How to disable artifact auth for Github in composer?

[micheh]

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us what version of Renovate you run.

37.59.2

If you're self-hosting Renovate, select which platform you are using.

GitLab self-hosted

Was this something which used to work for you, and then stopped?

I never saw this working

Wanted end result.

Hello

I have set the environment variable GITHUB_COM_TOKEN to fetch the change logs. However, this leads to an error when using composer with the symfony/flex plugin, as this plugin will download a JSON file from Github during composer install. But this request will fail with the following error:

The "https://raw.githubusercontent.com/symfony/recipes/flex/main/index.json" file could not be downloaded (HTTP/2 404 )

The update will fail and Renovate will report the error as Composer requirements cannot be resolved.

What you tried so far.

The error seems to be related to the Github token: https://stackoverflow.com/questions/74983748/composer-cannot-download-flex-recipes-json-file-404-vs-curl-200-ok

Indeed, when I remove the environment variable of the Github token, everything works as expected.

Is it possible to remove or ignore the Github token from the artifact auth (COMPOSER_AUTH env variable, which is generated by Renovate), while still keeping the GITHUB_COM_TOKEN to get the change logs? Maybe by changing the hostRules somehow, just for composer?

Relevant debug logs

No response

[rarkins]

I'm not sure it's possible to disable this auth currently. It would be good to understand exactly why the failure happens, if the GitHub.com token is valid

[micheh]

I believe the solution is using the new Fine-grained personal access tokens (beta) instead of the previous classic token.

The classic personal access token works fine when using the Github API, but does not seem to support fetching contents from raw.githubusercontent.com.

When using the new Fine-grained personal access tokens (beta), both the API and the fetching of resources from raw.githubusercontent.com seems to work.