Yarn "prepare" task fails with command not found

[amuttsch]

What Renovate type, platform and version are you using?

Self-hosted on GitLab using renovate/renovate:24.104.1-slim docker image.

Describe the bug

We have a yarn repository that recently updated husky to v6. From this version a prepare task is added automatically to activate any git hooks after the yarn install is done. This causes renovate bot to fail with an artifact error, as it doesn't find husky when creating a PR.

Relevant debug logs

• MR with artifact issue: https://gitlab.com/amuttsch_cc/renovate-yarn-husky/-/merge_requests/4
• Pipeline with debug logs: https://gitlab.com/amuttsch_cc/renovate-yarn-husky/-/jobs/1162279900

Have you created a minimal reproduction repository?

Yes: https://gitlab.com/amuttsch_cc/renovate-yarn-husky

It contains the renovate configuration, CI job that triggers renovate as well as the minimal package.json. You also find the MR with the error and the pipeline with debug logs above.

Additional context

We also tested if binarySource: 'docker' caused this issue. We removed it and it still causes this problem.

The issue only arises when renovate is creating a MR. If, for example, the hourly MR limit is reached, the error does not arise in the logs.

It seems like the yarn install is patched before executing:

sed -i 's/ steps,/ steps.slice(0,1),/' /home/ubuntu/.npm-global/lib/node_modules/yarn/lib/cli.js

This leads to the following output:

yarn@1.22.10
added 1 package in 0.647s
yarn install v1.22.10
[1/4] Resolving packages...
success Saved lockfile.
$ husky install
info Visit https://yarnpkg.com/en/docs/cli/install for documentation about this command.

It only resolves packages, but is not fetching and installing anything.

If we understand this correctly it just resolves packages and saves the lock file. This does not install any dependencies, but it still executed the prepare command. Since it didn't install anything, husky cannot be executed.

Documentation about the prepare task: https://classic.yarnpkg.com/en/docs/package-json/#toc-scripts

I think a check in the prepare if husky exists can be a workaround for this issue.

[viceice]

I think you don't want to run husky on renovate, so configure ignoreScripts=true.

if you need to run husky configure skipInstalls=false, so the yarn command is not optimized and does a full install.

[amuttsch]

Ahh okay, this should fix our issue, thanks!

[viceice]

Is there a reason to use trustLevel: 'high' ? if you remove that, you issue will resolve too.

[amuttsch]

Yes, because we access a private repository using .npmrc with environment substitution.

[viceice]

This is / will be deprecated in near future, so prepare to configure hostrules instead

[amuttsch]

Thanks for the hint. Does this support environment variables too? We don't want to include the token directly in our renovate.json. Is there an example for a .npmrc using hostRules somewhere? Thanks!

[viceice]

https://docs.renovatebot.com/private-modules/#add-hostrule-to-bots-config