Self-Hosted: "No docker auth found" and "Failed to look up github-tags"

[cdenneen]

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

GitLab

Please tell us more about your question or problem

shared renovate-config:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:best-practices",
    ":rebaseStalePrs"
  ],
  "ignorePaths": [
  ],
  "hostRules": [
    {
      "matchHost": "github.com",
      "token": "{{ process.env.GITHUB_COM_TOKEN }}"
    },
    {
      "hostType": "docker",
      "matchHost": "private.jfrog.io",
      "username": "{{ process.env.CI_REGISTRY_USER }}",
      "password": "{{ process.env.CI_REGISTRY_PASSWORD }}"
    },
    {
      "hostType": "docker",
      "matchHost": "docker.io",
      "token": "{{ process.env.DOCKER_HUB_PASSWORD }}"
    }
  ]
}

project renovate.json:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "local>gitops/renovate-config"
  ],
  "ignorePaths": [
  ],
  "kubernetes": {
    "fileMatch": ["infrastructure","external-config-data","config","special"]
  },
  "flux": {
    "fileMatch": ["clusters","infrastructure","external-config-data","config","special"]
  }
}

run:

docker run --rm -ti -e CI_REGISTRY_USER=$CI_REGISTRY_USER -e CI_REGISTRY_PASSWORD=$CI_REGISTRY_PASSWORD -e GITHUB_COM_TOKEN=$GITHUB_TOKEN -e RENOVATE_PLATFORM=gitlab -e RENOVATE_ENDPOINT=$GITLAB_API -e RENOVATE_TOKEN=$RENOVATE_TOKEN -e DOCKER_HUB_PASSWORD=$DOCKER_HUB_TOKEN -e RENOVATE_ONBOARDING=true ghcr.io/renovatebot/renovate:37.275.0 gitops/cluster/workloads
 INFO: Repository started (repository=gitops/cluster/workloads)
       "renovateVersion": "37.275.0"
 INFO: Dependency extraction complete (repository=gitops/cluster/workloads, baseBranch=main)
       "stats": {
         "managers": {
           "flux": {"fileCount": 41, "depCount": 41},
           "kubernetes": {"fileCount": 134, "depCount": 137}
         },
         "total": {"fileCount": 175, "depCount": 178}
       }
 WARN: No docker auth found - returning (repository=gitops/cluster/workloads)
 WARN: Error updating branch: update failure (repository=gitops/cluster/workloads, branch=renovate/pin-dependencies)
 WARN: Package lookup failures (repository=gitops/cluster/workloads, branch=renovate/external-secrets-0.x)
       "warnings": ["Failed to look up github-tags package traefik/traefik-helm-chart"],
       "files": ["infrastructure/base/traefik/repository.yaml"]
 WARN: Package lookup failures (repository=gitops/cluster/workloads, branch=renovate/fluent-bit-0.x)
       "warnings": ["Failed to look up github-tags package traefik/traefik-helm-chart"],
       "files": ["infrastructure/base/traefik/repository.yaml"]
 WARN: Package lookup failures (repository=gitops/cluster/workloads)
       "warnings": ["Failed to look up github-tags package traefik/traefik-helm-chart"],
       "files": ["infrastructure/base/traefik/repository.yaml"]
 INFO: Repository finished (repository=gitops/cluster/workloads)
       "cloned": true,
       "durationMs": 9667
 INFO: Renovate was run at log level "info". Set LOG_LEVEL=debug in environment variables to see extended debug logs.

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[rarkins]

Repo config cannot read process.env

[cdenneen]

@rarkins how would I handle this in order to test functionality?

[rarkins]

Define such hostRules in global config, such as config.js. There you can access env.

[cdenneen]

@rarkins ok changed process.env.VARIABLE to secret.VARIABLE for all in the above shared config but now getting the following error:

 INFO: Repository has invalid config (repository=gitops/cluster/workloads)
       "error": {
         "validationSource": "config",
         "validationError": "Unknown secret name",
         "validationMessage": "The following secret name was not found in config: GITHUB_COM_TOKEN",
         "message": "config-validation",
         "stack": "Error: config-validation\n    at /usr/local/renovate/lib/config/secrets.ts:76:19\n    at RE2.Symbol.replace.RE2.<computed> (/usr/local/renovate/node_modules/.pnpm/re2@1.20.10/node_modules/re2/re2.js:16:19)\n    at String.replace (<anonymous>)\n    at replaceSecretsInString (/usr/local/renovate/lib/config/secrets.ts:72:16)\n    at replaceSecretsInObject (/usr/local/renovate/lib/config/secrets.ts:100:21)\n    at replaceSecretsInObject (/usr/local/renovate/lib/config/secrets.ts:105:31)\n    at applySecretsToConfig (/usr/local/renovate/lib/config/secrets.ts:131:10)\n    at mergeRenovateConfig (/usr/local/renovate/lib/workers/repository/init/merge.ts:234:40)\n    at processTicksAndRejections (node:internal/process/task_queues:95:5)\n    at getRepoConfig (/usr/local/renovate/lib/workers/repository/init/config.ts:14:12)\n    at initRepo (/usr/local/renovate/lib/workers/repository/init/index.ts:55:12)\n    at Object.renovateRepository (/usr/local/renovate/lib/workers/repository/index.ts:62:14)\n    at attributes.repository (/usr/local/renovate/lib/workers/global/index.ts:212:11)\n    at start (/usr/local/renovate/lib/workers/global/index.ts:197:7)\n    at /usr/local/renovate/lib/renovate.ts:18:22"
       }

so I change the run to be:

❯ docker run --rm -ti -e CI_REGISTRY_USER=$CI_REGISTRY_USER -e CI_REGISTRY_PASSWORD=$CI_REGISTRY_PASSWORD -e GITHUB_COM_TOKEN=$GITHUB_TOKEN -e RENOVATE_PLATFORM=gitlab -e RENOVATE_ENDPOINT=$GITLAB_API -e RENOVATE_TOKEN=$RENOVATE_TOKEN -e DOCKER_HUB_PASSWORD=$DOCKER_HUB_PASSWORD -e LOG_LEVEL=debug ghcr.io/renovatebot/renovate:37.275.0 gitops/cluster/workloads --secrets "{GITHUB_COM_TOKEN: \"$GITHUB_TOKEN\", CI_REGISTRY_USER: \"$CI_REGISTRY_USER\", CI_REGISTRY_PASSWORD: \"$CI_REGISTRY_PASSWORD\", DOCKER_HUB_PASSWORD: \"$DOCKER_HUB_PASSWORD\"}"

Fixed my changelog issues and docker auth. Have different issue so we'll open new discussion on it.

However this is run this way from docker locally. Not sure best way to run this via a gitlab-ci schedule job though. Guess I could set the SECRETS environment variable so it does the expansion on this.

[rarkins]

If setting env is a challenge then use a config.js file

[github-actions[bot]]

Hi there,

This is intended as a polite, automated request that users avoid @ mentioning repository maintainers like @rarkins or @viceice. Doing so causes annoying mobile notifications and makes it harder to maintain this repository.

We know it might be common elsewhere but we participate in hundreds of discussions a week and would need to turn off GitHub mobile notifications if we were mentioned in every one.

As a general rule, we will read and respond to all discussions in this repository, so there is no need to mention us.

Thanks, the Renovate team