Renovate tries to query authenticated gerrit version url in initPlatform before setting up host rules causing Unauthorized error

[travisshivers]

How are you running Renovate?

Self-hosted Renovate

Which platform you running Renovate on?

Other (please specify)

Which version of Renovate are you using?

42.47.0

Please tell us more about your question or problem

This recent PR, #39223, breaks gerrit because it tries to get the gerrit version using an authenticated gerrit url before the host rules have been applied.

Specifically, the PR added code in the gerrit specific initPlatform

renovate/lib/modules/platform/index.ts

Lines 42 to 48 in 5a212d2

	export async function initPlatform(config: AllConfig): Promise<AllConfig> {
	setPrivateKey(config.gitPrivateKey, config.gitPrivateKeyPassphrase);
	setNoVerify(config.gitNoVerify ?? []);
	// TODO: `platform` (#22198)
	setPlatformApi(config.platform!);
	// TODO: types
	const platformInfo = await platform.initPlatform(config);

that calls this

renovate/lib/modules/platform/gerrit/index.ts

Lines 84 to 99 in 5a212d2

	let gerritVersion: string;
	try {
	const env = getEnv();
	/* v8 ignore if: experimental feature */
	if (env.RENOVATE_X_PLATFORM_VERSION) {
	gerritVersion = env.RENOVATE_X_PLATFORM_VERSION;
	} else {
	gerritVersion = await client.getGerritVersion();
	}
	} catch (err) {
	logger.debug(
	{ err },
	'Error authenticating with Gerrit. Check your credentials',
	);
	throw new Error('Init: Authentication failure');
	}

but that all happens before it sets up the host rules later on in initPlatform

renovate/lib/modules/platform/index.ts

Lines 86 to 87 in 5a212d2

	returnConfig.hostRules.push(typedPlatformRule);
	hostRules.add(typedPlatformRule);

so the gerrit api call fails with an Unauthorized error

This can be replicated by setting up any normal gerrit instance with renovate

Logs (if relevant)

No response

[felipecrs]

I cannot reproduce this issue. How do you configure Gerrit credentials? Here's how I do it:

module.exports = {
  platform: 'gerrit',
  endpoint: 'https://review.gerrithub.io/',
  username: process.env.GERRIT_USERNAME,
  password: process.env.GERRIT_PASSWORD,
}

[travisshivers]

I configure them by passing the following envs:

RENOVATE_PLATFORM=gerrit
RENOVATE_USERNAME=...
RENOVATE_PASSWORD=...
RENOVATE_ENDPOINT=...

[felipecrs]

Weird. I believe that ends up to the same as I did.

Unfortunately, I'm no longer at home. I'll try having a better look at this tomorrow.

Just to emphasize, I am unable to reproduce your issue with my Gerrit instances.

And just FYI, the PR was inspired by the Gitlab platform where it performs an authenticated call at the initPlatform too.

[travisshivers]

With the gitlab platform, for the api calls it makes during initPlaform, it explicitly passes authentication information which isn't currently done in the gerrit one.

renovate/lib/modules/platform/gitlab/index.ts

Lines 146 to 150 in 5a212d2

	const version = (
	await gitlabApi.getJsonUnchecked<{ version: string }>('version', {
	token,
	})
	).body;

Are you setting the env RENOVATE_X_PLATFORM_VERSION in your setup?

We can solve this issue with gerrit by explicitly passing the authentication information. I've made a PR doing this and it fixes the issue for me: #39970

[felipecrs]

I'm not setting RENOVATE_X_PLATFORM_VERSION, but your patch does make sense.

I wonder how come it works for me, and I'll investigate that tomorrow (and review your PR too).

Thanks a lot though for the report and for fixing it up.

[felipecrs]

I found why it worked for me. I had this in my config:

  hostRules: [
    {
      matchHost: 'review.gerrithub.io',
      authType: 'basic',
      username: process.env.GERRIT_USERNAME,
      password: process.env.GERRIT_PASSWORD,
      concurrentRequestLimit: 1,
      maxRequestsPerSecond: 1,
    },
  ],

Which is useful for resolution of submodules.

[Shegox]

@travisshivers, just wanted to say that I run into the same. Big thanks to you for raising the problem and fixing it via #39970.
After applying the updated version it resolved the problem and authenticated lookups did work again!
Thank you very much! 🚀