The npmrc configuration is not used for postUpgradeTasks

[cascornelissen]

We have the following global Renovate configuration used in a self-hosted setup on Bitbucket Server/Bamboo. Renovate version at the time of testing is 32.10.3.

module.exports = {
    platform: 'bitbucket-server',
    endpoint: '<bitbucket-url>',
    constraints: {
        npm: '>= 8.0.0'
    },
    allowedPostUpgradeCommands: [
        '^npm ci --ignore-scripts$',
        '^npm run lint:fix --if-present$'
    ],
    hostRules: [{
        hostType: 'npm',
        matchHost: '<artifactory-url>',
        token: process.env.NPM_TOKEN
    }],
    npmrc: 'registry=<artifactory-url>'
}

As an example, our shared base configuration JSON contains a packageRule that looks like the following. The goal is to automatically try to fix any linting issues that are introduced in new versions.

{
    "groupName": "Linting packages",
    "matchPackagePatterns": ["eslint", "stylelint"],
    "postUpgradeTasks": {
        "commands": ["npm ci --ignore-scripts", "npm run lint:fix --if-present"],
        "executionMode": "branch"
    }
}

These dependencies should be fetched from <artifactory-url> which works correctly when updating the dependencies themselves but as soon as the npm ci --ignore-scripts postUpgradeTask kicks in it doesn't take the npmrc from the global configuration into account. Instead, it tries to connect to the official/default npm registry and returns 401s.

Is there any way to re-use the npmrc global configuration value to set up an npmrc file for the postUpgradeTasks? Or any other way around this? I noticed and read through #14446 but there hasn't been any comments on it for a month and I'm not 100% sure it's the exact same issue/solution.

[rarkins]

Renovate intentionally modifies the .npmrc file before running npm package manager commands, and then reverts its changes. If it didn't revert them, or somehow delayed that reversion, then your use case might work. But we'd need to think of any unintended side effects.

[cascornelissen]

Thanks for the reply! Anything I can do from my side? I'd love to get this out some day as it would save us a ton of manual labor executing these commands for dozens of repositories 😅

[rarkins]

You could try another way - set skipInstalls: false in your global config, then you might not need to run npm ci at all and node_modules will still be there

[cascornelissen]

We came to the same conclusion as in #14446, skipInstalls: false greatly increases the duration of the Renovate so it's not really feasible.

[GKersten]

@cascornelissen were you able to find a solution for this? I seem to run into a similar issue at the moment.

[cascornelissen]

It's been a while and can't quite remember but I think we just learned to live with it...