How to configure renovate to scan gruntwork-io repos

[nadiia-kotelnikova]

Hey,

i am excited to use Patcher as soon as it is ready. But for now, i would like to configure Renovate and, unfortunately, cannot get it run. For me looks like renovate cannot scan private repos (most of our infrastructure-live modules point to gruntwork-io repos) although we have the subscription.

Is there any workaround? Or is it correct that it cannot be achieved with renovate and gruntwork-io modules? I saw also this "registryUrls": ["https://registry.dogfood-dev.com"] registry, can I use it somehow?

Thanks in advance!

---

Tracked in ticket #109867

[gitsstewart]

@nadiia-caspar what is it doing when you try to get it running? Does it throw an error?

[nadiia-kotelnikova]

here what i got:

    {
        "packageFile": "terragrunt.hcl",
        "deps": [
          {
            "depName": "gruntwork-io/terraform-aws-service-catalog",
            "packageName": "gruntwork-io/service-catalog/aws",
            "currentValue": "v0.88.1",
            "datasource": "terraform-module",
            "replaceString": "source = \"git::git@github.com:gruntwork-io/terraform-aws-service-catalog.git//modules/data-stores/rds?ref=v0.88.1\"",
            "depIndex": 0,
            "updates": [],
            "warnings": [
              {
                "topic": "gruntwork-io/terraform-aws-service-catalog",
                "message": "Failed to look up terraform-module dependency gruntwork-io/terraform-aws-service-catalog"
              }
            ],
            "versioning": "hashicorp"
          }
        ],
        "matchStrings": [
          "source\\s*=\\s*\".*?github\\.com.gruntwork-io/(?:(?<prefix>terraform)-(?<cloud>.+?)-)?(?<name>.+?)(?:\\.git)?(?:/.*?)?\\?ref=(?<currentValue>.*?)\""
        ],
        "depNameTemplate": "gruntwork-io/{{#if cloud}}terraform-{{cloud}}-{{/if}}{{name}}",
        "packageNameTemplate": "gruntwork-io/{{name}}/{{#if cloud}}{{cloud}}{{else}}aws{{/if}}",
        "datasourceTemplate": "terraform-module"
      }

And the DEBUG message:

DEBUG: Using queue: host=registry.dogfood-dev.com, concurrency=10
DEBUG: GET https://registry.dogfood-dev.com/v1/modules/gruntwork-io/service-catalog/aws/versions = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=404 retryCount=0, duration=1271)
DEBUG: Datasource 404
{
 "datasource": "terraform-module",
 "packageName": "gruntwork-io/service-catalog/aws",
 "url": "https://registry.dogfood-dev.com/v1/modules/gruntwork-io/service-catalog/aws/versions"
}
DEBUG: Failed to look up terraform-module dependency gruntwork-io/terraform-aws-service-catalog (gruntwork-io/terraform-aws-service-catalog)(packageFile="terragrunt.hcl", dependency="gruntwork-io/terraform-aws-service-catalog")

[gitsstewart]

I believe you are correct. Renovate would need to have its own access to our private repos, it doesn't run as if impersonating your credentials.

It is a less elegant solution that Patcher (or Renovate) but we do have a page on our website where you can check once a month for the latest releases, if that is helpful. https://docs.gruntwork.io/guides/stay-up-to-date/

[josh-padnick]

I believe Mend recommends running Renovate as a GitHub App to handle this access, however you could also configure Renovate to with a Personal Access Token directly in the configuration file. Of course, adding a Github Personal Access Token directly to the config file isn't ideal. Take a look at https://docs.renovatebot.com/getting-started/installing-onboarding/#hosted-githubcom-app and https://docs.renovatebot.com/modules/platform/github/#running-as-a-github-app for additional details.

We wrote our own trivial registry to run as a Serverless/Lambda app whose sole purpose is to look up private modules and return their versions; this way we could keep our creds in AWS.

Hope that helps!