Custom Offline Dependencies: Allow Default Registry URL with file:// Prefix Accessible Anywhere

[danhlee329]

Tell us more.

Following up from discussion #27644 (comment), would like to request that the defaultRegistryUrlTemplate property with the file:// prefix (in it's value) be accessible anywhere as opposed to only from the cloned Github repo. There may be cases where the file could be provided outside of the target Github repo we want to apply Renovate to.

[rarkins]

@viceice if the bot admin allows it, why not?

[viceice]

path to repo is always allowed

[danhlee329]

forgot to mention in the discussion above that this could be done via configuration per previous discussion, whitelisting paths would be no issue for our use-case

[viceice]

the config option should have a big warning about security implications.

[danhlee329]

I feel that having a big warning about security implications will not make this a friendly nor inviting feature for users to consume. not saying that we shouldn't have a warning, just wondering if there is a way we can do this with better inherent security

[danhlee329]

I should note that this is not a blocker for us when we run Renovate as we're hosting a local nginx service that hosts our version file, which is accessible via the URL to the file in the property defaultRegistryUrlTemplate. I'd say that this request is not a biggie as long as we update the documentation stating that by using file://, it assumes that the file is local in the current GH repo.