Relative path in helmfile leads to Renovate file-access-violation-error

[medy75]

Reproduction setup

https://github.com/medy75/renovate_relative_path_file-access-violation-error

What would you like help with?

I think I found a bug

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

GitLab, local

Please tell us more about your question or problem

Having a helmfile.yaml with few releases:

releases:
  - name: task-service
    chart: ../tasks/helm/tasks
    namespace: {{ .Namespace }}
    values:
    - image:
        pullPolicy: Always

  - name: storage
    chart: harbor/storage
    version: 2.0.0

and I want to configure Renovate to renew storage version if available (from Harbor).

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:base"],
  "enabledManagers": ["helmfile"],
  "dependencyDashboard": false,
  "rebaseWhen": "behind-base-branch",
  "prConcurrentLimit": 10,
  "prHourlyLimit": 100,
  "commitBody": "Changelog: Storage dep",
  "automergeStrategy": "merge-commit",
  "hostRules": [],
  "baseBranches": [
    "main"
  ],
  "packageRules": [
    {
      "matchUpdateTypes": [
        "major",
        "minor"
      ],
      "automerge": false,
      "autoApprove": false
    }
  ]
}

but when I run it, Renovate fails with error:
LOG_LEVEL=debug renovate --platform=local --dry-run=true
output:

DEBUG: Preventing access to file outside allowed directory (repository=local)
       "path": "/Users/my.name/IdeaProjects/tasks/helm/tasks/kustomization.yaml",
       "allowedDir": "/Users/my.name/IdeaProjects/data-catalog-saas-helmfile"
ERROR: Repository has unknown error (repository=local)
       "err": {
         "message": "file-access-violation-error",
         "stack": "Error: file-access-violation-error\n    at assertBaseDir (/opt/homebrew/lib/node_modules/renovate/lib/util/fs/util.ts:12:11)\n    at ensurePath (/opt/homebrew/lib/node_modules/renovate/lib/util/fs/util.ts:21:3)\n    at ensureLocalPath (/opt/homebrew/lib/node_modules/renovate/lib/util/fs/util.ts:26:10)\n    at localPathExists (/opt/homebrew/lib/node_modules/renovate/lib/util/fs/index.ts:118:31)\n    at localChartHasKustomizationsYaml (/opt/homebrew/lib/node_modules/renovate/lib/modules/manager/helmfile/utils.ts:27:25)\n    at Object.extractPackageFile (/opt/homebrew/lib/node_modules/renovate/lib/modules/manager/helmfile/extract.ts:75:49)\n    at extractPackageFile (/opt/homebrew/lib/node_modules/renovate/lib/modules/manager/index.ts:75:9)\n    at getManagerPackageFiles (/opt/homebrew/lib/node_modules/renovate/lib/workers/repository/extract/manager-files.ts:58:43)\n    at /opt/homebrew/lib/node_modules/renovate/lib/workers/repository/extract/index.ts:57:28\n    at async Promise.all (index 2)\n    at extractAllDependencies (/opt/homebrew/lib/node_modules/renovate/lib/workers/repository/extract/index.ts:54:26)\n    at extract (/opt/homebrew/lib/node_modules/renovate/lib/workers/repository/process/extract-update.ts:140:28)\n    at extractDependencies (/opt/homebrew/lib/node_modules/renovate/lib/workers/repository/process/index.ts:154:26)\n    at Object.renovateRepository (/opt/homebrew/lib/node_modules/renovate/lib/workers/repository/index.ts:69:9)\n    at attributes.repository (/opt/homebrew/lib/node_modules/renovate/lib/workers/global/index.ts:218:11)\n    at start (/opt/homebrew/lib/node_modules/renovate/lib/workers/global/index.ts:203:7)\n    at /opt/homebrew/lib/node_modules/renovate/lib/renovate.ts:18:22"
       }
DEBUG: Repository result: unknown-error, status: onboarded, enabled: true, onboarded: true 

and I have no idea why and how to prevent it. The interersting part for me is

"path": "/Users/my.name/IdeaProjects/tasks/helm/tasks/kustomization.yaml"
which leads me that it's something with a relative path chart: ../tasks/helm/tasks in my helmfile.yaml. I tried to find a solution in doc, Google it, I also tried to find some renovate files which I can copy, but no luck.

Logs (if relevant)

No response

[rarkins]

Is that file inside or outside the repo?

[medy75]

yes, "path": "/Users/my.name/IdeaProjects/tasks/helm/tasks/kustomization.yaml" is outside of this repo (it even doesn't exist in my local setup, I have no idea where it gets kustomization.yaml file)

[rarkins]

So renovate is blocking access to files outside the repository. You could try using logLevelRemap to change it from error to trace if you want to ignore it

[medy75]

I tried, but the problem is that with this error (no matter what level it is) I am missing this part in logs:

DEBUG: packageFiles with updates (repository=local)
       "config": {
         "helmfile": [
           {
             "deps": [
               {
                 "depName": "storage",
                 "currentValue": "2.0.0",
                 "registryUrls": ["harbor.xxx.dev/saas/helm"],
                 "datasource": "docker",
                 "packageName": "harbor.xxx.dev/saas/helm/storage",
                 "updates": [],
                 "versioning": "docker",
                 "warnings": [],
                 "registryUrl": "https://harbor.xxx.dev",
                 "lookupName": "saas/helm/storage",
                 "currentVersion": "2.0.0",
                 "fixedVersion": "2.0.0"
               }
             ],
             "datasource": "helm",
             "packageFile": "helmfile.yaml"
           }
         ]
       }

which tells me that it found something to "renovate". That error with relative path completely stops the execution :(

[medy75]

When I remove a relative path from my helmfile, it works fine, but this chart: ../tasks/helm/tasks is a problem that Renovate cannot handle.

[medy75]

https://github.com/medy75/renovate_relative_path_file-access-violation-error

[github-actions[bot]]

Hi there,

Get your discussion fixed faster by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues.

Please follow these steps:

1. Read our guide on creating a minimal reproduction.
2. Go to our minimal reproduction template repository.
3. Select the Use this template button to create a new repository based on the template.
4. Work on the minimal reproduction in your own repository.
5. Fill out the information in your repository's README.md.
6. Add the link to your reproduction to the first post of your Discussion. If you are not the original author, you can post a new comment with the link.

Good luck,

The Renovate team

[medy75]

https://github.com/medy75/renovate_relative_path_file-access-violation-error

[rarkins]

Converted to issue: #29814