dependabot could not clone private repository for swift that located same organization and granted access. #8027
Comments
r-plus
changed the title
jakecoffman
added
F: private-registries 💂♂️
|
I'm running into the same thing. @r-plus, have you found a workaround, by any chance? |
|
I think the fix for this should be a matter of replacing scp-style urls before shelling out to SwiftPM. As a workaround, can you try replacing the url with an https url? |
|
It's the same issue with https URLs, unfortunately. Dependabot just seems to ignore that we've given it access to the private repo which contains the private dependency. |
|
Did you replace it in both manifest and lockfile? Can you copy redacted logs, just to see what the errors with https look like? |
|
Yep, there's no trace of any non-https git URLs in our project. Package.swift: let package = Package(
[…]
dependencies: [
.package(url: "https://github.com/redacted-org/redacted-repo", exact: "0.4.8"),
[…]
]
[…]
)Package.resolved: […]
{
"identity" : "redacted-repo",
"kind" : "remoteSourceControl",
"location" : "https://github.com/redacted-org/redacted-repo",
"state" : {
"revision" : "redacted-sha",
"version" : "0.4.8"
}
},
[…]Logs: |
|
Ok, there's a workaround that was helpfully suggested to me by GitHub support: with a GH access token in Dependabot secrets, we can register GH as a package registry and use that instead of relying on setting permissions in org settings (which doesn't seem to work for SPM, so this issue should still be kept open). […]
registries:
github-private:
type: git
url: https://github.com
username: x-access-token
password: ${{secrets.GITHUB_TOKEN_NAME_REPLACE_ME}}
updates:
- package-ecosystem: "swift"
schedule:
interval: "daily"
registries:
- github-private
[…] |
|
Dependabot can now clone the private repository with the workaround suggested in #8027 (comment), but it still fails to authenticate when downloading a package from Github Package Registry (published via KMMBridge). Is this supported? I couldn't find any related info the docs. |
|
It's the same issue with https URLs & env GITHUB_TOKEN || env GITHUB_DEPENDABOT_CRED_TOKEN... url: "https://\(GITHUB_TOKEN)@github.com/\(repo).git"
url: "https://\(GITHUB_DEPENDABOT_CRED_TOKEN)@github.com/\(repo).git" |
Is there an existing issue for this?
Package ecosystem
swift
Package manager version
5.8
Language version
5.8
Manifest location and content before the Dependabot update
/Package.swiftrepository is
appbrew/try-dependabot-spm,appbrewis the organization name.and
Package.resolveddependabot.yml content
Updated dependency
try-dependabot-spm-privaterepo is not yet updated from 0.0.1, so I expect dependabot will not create pull request without error.What you expected to see, versus what you actually saw
I expect dependabot will not create pull request without error.
But dependabot will show repository clone error even if grant dependabot access to
try-dependabot-spm-privaterepo that describing in this docs.Native package manager behavior
no output without error.
Images of the diff or a link to the PR, issue, or logs
No response
Smallest manifest that reproduces the issue
No response
The text was updated successfully, but these errors were encountered: