Skip to content

Commit

Permalink
feat: disable setting COMPOSER_AUTH for gitlab (#20634)
Browse files Browse the repository at this point in the history 
Co-authored-by: Rhys Arkins <rhys@arkins.net>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
  • Loading branch information
@DjordyKoert @rarkins @viceice
3 people committed Apr 17, 2023
1 parent 94b42c5 commit 62b57aa
Show file tree
Hide file tree
Showing 7 changed files with 428 additions and 40 deletions.
25 changes: 25 additions & 0 deletions docs/usage/configuration-options.md
View file
Expand Up @@ -1348,6 +1348,31 @@ Example:

If enabled, this allows a single TCP connection to remain open for multiple HTTP(S) requests/responses.

### artifactAuth

You may use this field whenever it is needed to only enable authentication for a specific set of managers.

For example, using this option could be used whenever authentication using Git for private composer packages is already being handled through the use of SSH keys, which results in no need for also setting up authentication using tokens.

```json
{
"hostRules": [
{
"hostType": "gitlab",
"matchHost": "gitlab.myorg.com",
"token": "abc123",
"artifactAuth": ["composer"]
}
]
}
```

Supported artifactAuth and hostType combinations:

| artifactAuth | hostTypes |
| ------------ | ------------------------------------------- |
| `composer` | `gitlab`, `packagist`, `github`, `git-tags` |

### matchHost

This can be a base URL (e.g. `https://api.github.com`) or a hostname like `github.com` or `api.github.com`.
Expand Down
14 changes: 14 additions & 0 deletions lib/config/options/index.ts
View file
Expand Up @@ -2302,6 +2302,20 @@ const options: RenovateOptions[] = [
env: false,
experimental: true,
},
{
name: 'artifactAuth',
description:
'A list of package managers to enable artifact auth. Only managers on the list are enabled. All are enabled if `null`',
experimental: true,
type: 'array',
subType: 'string',
stage: 'repository',
parent: 'hostRules',
allowedValues: ['composer'],
default: null,
cli: false,
env: false,
},
{
name: 'cacheHardTtlMinutes',
description:
Expand Down
323 changes: 323 additions & 0 deletions lib/modules/manager/composer/artifacts.spec.ts
View file
Expand Up @@ -292,6 +292,329 @@ describe('modules/manager/composer/artifacts', () => {
]);
});

it('does set github COMPOSER_AUTH for github when only hostType git-tags artifactAuth does not include composer', async () => {
hostRules.add({
hostType: 'github',
matchHost: 'api.github.com',
token: 'ghs_token',
});
hostRules.add({
hostType: GitTagsDatasource.id,
matchHost: 'github.com',
token: 'ghp_token',
artifactAuth: [],
});
fs.readLocalFile.mockResolvedValueOnce('{}');
const execSnapshots = mockExecAll();
fs.readLocalFile.mockResolvedValueOnce('{}');
const authConfig = {
...config,
registryUrls: ['https://packagist.renovatebot.com'],
};
git.getRepoStatus.mockResolvedValueOnce(repoStatus);
expect(
await composer.updateArtifacts({
packageFileName: 'composer.json',
updatedDeps: [],
newPackageFileContent: '{}',
config: authConfig,
})
).toBeNull();
expect(execSnapshots).toMatchObject([
{
options: {
env: {
COMPOSER_AUTH: '{"github-oauth":{"github.com":"ghs_token"}}',
},
},
},
]);
});

it('does set github COMPOSER_AUTH for git-tags when only hostType github artifactAuth does not include composer', async () => {
hostRules.add({
hostType: 'github',
matchHost: 'api.github.com',
token: 'ghs_token',
artifactAuth: [],
});
hostRules.add({
hostType: GitTagsDatasource.id,
matchHost: 'github.com',
token: 'ghp_token',
});
fs.readLocalFile.mockResolvedValueOnce('{}');
const execSnapshots = mockExecAll();
fs.readLocalFile.mockResolvedValueOnce('{}');
const authConfig = {
...config,
registryUrls: ['https://packagist.renovatebot.com'],
};
git.getRepoStatus.mockResolvedValueOnce(repoStatus);
expect(
await composer.updateArtifacts({
packageFileName: 'composer.json',
updatedDeps: [],
newPackageFileContent: '{}',
config: authConfig,
})
).toBeNull();
expect(execSnapshots).toMatchObject([
{
options: {
env: {
COMPOSER_AUTH: '{"github-oauth":{"github.com":"ghp_token"}}',
},
},
},
]);
});

it('does not set github COMPOSER_AUTH when artifactAuth does not include composer, for both hostType github & git-tags', async () => {
hostRules.add({
hostType: 'github',
matchHost: 'api.github.com',
token: 'ghs_token',
artifactAuth: [],
});
hostRules.add({
hostType: GitTagsDatasource.id,
matchHost: 'github.com',
token: 'ghp_token',
artifactAuth: [],
});
fs.readLocalFile.mockResolvedValueOnce('{}');
const execSnapshots = mockExecAll();
fs.readLocalFile.mockResolvedValueOnce('{}');
const authConfig = {
...config,
registryUrls: ['https://packagist.renovatebot.com'],
};
git.getRepoStatus.mockResolvedValueOnce(repoStatus);
expect(
await composer.updateArtifacts({
packageFileName: 'composer.json',
updatedDeps: [],
newPackageFileContent: '{}',
config: authConfig,
})
).toBeNull();
expect(execSnapshots[0].options?.env).not.toContainKey('COMPOSER_AUTH');
});

it('does not set gitlab COMPOSER_AUTH when artifactAuth does not include composer', async () => {
hostRules.add({
hostType: GitTagsDatasource.id,
matchHost: 'github.com',
token: 'ghp_token',
});
hostRules.add({
hostType: 'gitlab',
matchHost: 'gitlab.com',
token: 'gitlab-token',
artifactAuth: [],
});
fs.readLocalFile.mockResolvedValueOnce('{}');
const execSnapshots = mockExecAll();
fs.readLocalFile.mockResolvedValueOnce('{}');
const authConfig = {
...config,
postUpdateOptions: ['composerGitlabToken'],
registryUrls: ['https://packagist.renovatebot.com'],
};
git.getRepoStatus.mockResolvedValueOnce(repoStatus);
expect(
await composer.updateArtifacts({
packageFileName: 'composer.json',
updatedDeps: [],
newPackageFileContent: '{}',
config: authConfig,
})
).toBeNull();

expect(execSnapshots).toMatchObject([
{
options: {
env: {
COMPOSER_AUTH: '{"github-oauth":{"github.com":"ghp_token"}}',
},
},
},
]);
});

it('does not set packagist COMPOSER_AUTH when artifactAuth does not include composer', async () => {
hostRules.add({
hostType: GitTagsDatasource.id,
matchHost: 'github.com',
token: 'ghp_token',
});
hostRules.add({
hostType: PackagistDatasource.id,
matchHost: 'packagist.renovatebot.com',
username: 'some-username',
password: 'some-password',
artifactAuth: [],
});
hostRules.add({
hostType: PackagistDatasource.id,
matchHost: 'https://artifactory.yyyyyyy.com/artifactory/api/composer/',
username: 'some-other-username',
password: 'some-other-password',
artifactAuth: [],
});
hostRules.add({
hostType: PackagistDatasource.id,
username: 'some-other-username',
password: 'some-other-password',
artifactAuth: [],
});
hostRules.add({
hostType: PackagistDatasource.id,
matchHost: 'https://packages-bearer.example.com/',
token: 'abcdef0123456789',
artifactAuth: [],
});
fs.readLocalFile.mockResolvedValueOnce('{}');
const execSnapshots = mockExecAll();
fs.readLocalFile.mockResolvedValueOnce('{}');
const authConfig = {
...config,
postUpdateOptions: ['composerGitlabToken'],
registryUrls: ['https://packagist.renovatebot.com'],
};
git.getRepoStatus.mockResolvedValueOnce(repoStatus);
expect(
await composer.updateArtifacts({
packageFileName: 'composer.json',
updatedDeps: [],
newPackageFileContent: '{}',
config: authConfig,
})
).toBeNull();

expect(execSnapshots).toMatchObject([
{
options: {
env: {
COMPOSER_AUTH: '{"github-oauth":{"github.com":"ghp_token"}}',
},
},
},
]);
});

it('does set gitlab COMPOSER_AUTH when artifactAuth does include composer', async () => {
hostRules.add({
hostType: GitTagsDatasource.id,
matchHost: 'github.com',
token: 'ghp_token',
});
hostRules.add({
hostType: 'gitlab',
matchHost: 'gitlab.com',
token: 'gitlab-token',
artifactAuth: ['composer'],
});
fs.readLocalFile.mockResolvedValueOnce('{}');
const execSnapshots = mockExecAll();
fs.readLocalFile.mockResolvedValueOnce('{}');
const authConfig = {
...config,
postUpdateOptions: ['composerGitlabToken'],
registryUrls: ['https://packagist.renovatebot.com'],
};
git.getRepoStatus.mockResolvedValueOnce(repoStatus);
expect(
await composer.updateArtifacts({
packageFileName: 'composer.json',
updatedDeps: [],
newPackageFileContent: '{}',
config: authConfig,
})
).toBeNull();

expect(execSnapshots).toMatchObject([
{
options: {
env: {
COMPOSER_AUTH:
'{"github-oauth":{"github.com":"ghp_token"},' +
'"gitlab-token":{"gitlab.com":"gitlab-token"},' +
'"gitlab-domains":["gitlab.com"]}',
},
},
},
]);
});

it('does set packagist COMPOSER_AUTH when artifactAuth does include composer', async () => {
hostRules.add({
hostType: GitTagsDatasource.id,
matchHost: 'github.com',
token: 'ghp_token',
});
hostRules.add({
hostType: PackagistDatasource.id,
matchHost: 'packagist.renovatebot.com',
username: 'some-username',
password: 'some-password',
artifactAuth: ['composer'],
});
hostRules.add({
hostType: PackagistDatasource.id,
matchHost: 'https://artifactory.yyyyyyy.com/artifactory/api/composer/',
username: 'some-other-username',
password: 'some-other-password',
artifactAuth: ['composer'],
});
hostRules.add({
hostType: PackagistDatasource.id,
username: 'some-other-username',
password: 'some-other-password',
artifactAuth: ['composer'],
});
hostRules.add({
hostType: PackagistDatasource.id,
matchHost: 'https://packages-bearer.example.com/',
token: 'abcdef0123456789',
artifactAuth: ['composer'],
});
fs.readLocalFile.mockResolvedValueOnce('{}');
const execSnapshots = mockExecAll();
fs.readLocalFile.mockResolvedValueOnce('{}');
const authConfig = {
...config,
postUpdateOptions: ['composerGitlabToken'],
registryUrls: ['https://packagist.renovatebot.com'],
};
git.getRepoStatus.mockResolvedValueOnce(repoStatus);
expect(
await composer.updateArtifacts({
packageFileName: 'composer.json',
updatedDeps: [],
newPackageFileContent: '{}',
config: authConfig,
})
).toBeNull();

expect(execSnapshots).toMatchObject([
{
options: {
env: {
COMPOSER_AUTH:
'{"github-oauth":{"github.com":"ghp_token"},' +
'"http-basic":{' +
'"packagist.renovatebot.com":{"username":"some-username","password":"some-password"},' +
'"artifactory.yyyyyyy.com":{"username":"some-other-username","password":"some-other-password"}' +
'},' +
'"bearer":{"packages-bearer.example.com":"abcdef0123456789"}}',
},
},
},
]);
});

it('returns updated composer.lock', async () => {
fs.readLocalFile.mockResolvedValueOnce('{}');
const execSnapshots = mockExecAll();
Expand Down

0 comments on commit 62b57aa

Please sign in to comment.