Updating private Bitbucket submodule doesn't work

[tiberium]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us what version of Renovate you run.

docker: 37.0.3-slim, 35-159.7-slim

If you're self-hosting Renovate, select which platform you are using.

Bitbucket Cloud (bitbucket.org)

Was this something which used to work for you, and then stopped?

I am trying to get this working for the first time

Describe the problem

I have two private Bitbucket Cloud repos: AAA and BBB. BBB serves as a submodule for AAA. This is the .gitmodule configuration in the AAA repo:

[submodule "BBB"]
        path = BBB
        url = git@bitbucket.org:my-bitbucket-workspace/BBB.git
        branch = master

As the .gitmodule shows, it is configured with git/ssh, not https, however Renovate tries to work with the submodule using the https protocol.

Currently, in the AAA, the BBB submodule could be updated. The BBB commit kept in AAA is ede6c88 while the newest commit is d9357cd.

In the Renovate config file I set:

hostRules: [
        "matchHost": "bitbucket.org",
        "token": "XYZ"
]

The token is the Bitbucket Cloud Access token.

I run Renovate with docker, having the `LOG_LEVEL=debug" set on.

In the logs, I see:

 INFO: Dependency extraction complete (repository=my-bitbucket-workspace/AAA, baseBranch=master)
       "stats": {
         "managers": {
           "dockerfile": {"fileCount": 3, "depCount": 3},
           "git-submodules": {"fileCount": 1, "depCount": 1},
           "gradle": {"fileCount": 12, "depCount": 37},
           "gradle-wrapper": {"fileCount": 1, "depCount": 1},
           "helm-values": {"fileCount": 1, "depCount": 1},
           "helmv3": {"fileCount": 4, "depCount": 4},
           "maven": {"fileCount": 6, "depCount": 41}
         },
         "total": {"fileCount": 28, "depCount": 88}
       }

So far I am happy, I see that the git submodule was taken into consideration by Renovate.

I see that Renovate was able to see that the update in the submodule is required. The currentDigest and newDigest are correctly recognized by Renovate.

"git-submodules": [
           {
             "deps": [
               {
                 "depName": "BBB",
                 "packageName": "https://bitbucket.org/my-bitbucket-workspace/BBB.git",
                 "currentValue": "master",
                 "currentDigest": "ede6c88...",
                 "updates": [
                   {
                     "updateType": "digest",
                     "newValue": "master",
                     "newDigest": "d9357cd...",
                     "branchName": "renovate/BBB"
                   }
                 ],
                 "versioning": "git",
                 "warnings": []
               }
             ],
             "datasource": "git-refs",
             "packageFile": ".gitmodules"
           }
         ],

Later logs:

DEBUG: syncBranchState() (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
DEBUG: syncBranchState(): Branch cache not found, creating minimal branchState (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
DEBUG: getBranchPr(renovate/BBB-digest) (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
DEBUG: findPr(renovate/BBB-digest, undefined, open) (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
DEBUG: getPrList() (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
DEBUG: branchExists=false (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
DEBUG: dependencyDashboardCheck=undefined (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
DEBUG: Check for closed PR because recreating closed PRs is disabled. (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
DEBUG: findPr(renovate/BBB-digest, chore(deps): update BBB digest to d9357cd, !open) (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
DEBUG: getPrList() (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
DEBUG: prAlreadyExisted=false (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
DEBUG: Checking schedule(at any time, null) (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
DEBUG: No schedule defined (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
DEBUG: Branch needs creating (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
DEBUG: Using reuseExistingBranch: false (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
DEBUG: Setting current branch to master (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
DEBUG: latest commit (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
       "branchName": "master",
       "latestCommitDate": "2023-10-02T20:08:18+02:00"

And unfortunately the next log is the error:

DEBUG: manager.getUpdatedPackageFiles() reuseExistingBranch=false (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
DEBUG: submodule checkout error (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
       "err": {
         "task": {
           "commands": ["submodule", "update", "--init", "BBB"],
           "format": "utf-8",
           "parser": "[function]"
         },
         "message": "Submodule 'BBB' (git@bitbucket.org:my-bitbucket-workspace/BBB.git) registered for path 'BBB'\nCloning into '/tmp/renovate/repos/bitbucket/my-bitbucket-workspace/AAA/BBB'...\nremote: Invalid credentials\nfatal: Authentication failed for 'https://**redacted**@bitbucket.org:my-bitbucket-workspace/BBB.git' into submodule path '/tmp/renovate/repos/bitbucket/my-bitbucket-workspace/AAA/BBB' failed\nFailed to clone 'BBB'. Retry scheduled\nCloning into '/tmp/renovate/repos/bitbucket/my-bitbucket-workspace/AAA/BBB'...\nremote: Invalid credentials\nfatal: Authentication failed for 'https://**redacted**@bitbucket.org:my-bitbucket-workspace/BBB.git' into submodule path '/tmp/renovate/repos/bitbucket/my-bitbucket-workspace/AAA/BBB' failed\nFailed to clone 'BBB' a second time, aborting\n",
         "stack": "Error: Submodule 'BBB' (git@bitbucket.org:my-bitbucket-workspace/BBB.git) registered for path 'BBB'\nCloning into '/tmp/renovate/repos/bitbucket/my-bitbucket-workspace/AAA/BBB'...\nremote: Invalid credentials\nfatal: Authentication failed for 'https://**redacted**@bitbucket.org:my-bitbucket-workspace/BBB.git' into submodule path '/tmp/renovate/repos/bitbucket/my-bitbucket-workspace/AAA/BBB' failed\nFailed to clone 'BBB'. Retry scheduled\nCloning into '/tmp/renovate/repos/bitbucket/my-bitbucket-workspace/AAA/BBB'...\nremote: Invalid credentials\nfatal: Authentication failed for 'https://**redacted**@bitbucket.org:my-bitbucket-workspace/BBB.git' into submodule path '/tmp/renovate/repos/bitbucket/my-bitbucket-workspace/AAA/BBB' failed\nFailed to clone 'BBB' a second time, aborting\n\n    at Object.action (/opt/containerbase/tools/renovate/37.0.3/node_modules/simple-git/src/lib/plugins/error-detection.plugin.ts:42:29)\n    at PluginStore.exec (/opt/containerbase/tools/renovate/37.0.3/node_modules/simple-git/src/lib/plugins/plugin-store.ts:29:29)\n    at /opt/containerbase/tools/renovate/37.0.3/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:127:42\n    at new Promise (<anonymous>)\n    at GitExecutorChain.handleTaskData (/opt/containerbase/tools/renovate/37.0.3/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:124:14)\n    at GitExecutorChain.<anonymous> (/opt/containerbase/tools/renovate/37.0.3/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:100:40)\n    at Generator.next (<anonymous>)\n    at fulfilled (/opt/containerbase/tools/renovate/37.0.3/node_modules/simple-git/dist/cjs/index.js:55:24)\n    at processTicksAndRejections (node:internal/process/task_queues:95:5)"
       }
DEBUG: Error updating file (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)

If I change the token in the configuration to this (prefix the token with x-token-auth as Bitbucket Cloud proposes):

hostRules: [
        "matchHost": "bitbucket.org",
        "token": "x-token-auth:XYZ"
]

I get a different error, from different git command:

DEBUG: Git function thrown (repository=my-bitbucket-workspace/AAA)
       "err": {
         "task": {
           "commands": [
             "ls-remote",
             "--heads",
             "https://**redacted**@bitbucket.org/my-bitbucket-workspace/AAA.git"
           ],
           "format": "utf-8",
           "parser": "[function]"
         },
         "message": "remote: Invalid credentials\nfatal: Authentication failed for 'https://bitbucket.org/my-bitbucket-workspace/AAA.git/'\n",
         "stack": "Error: remote: Invalid credentials\nfatal: Authentication failed for 'https://bitbucket.org/my-bitbucket-workspace/AAA.git/'\n\n    at Object.action (/opt/containerbase/tools/renovate/37.0.3/node_modules/simple-git/src/lib/plugins/error-detection.plugin.ts:42:29)\n    at PluginStore.exec (/opt/containerbase/tools/renovate/37.0.3/node_modules/simple-git/src/lib/plugins/plugin-store.ts:29:29)\n    at /opt/containerbase/tools/renovate/37.0.3/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:127:42\n    at new Promise (<anonymous>)\n    at GitExecutorChain.handleTaskData (/opt/containerbase/tools/renovate/37.0.3/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:124:14)\n    at GitExecutorChain.<anonymous> (/opt/containerbase/tools/renovate/37.0.3/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:100:40)\n    at Generator.next (<anonymous>)\n    at fulfilled (/opt/containerbase/tools/renovate/37.0.3/node_modules/simple-git/dist/cjs/index.js:55:24)\n    at processTicksAndRejections (node:internal/process/task_queues:95:5)"
       }

However when I execute the command on my machine, it works:

git ls-remote --heads https://x-token-auth:XYZ@bitbucket.org/my-bitbucket-workspace/AAA.git

BTW I also tried with username/password in many different ways... If needed I can deliver more logs.

Any help? I saw some issues and discussions here, but none of them provided any solution, maybe my approach based on Bitbucket Cloud Acces token could be a direction to go?

Relevant debug logs

Logs

DEBUG: manager.getUpdatedPackageFiles() reuseExistingBranch=false (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
DEBUG: submodule checkout error (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)
       "err": {
         "task": {
           "commands": ["submodule", "update", "--init", "BBB"],
           "format": "utf-8",
           "parser": "[function]"
         },
         "message": "Submodule 'BBB' (git@bitbucket.org:my-bitbucket-workspace/BBB.git) registered for path 'BBB'\nCloning into '/tmp/renovate/repos/bitbucket/my-bitbucket-workspace/AAA/BBB'...\nremote: Invalid credentials\nfatal: Authentication failed for 'https://**redacted**@bitbucket.org:my-bitbucket-workspace/BBB.git' into submodule path '/tmp/renovate/repos/bitbucket/my-bitbucket-workspace/AAA/BBB' failed\nFailed to clone 'BBB'. Retry scheduled\nCloning into '/tmp/renovate/repos/bitbucket/my-bitbucket-workspace/AAA/BBB'...\nremote: Invalid credentials\nfatal: Authentication failed for 'https://**redacted**@bitbucket.org:my-bitbucket-workspace/BBB.git' into submodule path '/tmp/renovate/repos/bitbucket/my-bitbucket-workspace/AAA/BBB' failed\nFailed to clone 'BBB' a second time, aborting\n",
         "stack": "Error: Submodule 'BBB' (git@bitbucket.org:my-bitbucket-workspace/BBB.git) registered for path 'BBB'\nCloning into '/tmp/renovate/repos/bitbucket/my-bitbucket-workspace/AAA/BBB'...\nremote: Invalid credentials\nfatal: Authentication failed for 'https://**redacted**@bitbucket.org:my-bitbucket-workspace/BBB.git' into submodule path '/tmp/renovate/repos/bitbucket/my-bitbucket-workspace/AAA/BBB' failed\nFailed to clone 'BBB'. Retry scheduled\nCloning into '/tmp/renovate/repos/bitbucket/my-bitbucket-workspace/AAA/BBB'...\nremote: Invalid credentials\nfatal: Authentication failed for 'https://**redacted**@bitbucket.org:my-bitbucket-workspace/BBB.git' into submodule path '/tmp/renovate/repos/bitbucket/my-bitbucket-workspace/AAA/BBB' failed\nFailed to clone 'BBB' a second time, aborting\n\n    at Object.action (/opt/containerbase/tools/renovate/37.0.3/node_modules/simple-git/src/lib/plugins/error-detection.plugin.ts:42:29)\n    at PluginStore.exec (/opt/containerbase/tools/renovate/37.0.3/node_modules/simple-git/src/lib/plugins/plugin-store.ts:29:29)\n    at /opt/containerbase/tools/renovate/37.0.3/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:127:42\n    at new Promise (<anonymous>)\n    at GitExecutorChain.handleTaskData (/opt/containerbase/tools/renovate/37.0.3/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:124:14)\n    at GitExecutorChain.<anonymous> (/opt/containerbase/tools/renovate/37.0.3/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:100:40)\n    at Generator.next (<anonymous>)\n    at fulfilled (/opt/containerbase/tools/renovate/37.0.3/node_modules/simple-git/dist/cjs/index.js:55:24)\n    at processTicksAndRejections (node:internal/process/task_queues:95:5)"
       }
DEBUG: Error updating file (repository=my-bitbucket-workspace/AAA, branch=renovate/BBB-digest)

Have you created a minimal reproduction repository?

Placeholder value, please select the correct response from the dropdown

[marverix]

Can we convert this to an Issue?

[viceice]

configure the x-auth-token as username and the token as password

[tiberium]

Hi @viceice ,
I tried this way:

hostRules: [ 
    {
        "matchHost": "bitbucket.org",
        "username": "x-token-auth",
        "password": "XYZ"
    }
]

Unfortunately, it didn't work, this way even the submodule's new digest (d9357cd...) was not calculated by Renovate (in the above example it was).

This is the error (I tried with different Renovate versions, this log comes from 37.50.2):

             "message": "remote: Invalid credentials\nfatal: Authentication failed for 'https://bitbucket.org/my-bitbucket-workspace/BBB.git/'\n",
             "stack": "Error: remote: Invalid credentials\nfatal: Authentication failed for 'https://bitbucket.org/my-bitbucket-workspace/BBB.git/'\n\n    at Object.action (/opt/containerbase/tools/renovate/37.50.2/node_modules/simple-git/src/lib/plugins/error-detection.plugin.ts:42:29)\n    at PluginStore.exec (/opt/containerbase/tools/renovate/37.50.2/node_modules/simple-git/src/lib/plugins/plugin-store.ts:29:29)\n    at /opt/containerbase/tools/renovate/37.50.2/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:127:42\n    at new Promise (<anonymous>)\n    at GitExecutorChain.handleTaskData (/opt/containerbase/tools/renovate/37.50.2/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:124:14)\n    at GitExecutorChain.<anonymous> (/opt/containerbase/tools/renovate/37.50.2/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:100:40)\n    at Generator.next (<anonymous>)\n    at fulfilled (/opt/containerbase/tools/renovate/37.50.2/node_modules/simple-git/dist/cjs/index.js:55:24)\n    at processTicksAndRejections (node:internal/process/task_queues:95:5)"

Any other ideas? Updating simple-git would not fix that, right?

[viceice]

Do you have other hostrules which can interfere?

[tiberium]

No, I didn't have any additional host rules. The issue is no relevant for me any more since I don't use Bitbucket any more. Thanks for the support!