Post Upgrade Command Not Allowed Even Though It Should Be

[jpgoelz]

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us what version of Renovate you run.

37.45.0

If you're self-hosting Renovate, select which platform you are using.

GitLab self-hosted

Was this something which used to work for you, and then stopped?

I never saw this working

Wanted end result.

We enabled post upgrade commands and want to use them to update Angular in a subdirectory. For this, we want to switch directories using the cd <subdir> command, but it is not recognized as an allowed command.

However, because our frontend is located in a frontend subdirectory, npm complains that it cannot find the needed files.

We thought, adding the cd <subdir> command should allow us to switch directories, but Renovate says, the command is not allowed.

What you tried so far.

We followed the example from the Renovate docs for allowPostUpgradeCommandTemplating.

Our config.js is currently configured like this:

module.exports = {
  endpoint: process.env.CI_API_V4_URL,
  hostRules: [
    {
      matchHost: /* removed for this post */,
      token: process.env.RENOVATE_TOKEN,
    },
  ],
  "helm-values": {
    fileMatch: [
      "(^|/)values.yaml$",
      "(^|/)values-dev.yaml$",
      "(^|/)values-test.yaml$",
      "(^|/)values-prod.yaml$",
    ],
  },
  platform: "gitlab",
  username: /* removed for this post */,
  gitAuthor: /* removed for this post */,
  autodiscover: false,
  allowPostUpgradeCommandTemplating: true,
  allowedPostUpgradeCommands: [
    "^cd [\w-]([\w-]+)*$",
    "^npm ci --ignore-scripts$",
    "^npx ng update",
  ],
  repositories: [
    /* removed for this post */
  ],
};

It looks like Renovate is able to run the npm ci and npx commands but changing the directory does not work, which is why running the npm commands does not work:

Post-upgrade command 'cd frontend' has not been added to the allowed list in allowedPostUpgradeCommands

Command failed: npm ci --ignore-scripts
npm ERR! code EUSAGE
npm ERR! 
npm ERR! The `npm ci` command can only install with an existing package-lock.json or
npm ERR! npm-shrinkwrap.json with lockfileVersion >= 1. Run an install with npm@5 or
npm ERR! later to generate a package-lock.json file, then try again.
...

Command failed: npx ng update @angular/core --from=16.2.9 --to=16.2.10 --migrate-only --allow-dirty --force
npm ERR! could not determine executable to run
...

The regex for the cd command should match our needs. I have tested that using regexr.com:

Relevant debug logs

Logs

Copy/paste the relevant log(s) here, between the starting and ending backticks

[github-actions[bot]]

Hi there,

This issue or discussion is missing some logs, making it difficult or impossible to help you. Depending on which situation applies follow one, some or all of these instructions.

No logs at all

If you haven't posted any log yet, we need you to find and copy/paste the log into the issue template.

Finding logs on hosted app

Select me to read instructions

If you use the Renovate app (GitHub):

1. Go to the affected PR, and search for "View repository job log here"
2. Select the link to go to the "Mend Renovate Dashboard" and log in
3. You are now in the correct repository log overview screen
4. Copy/paste the correct log
5. Follow the steps in the formatting your logs section

Finding logs when self-hosting

Select me to read instructions

If you're running self-hosted, run with LOG_LEVEL=debug in your environment variables and search for whatever dependency/branch/PR that is causing the problem.

Insufficient logs

Select me to read instructions

If you already gave us a log, and the Renovate team said it's not enough, then follow the instructions from the No logs at all section.

Formatting your logs

Select me to read instructions

Please put your logs in a <details> and <summary> element like this:

<details><summary>Select me to see logs</summary>

```
Copy/paste your logs here, between the starting and ending backticks
```

</details>

Good luck,

The Renovate team

[rarkins]

Need logs showing:

• startup debug to verify that the allowed commands are read as expected
• full debug logs at time when the commands are attempted and failed

[jpgoelz]

I do not have access to the logs. However, the problem seems to be resolved.

We removed the cd command and now Renovate did not post a comment about not being able to run commands or error messages from running allowed commands.

Unfortunately, I cannot reconstruct the message Renovate posted that led to us trying to change the directory in the first place.

I consider this post resolved for now.