Adding source to Podfile breaks cocoapods dependency

[asoneji]

What Renovate type are you using?
GitHub

Describe the bug
Issue updating Cocoapods dependency

Did you see anything helpful in debug logs?

• Artifact file update failure
• Job log here

To Reproduce

1. Created sample repo sample-ios-project-cocoapods-renovate-debug-source
2. Create a sample XCode Project sample-ios-project
3. Did pod init and added a pod dependency
   • Added at top:
     • platform :ios, '11.2'
   • Added Dependency:
     • pod 'Analytics', '3.8.1'
4. Connect Renovate using renovate to the repo sample-ios-project-cocoapods-renovate-debug-source.
5. Renovate created a pr 1 with renovate config which I merged.
6. Renovate created a pr 2 to Update dependency Analytics 3.8.1 to 3.9.0.
   • Successfully dependency update for renovate bot.
   • Job log here
7. Add Source
   • Added Source:
     • source 'https://github.com/CocoaPods/Specs.git'
     • pod source doc
8. Renovate updated pr 2 to Update dependency Analytics 3.8.1 to 3.9.0.
   • Error

   Analyzing dependencies
   Cloning spec repo `cocoapods` from `https://github.com/CocoaPods/Specs.git`
   

   • Job log here

Note: If I remove Source from podfile the pr 2 again will behave successfully dependency update for renovate bot. Adding source impacts all PR's.

Additional context
Source can be provided in https or ssh format:

• https - source 'https://github.com/somexyz/Specs.git'
• ssh - source 'git@github.com:somexyz/Specs.git'

[rarkins]

@asoneji does this reproduce when using the CLI (instead of the app)?

[asoneji]

@rarkins What do you mean and how can I do that? I do not have any issue locally when I try pod install via CLI.

[viceice]

@asoneji how do you configure auth credentials for your private pod spec git repos

[asoneji]

By the way, this issue happens even for source 'https://github.com/CocoaPods/Specs.git' which is all public.

For access to our private repo for my local machine and our build machines, we use GitHub token. We use GitHub Enterprise which required token even for read access.

For renovate we are not sure how to configure GitHub auth token. FYI #6568 (comment)

[viceice]

How do you configure the token for pod install command?

[asoneji]

For the reproduce steps in this issue I have not configure any token for pod install command as it is connecting to source 'https://github.com/CocoaPods/Specs.git' which is public. All I did was connect Renovate using renovate to the repo sample-ios-project-cocoapods-renovate-debug-source.

[viceice]

@asoneji Can you add me to your sample project, so i can see the logs or past the relevant logs here.

If i run pod install --verbose in our renovate/cocoapods:1.9.1 container it hangs on:

#25 2.436 Cloning spec repo `cocoapods` from `https://github.com/CocoaPods/Specs.git`
#25 2.436   $ /usr/bin/git clone https://github.com/CocoaPods/Specs.git -- cocoapods
#25 2.438   Cloning into 'cocoapods'...
  Updating files: 100% (425573/425573), done.3)
#24 332.4   CDN: trunk Relative path downloaded: all_pods_versions_a_7_6.txt, save ETag: "3bf669728bf9fc52003f25b2d9c194ad-ssl-df"

Runs 5.5 min, so i guess the renovate logs show a timeout?

[viceice]

see CocoaPods/CocoaPods#4989, looks like we definitely have a timeout here

[asoneji]

Added @rarkins and @viceice to the repo.

Yea @krohrsb had pointed this out to me: the repo is large and a workaround solution would be to use the CDN - https://blog.cocoapods.org/CocoaPods-1.7.2/

That being said source 'https://github.com/artsy/Specs.git' is popular. Can the timeout be configured to be higher? Maybe more information in the PR fail message or the job log with a timeout error.

[viceice]

@asoneji We already have a timeout of 15min by default, I've changed yout podfile to use https://github.com/artsy/Specs.git and the CDN, that will work as a workaround for now.

[rarkins]

Is it a viable workaround to add the CDN instead of the GitHub-based specs repo? And if so, is it possible that we can "massage" the podfile before running pod install to replace the github repo specs with the CDN instead?

[viceice]

@rarkins CDN was preview (optin) since 1.7.2 and became default in 1.8.0 so all cocoapods should use the cdn.

Changing the podfile would result in different hashes in lockfile. So we can only forward update from git to cdn and have to leave it after.

[rarkins]

In that case, if we were to say that using the legacy repository in source is unsupported and users should update to use the CDN, would it be a reasonable limitation?

[viceice]

yes i think so, because 1.7.2 is over a year old and supports cdn. most pod users should be on 1.9.x (first released in feb 2020)

[asoneji]

In that case, if we were to say that using the legacy repository in source is unsupported and users should update to use the CDN, would it be a reasonable limitation?

This would be great. Would this error message be in the build log or PR comment which would inform the user to update the legacy repository in the source?

[viceice]

@rarkins should we update this issue to reflect latest ideas / suggestions?

• log error if cocoapods > 1.7.2 and no cdn usage?
• migrate to cdn automatically?

ref #7120

[rarkins]

@viceice if it's technically easy for us to do the CDN migration then the question is: Would any user find that objectionable? If there's no reason to object to it then we should do it automatically, but otherwise do you think we need additional error logging on top of the existing failure message?

[viceice]

I think we should at lease issue a warning if sources are configured to use the old https://github.com/CocoaPods/Specs.git repo.
Using that will mostly fail on renovate.

maybe we should add some explanation to the docs. so users can check for cdn usage before raising issues 😉

[HonkingGoose]

In that case, if we were to say that using the legacy repository in source is unsupported and users should update to use the CDN, would it be a reasonable limitation?

maybe we should add some explanation to the docs. so users can check for cdn usage before raising issues 😉

Do we want/need a separate issue to track adding such a warning to the docs?

[HonkingGoose]

I've labeled it bug for now, but if you feel it needs to be feature please change it to that. 😄