ContainerServiceAdapter.Create. The follow-up audit found 4 more helpers in core/adapters/docker/ with the same defense-in-depth gap:

Helper	Risk
convertFromAPIContainer(c *containertypes.Summary)	derefs c.Names, c.ID, c.Image, c.Created, c.Labels, c.State
convertFromNetworkResource(n *networktypes.Summary)	derefs n.Name, n.IPAM.Driver, n.Containers
convertFromNetworkInspect(n *networktypes.Inspect)	derefs n.Name, n.IPAM, n.Containers
convertToMount(m *domain.Mount)	derefs m.Type

All four are reached via &loopVar from a range over a slice in production, so no live panic exists today. The signature contract is unsafe though — and convertToMount was especially asymmetric: every other convertTo* helper in container.go (convertToHostConfig, convertToNetworkingConfig, convertToEndpointSettings, convertToContainerConfig) already nil-guarded its argument.

Changes

• Each helper early-returns the appropriate zero value when the pointer arg is nil:
  • convertFromNetworkInspect(nil) -> nil (mirrors convertFromSwarmService from fix(docker): nil-guard symmetric *From* converters and Container.Create (#632) #648)
  • convertFromAPIContainer(nil) -> domain.Container{}
  • convertFromNetworkResource(nil) -> domain.Network{}
  • convertToMount(nil) -> mount.Mount{}
• Each gains a godoc note explaining the defense-in-depth rationale and pointing at docker: nil-guard remaining convertFrom*/convertToMount helpers in convert.go (sibling of #632) #654 / fix(docker): nil-guard symmetric *From* converters and Container.Create (#632) #648 / fix(docker): nil-guard convert helpers in adapter (#622) #626.
• Nil-input + happy-path regression tests added to convert_nil_test.go using the existing failOnPanic helper. (Comprehensive happy-path coverage for these helpers already exists in convert_test.go / container_convert_test.go / convert_mutation_test.go; the colocated happy-path counterparts mirror the pattern established for convertFromSDKEvent in event_nil_test.go so a future reader sees the nil + valid contract side-by-side.)
• CHANGELOG.md entry under ### Fixed adjacent to the existing Docker SDK: symmetric nil-guards on convertFromSwarmService / convertFromSwarmTask / convertFromSDKEvent #632 / fix(docker): nil-guard symmetric *From* converters and Container.Create (#632) #648 entry.

Why "sibling-hunt completion"

This closes the convert.go family that #619 (Exec.Create / Run), #626 (convertTo* swarm/mount), #632 / #648 (convertFrom* swarm/event + Container.Create) chipped away at. After this merges, every convertTo* and convertFrom* helper in core/adapters/docker/ nil-guards its pointer argument — the unsafe-signature class is closed.

Test plan

• go test ./core/adapters/docker/ -count=1 -short -race — all pass (existing happy-path tests in convert_mutation_test.go / convert_test.go / container_convert_test.go continue to pass, confirming the new guards don't regress anything)
• golangci-lint run ./... — 0 issues
• New nil-input tests pass with failOnPanic (would catch a missing guard)
• New happy-path tests pin the contract for the 4 newly-guarded helpers

[gemini-code-assist]

Code Review

This pull request implements defense-in-depth nil guards for several conversion functions in the Docker adapter, specifically convertToMount, convertFromAPIContainer, convertFromNetworkResource, and convertFromNetworkInspect, to prevent potential nil-pointer dereferences. Comprehensive regression tests have been added to verify these guards and ensure no regressions on valid inputs. I have no feedback to provide as there were no review comments to evaluate.

[Copilot]

Pull request overview

This PR completes a defense-in-depth audit in the Docker adapter by adding missing nil-guards to remaining convertFrom* helpers in convert.go and the asymmetric convertToMount helper in container.go, preventing potential nil-pointer panics from unsafe direct calls (while keeping current production behavior unchanged).

Changes:

• Add early-return nil-guards for convertFromAPIContainer, convertFromNetworkResource, convertFromNetworkInspect, and convertToMount.
• Add regression tests covering nil-input behavior (panic-free) plus happy-path sanity checks.
• Document the fix in CHANGELOG.md under “Fixed”.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
core/adapters/docker/convert.go	Adds nil-guards (zero-value / nil returns) and rationale godoc for remaining convertFrom* helpers.
core/adapters/docker/container.go	Adds a nil-guard and godoc rationale to convertToMount to match other convertTo* helpers.
core/adapters/docker/convert_nil_test.go	Adds nil-input regression tests + happy-path sanity checks for the newly guarded helpers.
CHANGELOG.md	Records the defense-in-depth fix and references the related issue/PR lineage.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Automated approval for maintainer PR

All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.

[github-actions]

✅ Mutation Testing Results

Mutation Score: 100.00% (threshold: 60%)

✨ Good job! Mutation score meets the threshold.

What is mutation testing?

Mutation testing measures test quality by introducing small changes (mutations) to the code and checking if tests detect them. A higher score means better test effectiveness.

• Killed mutants: Tests caught the mutation (good!)
• Survived mutants: Tests missed the mutation (needs improvement)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.85%. Comparing base (b6b6009) to head (aec3429).
⚠️ Report is 9 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #658      +/-   ##
==========================================
- Coverage   87.88%   87.85%   -0.03%     
==========================================
  Files          88       88              
  Lines       10978    11068      +90     
==========================================
+ Hits         9648     9724      +76     
- Misses       1086     1096      +10     
- Partials      244      248       +4     

Flag	Coverage Δ
integration	87.83% <100.00%> (-0.05%)	⬇️
unittests	84.98% <100.00%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.