Yarn authentication not working when using binarySource docker

[bobvandevijver]

What Renovate type, platform and version are you using?

We're using a self-hosted Gitlab instance and runners, with the latest (24.52.0) renovate docker images in a private gitlab runner.

Describe the bug

When using the slim image with binarySource set to docker, the yarn install fails with an authorization failed exception. This does not happen when the full image is used and the binarySource is set to global.

As a result, the created PRs do not contain the updated lock files.

Relevant debug logs

{"name":"renovate","hostname":"runner-kdwy7mh-project-43-concurrent-0","pid":15,"level":20,"logContext":"msgWDdI3o","repository":"extern/023-nanolab-nl","branch":"renovate/font-awesome","err":{"killed":false,"code":1,"signal":null,"cmd":"docker run --rm --name=renovate_node --label=renovate_child -v \"/builds/KdWY7M_h/0/intern/renovate-runner/renovate/repos/gitlab/extern/023-nanolab-nl\":\"/builds/KdWY7M_h/0/intern/renovate-runner/renovate/repos/gitlab/extern/023-nanolab-nl\" -v \"/builds/KdWY7M_h/0/intern/renovate-runner/renovate/cache\":\"/builds/KdWY7M_h/0/intern/renovate-runner/renovate/cache\" -e NPM_CONFIG_CACHE -e npm_config_store -e CI -w \"/builds/KdWY7M_h/0/intern/renovate-runner/renovate/repos/gitlab/extern/023-nanolab-nl\" docker.io/renovate/node bash -l -c \"npm i -g yarn && sed -i 's/ steps,/ steps.slice(0,1),/' /home/ubuntu/.npm-global/lib/node_modules/yarn/lib/cli.js && yarn install --ignore-engines --ignore-platform --network-timeout 100000 --ignore-scripts\"","stdout":"\n> yarn@1.22.10 preinstall /home/ubuntu/.npm-global/lib/node_modules/yarn\n> :; (node ./preinstall.js > /dev/null 2>&1 || true)\n\n/home/ubuntu/.npm-global/bin/yarn -> /home/ubuntu/.npm-global/lib/node_modules/yarn/bin/yarn.js\n/home/ubuntu/.npm-global/bin/yarnpkg -> /home/ubuntu/.npm-global/lib/node_modules/yarn/bin/yarn.js\n+ yarn@1.22.10\nadded 1 package in 0.613s\nyarn install v1.22.10\n[1/4] Resolving packages...\ninfo If you think this is a bug, please open a bug report with the information provided in \"/builds/KdWY7M_h/0/intern/renovate-runner/renovate/repos/gitlab/extern/023-nanolab-nl/yarn-error.log\".\ninfo Visit https://yarnpkg.com/en/docs/cli/install for documentation about this command.\n","stderr":"error An unexpected error occurred: \"https://**redacted**@fortawesome%2ffontawesome-free: authorization required to access package @fortawesome/fontawesome-free\".\n","message":"Command failed: docker run --rm --name=renovate_node --label=renovate_child -v \"/builds/KdWY7M_h/0/intern/renovate-runner/renovate/repos/gitlab/extern/023-nanolab-nl\":\"/builds/KdWY7M_h/0/intern/renovate-runner/renovate/repos/gitlab/extern/023-nanolab-nl\" -v \"/builds/KdWY7M_h/0/intern/renovate-runner/renovate/cache\":\"/builds/KdWY7M_h/0/intern/renovate-runner/renovate/cache\" -e NPM_CONFIG_CACHE -e npm_config_store -e CI -w \"/builds/KdWY7M_h/0/intern/renovate-runner/renovate/repos/gitlab/extern/023-nanolab-nl\" docker.io/renovate/node bash -l -c \"npm i -g yarn && sed -i 's/ steps,/ steps.slice(0,1),/' /home/ubuntu/.npm-global/lib/node_modules/yarn/lib/cli.js && yarn install --ignore-engines --ignore-platform --network-timeout 100000 --ignore-scripts\"\nerror An unexpected error occurred: \"https://**redacted**@fortawesome%2ffontawesome-free: authorization required to access package @fortawesome/fontawesome-free\".\n","stack":"Error: Command failed: docker run --rm --name=renovate_node --label=renovate_child -v \"/builds/KdWY7M_h/0/intern/renovate-runner/renovate/repos/gitlab/extern/023-nanolab-nl\":\"/builds/KdWY7M_h/0/intern/renovate-runner/renovate/repos/gitlab/extern/023-nanolab-nl\" -v \"/builds/KdWY7M_h/0/intern/renovate-runner/renovate/cache\":\"/builds/KdWY7M_h/0/intern/renovate-runner/renovate/cache\" -e NPM_CONFIG_CACHE -e npm_config_store -e CI -w \"/builds/KdWY7M_h/0/intern/renovate-runner/renovate/repos/gitlab/extern/023-nanolab-nl\" docker.io/renovate/node bash -l -c \"npm i -g yarn && sed -i 's/ steps,/ steps.slice(0,1),/' /home/ubuntu/.npm-global/lib/node_modules/yarn/lib/cli.js && yarn install --ignore-engines --ignore-platform --network-timeout 100000 --ignore-scripts\"\nerror An unexpected error occurred: \"https://**redacted**@fortawesome%2ffontawesome-free: authorization required to access package @fortawesome/fontawesome-free\".\n\n    at ChildProcess.exithandler (child_process.js:308:12)\n    at ChildProcess.emit (events.js:315:20)\n    at ChildProcess.EventEmitter.emit (domain.js:467:12)\n    at maybeClose (internal/child_process.js:1048:16)\n    at Process.ChildProcess._handle.onexit (internal/child_process.js:288:5)"},"type":"yarn","msg":"lock file error","time":"2021-02-17T20:57:24.332Z","v":0}

Have you created a minimal reproduction repository?

Please read the minimal reproductions documentation to learn how to make a good minimal reproduction repository.

• This is a really small bug, it does not need a reproduction (think small typo)
• I have provided a minimal reproduction repository
• I don't have time for that, but it happens in a public repository I have linked to
• I don't have time for that, and cannot share my private repository
• The nature of this bug means it's impossible to reproduce publicly

Additional context

The required .npmrc for authorisation on our private npm repository is created in the before_script part, and positioned in the root directory of the renovate runner.

[rarkins]

You need to add authentication using the npmrc field in Renovate's configuration. If it's to be done programmatically then you could use a config.js which reads from environment, for example (or even from file, perhaps, if you use a sync readFile)

[rarkins]

I've updated the source of those docs to correct that recommendation. It will be published by end of day.

The problem is that the .npmrc is not mapped into the sibling containers. You could try dockerMapDotfiles=true in config but it's likely to be deprecated in a future major release in favor of the hostRules approach.

[bobvandevijver]

Thanks, than that is clear. I did already open a PR to add the binarySource note (#8750), but if you do not want it due to the coming deprecation, feel free to close it.

[viceice]

Haha, I've opened a pr too 🙈 #8751

[rarkins]

Three fixes for one docs bug

[bobvandevijver]

Just to confirm: using the hostRules combined with a npmrc: "always-auth=true", in the config.js indeed fixed it 🎉