Token Not Being Recognized in hostRules Section

[calibratedcat]

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

GitLab

Please tell us more about your question or problem

I am encountering an issue with the hostRules section of my config.js, specifically when trying to use environment variables for the matchHost and token. The expected behavior is that Renovate would use these environment variables to authenticate against a self-hosted GitLab instance and fetch updates for dependencies.
This issue occurs even when the token and matchHost is provided in plain text directly within the hostRules configuration. Interestingly, specifying the token in plain text within the npmrc configuration works as expected.

Non-working configuration:

module.exports = {
  hostRules: [
    {
      matchHost: process.env.CI_API_V4_URL,
      hostType: 'npm',
      token: process.env.RENOVATE_TOKEN,
    },
  ],
  "npmrc": "@zodia:registry=https://gitlab.private.zodiamarkets.xyz/api/v4/packages/npm/",
};

Working configuration (with auth token hardcoded):

module.exports = {
  "npmrc": "//gitlab.private.zodiamarkets.xyz/:_authToken=**redacted**\n@zodia:registry=https://gitlab.private.zodiamarkets.xyz/api/v4/packages/npm/",
};

Error from debug logs:

{"name":"renovate","hostname":"runner-pkkfyp-jz-project-602-concurrent-0","pid":18,"level":20,"logContext":"7JTE_zBr_rCDMuVJhVI46","repository":"alex/ops-front-2","branch":"renovate/npm-run-all-replacement","commands":["pnpm install --recursive --lockfile-only --ignore-scripts --ignore-pnpmfile"],"err":{"cmd":"/bin/sh -c pnpm install --recursive --lockfile-only --ignore-scripts --ignore-pnpmfile","stderr":"","stdout":"Progress: resolved 1, reused 0, downloaded 0, added 0\nundefined\n ERR_PNPM_FETCH_404  GET https://**redacted**@zodia/zui/-/@zodia/zui-0.2.32.tgz: Not Found - 404\n\nThis error happened while installing a direct dependency of /builds/zodia/renovate-bot/renovate/repos/gitlab/alex/ops-front-2\n\nNo authorization header was set for the request.\n","options":{"cwd":"/builds/zodia/renovate-bot/renovate/repos/gitlab/alex/ops-front-2","encoding":"utf-8","env":{"NPM_CONFIG_CACHE":"/builds/zodia/renovate-bot/renovate/cache/others/npm","npm_config_store":"/builds/zodia/renovate-bot/renovate/cache/others/pnpm","HOME":"/home/ubuntu","PATH":"/home/ubuntu/.cargo/bin:/home/ubuntu/.local/bin:/go/bin:/home/ubuntu/bin:/home/ubuntu/.npm-global/bin:/home/ubuntu/.cargo/bin:/home/ubuntu/.local/bin:/go/bin:/home/ubuntu/bin:/home/ubuntu/.npm-global/bin:/home/ubuntu/.cargo/bin:/home/ubuntu/.local/bin:/go/bin:/home/ubuntu/bin:/home/ubuntu/.npm-global/bin:/home/ubuntu/.cargo/bin:/home/ubuntu/.local/bin:/go/bin:/home/ubuntu/bin:/home/ubuntu/.npm-global/bin:/home/ubuntu/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","LC_ALL":"C.UTF-8","LANG":"C.UTF-8","CONTAINERBASE_CACHE_DIR":"/builds/zodia/renovate-bot/renovate/cache/containerbase"},"maxBuffer":10485760,"timeout":900000},"exitCode":1,"name":"ExecError","message":"Command failed: pnpm install --recursive --lockfile-only --ignore-scripts --ignore-pnpmfile\n","stack":"ExecError: Command failed: pnpm install --recursive --lockfile-only --ignore-scripts --ignore-pnpmfile\n\n    at ChildProcess.<anonymous> (/usr/local/renovate/lib/util/exec/common.ts:99:11)\n    at ChildProcess.emit (node:events:529:35)\n    at ChildProcess.emit (node:domain:489:12)\n    at Process.ChildProcess._handle.onexit (node:internal/child_process:292:12)"},"type":"pnpm","msg":"lock file error","time":"2024-03-28T16:59:21.200Z","v":0}

Troubleshooting Attempts:

• Verified that the token has the correct permissions and works when used directly in .npmrc and in the npmrc field within config.js.

• Tested with the token provided both as an environment variable and in plain text within the hostRules to rule out issues related to environment variable parsing.

• Ensured that matchHost is correctly specified and matches the registry URL.

Any insights, suggestions, or guidance would be greatly appreciated. Thank you for your help!

[github-actions[bot]]

Hi there,

This issue or discussion is missing some logs, making it difficult or impossible to help you. Depending on which situation applies follow one, some or all of these instructions.

No logs at all

If you haven't posted any log yet, we need you to find and copy/paste the log into the issue template.

Finding logs on hosted app

Select me to read instructions

If you use the Mend Renovate app (GitHub):

1. Log in to the Mend Developer Portal
2. Navigate to the correct organization and repository
3. Locate the appropriate log (it may not always be the latest one)
4. Copy/paste the log contents
5. Follow the steps in the formatting your logs section

Finding logs when self-hosting

Select me to read instructions

If you're running self-hosted, run with LOG_LEVEL=debug in your environment variables and search for whatever dependency/branch/PR that is causing the problem.

Insufficient logs

Select me to read instructions

If you already gave us a log, and the Renovate team said it's not enough, then follow the instructions from the No logs at all section.

Formatting your logs

Select me to read instructions

Please put your logs in a <details> and <summary> element like this:

<details><summary>Select me to see logs</summary>

```
Copy/paste your logs here, between the starting and ending backticks
```

</details>

If you feel the logs are too large to paste here, please use a service like GitHub Gist and paste the link here.

Good luck,

The Renovate team

[rarkins]

We need more logs. If the renovate lookup works then the hostRules is probably working fine. Problem then is that renovate doesn't know how/where to pass any credentials to npm itself

[calibratedcat]

Forgot to mention: if I remove this line "npmrc": "@zodia:registry=https://gitlab.private.zodiamarkets.xyz/api/v4/packages/npm/" and leave just hostRules, it will try to download internal packages from public registry. Observed from logs: GET https://registry.npmjs.org/@zodia%2Fzui

[viceice]

matchHost and registry url need to be strictly equal

[calibratedcat]

I've also collected another example of debug logs (with better formatting and dashboard turned off) and the full config.js used for the run.
debug_logs_and_config.zip

[calibratedcat]

I have managed to fix it by writing matchHost in the following way.

module.exports = {
  hostRules: [
    {
      matchHost: "gitlab.private.zodiamarkets.xyz",
      hostType: 'npm',
      token: process.env.RENOVATE_TOKEN,
    },
  ],
  "npmrc": "@zodia:registry=https://gitlab.private.zodiamarkets.xyz/api/v4/packages/npm/",
  "extends": [":semanticCommits"],
};