Private Docker and Helm repositories authentification issue

[olga-salesloft]

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

renovatebot/[email protected]

Please tell us more about your question or problem

I'd like to configure auth to access private docker and helm repository by using Github org secrets but I wasn't able to find any clear documentation.
Please
Here is self-hosted workflow:

    steps:
      - name: Checkout
        uses: actions/[email protected]
      - name: Self-hosted Renovate
        uses: renovatebot/[email protected]
        env:
          RENOVATE_REPOSITORIES: ${{ GITHUB.repository }}
          RENOVATE_REQUIRE_CONFIG: optional 
          RENOVATE_DETECT_HOST_RULES_FROM_ENV: true
          
        with:
          configurationFile: .github/renovate.json
          token: ${{ GITHUB.token }}          
          RENOVATE_USERNAME: ${{ GITHUB.SL_QA_DOCKER_USER }}
          RENOVATE_PASSWORD: ${{ GITHUB.SL_QA_DOCKER_TOKEN }}
          RENOVATE_TOKEN: ${{ GITHUB.MIX_GITHUB_ACCESS_TOKEN }}

Here is the renovate.json

{
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
    "extends": [
      "config:recommended", 
      ":dependencyDashboard"
    ],
    "hostRules": [
      {
        "matchHost": "https://raw.githubusercontent.com/<reducted>/helm-charts/release",
        "hostType": "helm",
        "token": "MIX_GITHUB_ACCESS_TOKEN"
      },
      {
        "matchHost": "registry.<reducted>.com",
        "hostType": "docker",
        "username": "SL_QA_DOCKER_USER",
        "password": "SL_QA_DOCKER_TOKEN"
        }
     ],
     "labels": [
      "dependencies"
    ],
    "groupName": "dependencies",
    "enabledManagers": [
      "helm-values"
    ],
    "helm-values": {
      "enabled": true,
      "pinDigests": true
    }
  }

Kindly asking for guidance on configuring env with secret.

Logs (if relevant)

  Status: Downloaded newer image for ghcr.io/renovatebot/renovate:latest
 INFO: Repository started (repository=<reducted>/<reducted>)
       "renovateVersion": "37.413.3"
 INFO: Dependency extraction complete (repository=<reducted>/<reducted>, baseBranch=main)
       "stats": {
         "managers": {"helm-values": {"fileCount": 20, "depCount": 31}},
         "total": {"fileCount": 20, "depCount": 31}
       }
 INFO: Docker Hub lookup failure (repository=<reducted>/<reducted>)
       "err": {
         "name": "HTTPError",
         "code": "ERR_NON_2XX_3XX_RESPONSE",
         "timings": {
           "start": 1718913233319,
           "socket": 1718913233319,
           "lookup": 1718913233321,
           "connect": 1718913233328,
           "secureConnect": 1718913233337,
           "upload": 1718913233337,
           "response": 1718913233347,
           "end": 1718913233347,
           "phases": {
             "wait": 0,
             "dns": 2,
             "tcp": 7,
             "tls": 9,
             "request": 0,
             "firstByte": 10,
             "download": 0,
             "total": 28
           }
         },
         "message": "Response code 401 (Unauthorized)",
         "stack": "HTTPError: Response code 401 (Unauthorized)\n    at Request.<anonymous> (/usr/local/renovate/node_modules/.pnpm/[email protected]/node_modules/got/dist/source/as-promise/index.js:118:42)\n    at processTicksAndRejections (node:internal/process/task_queues:95:5)",
         "options": {
           "headers": {
             "user-agent": "RenovateBot/37.413.3 (https://github.com/renovatebot/renovate)",
             "accept": "application/json",
             "authorization": "***********",
             "accept-encoding": "gzip, deflate, br"
           },
           "url": "https://index.docker.io/v2/library/registry.<reducted>.com/tags/list?n=10000",
           "hostType": "docker",
           "username": "",
           "password": "",
           "method": "GET",
           "http2": false
         },
         "response": {
           "statusCode": 401,
           "statusMessage": "Unauthorized",
           "body": {
             "errors": [
               {
                 "code": "UNAUTHORIZED",
                 "message": "authentication required",
                 "detail": [
                   {
                     "Type": "repository",
                     "Class": "",
                     "Name": "library/registry.<reducted>.com",
                     "Action": "pull"
                   }
                 ]
               }
             ]
           },
           "headers": {
             "content-type": "application/json",
             "docker-distribution-api-version": "registry/2.0",
             "www-authenticate": "***"https://auth.docker.io/token\",service=\"registry.docker.io\",scope=\"repository:library/registry.qasalesloft.com:pull\",error=\"insufficient_scope\"",
             "date": "Thu, 20 Jun 2024 19:53:53 GMT",
             "content-length": "175",
             "strict-transport-security": "max-age=31536000",
             "connection": "close"
           },
           "httpVersion": "1.1",
           "retryCount": 0
         }

[secustor]

There is something not correctly parsed in your helm-values file.
"url": "https://index.docker.io/v2/library/registry.<reducted>.com/tags/list?n=10000",
Looks like your registry has been detected as depName/packageName

[olga-salesloft]

Thank you for response.
I've updated renovate.json

{
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
    "packageRules": [
      {
        "matchDatasources": ["docker"],
        "registryUrls": ["https://registry.<reducted>.com"]
      }
    ]
  }

It looks like it worked since I don't see the error "url": "https://index.docker.io/v2/library/registry.<reducted>.com/tags/list?n=10000".
But it's not clear how to configure docker user/password. I've added env in self-hosted workflow

    steps:
      - name: Checkout
        uses: actions/[email protected]
      - name: Self-hosted Renovate
        uses: renovatebot/[email protected]
        env:
          RENOVATE_REPOSITORIES: ${{ GITHUB.repository }}
          RENOVATE_REQUIRE_CONFIG: optional 
          RENOVATE_HOST_RULES: '[{"matchHost": "https://registry.<reducted>.com"}]'
          RENOVATE_DOCKER_REGISTRY_QASALESLOFT_COM_USERNAME: ${{ secrets.SL_QA_DOCKER_USER }}
          RENOVATE_DOCKER_REGISTRY_QASALESLOFT_COM_PASSWORD: ${{ secrets.SL_QA_DOCKER_TOKEN }}
        with:
          configurationFile: .github/renovate.json
          token: ${{ GITHUB.token }}

however renovate still is not able to auth private docket repository.
here is the logs:

Status: Downloaded newer image for ghcr.io/renovatebot/renovate:latest
 INFO: Repository started (repository=SalesLoft/kubernetes-argocd-qa)
       "renovateVersion": "37.415.0"
 INFO: Dependency extraction complete (repository=SalesLoft/kubernetes-argocd-qa, baseBranch=main)
       "stats": {
         "managers": {
           "github-actions": {"fileCount": 5, "depCount": 21},
           "helm-values": {"fileCount": 20, "depCount": 31}
         },
         "total": {"fileCount": 25, "depCount": 52}
       }
 WARN: App has not been granted permissions to update Workflows - aborting branch. (repository=SalesLoft/kubernetes-argocd-qa, branch=renovate/actions-checkout-4.x)
 WARN: App has not been granted permissions to update Workflows - aborting branch. (repository=SalesLoft/kubernetes-argocd-qa, branch=renovate/renovatebot-github-action-40.x)
 WARN: App has not been granted permissions to update Workflows - aborting branch. (repository=SalesLoft/kubernetes-argocd-qa, branch=renovate/azure-setup-helm-4.x)
 WARN: App has not been granted permissions to update Workflows - aborting branch. (repository=SalesLoft/kubernetes-argocd-qa, branch=renovate/azure-setup-kubectl-4.x)
 WARN: Package lookup failures (repository=SalesLoft/kubernetes-argocd-qa)
       "warnings": [
         "Failed to look up docker package registry.qasalesloft.com/salesloft-argocd",
       ],
       "files": [
         "application-sets/clusters/base/actions-runner-system/values.yaml",
 INFO: Repository finished (repository=SalesLoft/kubernetes-argocd-qa)
       "cloned": true,
       "durationMs": 19486
 INFO: Renovate was run at log level "info". Set LOG_LEVEL=debug in environment variables to see extended debug logs.

Is there any documentation how to pass Github secret?

[viceice]

https://github.com/renovatebot/github-action?tab=readme-ov-file#github-action-renovate

[viceice]

@rarkins you probably should update the market place version to contain the current readme

[rarkins]

URL is https://github.com/marketplace/actions/renovate-bot-github-action

I don't see any differences nor how to update that readme if there were