github-release-attachments datasource fails for private repos when using a GitHub App token

[lboynton]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

43.179.0

Please tell us more about your question or problem

The github-release-attachments datasource downloads release assets using browser_download_url (e.g. https://github.com/owner/repo/releases/download/tag/file). This is GitHub's browser-facing download URL, which does not accept GitHub App installation tokens for private repositories. It returns 404 even when the token has contents: read permission on the repository.

GitHub API calls to api.github.com (used for listing releases and metadata) work correctly with App tokens. Only the asset download itself fails, because it goes through GitHub's web layer rather than the API.

Steps to reproduce

1. Self-host Renovate using a GitHub App (not a PAT)
2. Add a hostRules entry in global config to send the App token for github.com downloads (required for the token to be included in asset download requests at all):

{                                                             
     matchHost: "github.com",                                                                                                                                                                                        
     hostType: "github-release-attachments",                   
     token: process.env.RENOVATE_TOKEN,                                                                                                                                                                              
}

3. Configure a repo's renovate.json to use github-release-attachments with a currentDigest:

{                                                                                                                                                                                                                     
  "regexManagers": [{
    "datasourceTemplate": "github-release-attachments",                                                                                                                                                               
    "depNameTemplate": "org/private-repo",                      
    "matchStrings": ["VERSION=\"(?<currentValue>[^\"]+)\"\\nCHECKSUM=\"(?<currentDigest>[^\"]+)\""]                                                                                                                   
  }]                                                                                                                                                                                                                  
}

4. Ensure org/private-repo has a GitHub release with a checksum file attached
5. Run Renovate

In lib/modules/datasource/github-release-attachments/index.ts (https://github.com/renovatebot/renovate/blob/main/lib/modules/datasource/github-release-attachments/index.ts), asset content is fetched using:

const res = await this.http.getText(asset.browser_download_url);                                                                                                                                                      

browser_download_url always resolves to https://github.com/..., the web download URL. For private repos, GitHub App tokens are not accepted here.

Suggested fix

Use the GitHub API asset endpoint instead of browser_download_url:

  GET https://api.github.com/repos/{owner}/{repo}/releases/assets/{asset_id}                                                                                                                                            
  Accept: application/octet-stream 

Logs (if relevant)

Logs

  DEBUG: GET https://github.com/org/private-repo/releases/download/v1.0.0/checksums.sha256 = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=404 retryCount=0, duration=92) (repository=org/consumer-repo)               
  ERROR: lookupUpdates error (repository=org/consumer-repo, packageFile=Dockerfile)                                                                                                                                 
        "currentDigest": "<digest>",                                                                                                                                                                                
        "currentValue": "v1.0.0",                                                                                                                                                                                   
        "datasource": "github-release-attachments",                                                                                                                                                                 
        "packageName": "org/private-repo",
        "err": {                                                                                                                                                                                                    
          "name": "HTTPError",                                    
          "code": "ERR_NON_2XX_3XX_RESPONSE",
          "options": {                                                                                                                                                                                              
            "headers": {
              "user-agent": "Renovate/43.179.0 (https://github.com/renovatebot/renovate)",                                                                                                                          
              "accept": "application/vnd.github.v3+json",                                                                                                                                                           
              "authorization": "***",
              "accept-encoding": "gzip, deflate, br, zstd"                                                                                                                                                          
            },                                                    
            "url": "https://github.com/org/private-repo/releases/download/v1.0.0/checksums.sha256",
            "hostType": "github-release-attachments",                                                                                                                                                               
            "method": "GET"
          },                                                                                                                                                                                                        
          "message": "Request failed with status code 404 (Not Found): GET https://github.com/org/private-repo/releases/download/v1.0.0/checksums.sha256",
          "response": {                                                                                                                                                                                             
            "statusCode": 404,
            "statusMessage": "Not Found",                                                                                                                                                                           
            "body": "Not Found",                                                                                                                                                                                    
            "headers": {
              "content-type": "text/plain; charset=utf-8",                                                                                                                                                          
              "set-cookie": ["_octo=...", "_gh_sess=..."]         
            }                                                                                                                                                                                                       
          }
        }

[github-actions[bot]]

Hi there,

You're reporting a problem with an old version of Renovate. Please try the latest version and tell us if that fixes your problem.

Be sure to provide updated logs once you have run with a newer version.

Good luck,

The Renovate team

[github-actions[bot]]

Hi there,
To the Discussion creator: please edit and improve the "Which version of Renovate are you using?" answer.
You've specified either latest or a major version number, but as Renovate ships many updates daily, the specific version of Renovate that runs changes.
You can find the specific Renovate version by checking the INFO: Repository started log line.
Thanks, the Renovate team