simple-git upgrade prevents custom GIT_CONFIG_GLOBAL

[marvin-roesch]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitLab (.com or self-hosted)

Which version of Renovate are you using?

43.198.0

Please tell us more about your question or problem

We're running a self-managed instance of Renovate where we provide a custom Git config via the GIT_CONFIG_GLOBAL environment variable. We use this to set options like insteadOf rules etc. Unfortunately, after #43122 was merged and simple-git updated, this now causes the Renovate run to fail because the allowUnsafeConfigPaths option is not set.

#43268 set some of these unsafe flags, but not the one we'd require. Renovate should either set this unsafe flag additionally or expose these flags as a config option for self-hosted instances, so users may opt into these risky features consciously.

Logs (if relevant)

Logs

 INFO: Renovate started
       "renovateVersion": "43.197.0"
DEBUG: Using RE2 regex engine
DEBUG: Parsing configs
DEBUG: Checking for config file in /usr/src/app/config.json
<snip>
DEBUG: No additional config file found specified - skipping
DEBUG: File config
       "config": {
         "customEnvVariables": {"GIT_CONFIG_GLOBAL": "/home/ubuntu/gitconfig/config"}
       }
DEBUG: Additional file config
       "config": {}
DEBUG: CLI config
       "config": {}
DEBUG: Env config
<snip>
DEBUG: Resolved global extends
       "config": undefined
DEBUG: Combined config
       "config": {
         "customEnvVariables": {"GIT_CONFIG_GLOBAL": "/home/ubuntu/gitconfig/config"}
       }
DEBUG: Adding trailing slash to endpoint
ERROR: Error fetching git version
       "err": {
         "task": {
           "commands": ["--version"],
           "format": "utf-8",
           "parser": "[function]",
           "onError": "[function]"
         },
         "plugin": "unsafe",
         "message": "Use of \"GIT_CONFIG_GLOBAL\" is not permitted without enabling allowUnsafeConfigPaths"
       }
       Error: Use of "GIT_CONFIG_GLOBAL" is not permitted without enabling allowUnsafeConfigPaths
           at Object.action (file:///usr/local/renovate/node_modules/.pnpm/simple-git@3.36.0/node_modules/simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts:15:22)
           at PluginStore.exec (file:///usr/local/renovate/node_modules/.pnpm/simple-git@3.36.0/node_modules/simple-git/src/lib/plugins/plugin-store.ts:54:29)
           at GitExecutorChain.attemptRemoteTask (file:///usr/local/renovate/node_modules/.pnpm/simple-git@3.36.0/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:84:34)
           at GitExecutorChain.attemptTask (file:///usr/local/renovate/node_modules/.pnpm/simple-git@3.36.0/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:63:20)
FATAL: Initialization error
       "errorMessage": "git version needs upgrading"
 INFO: Renovate is exiting with a non-zero code due to the following logged errors
       "loggerErrors": [
         {
           "name": "renovate",
           "level": 50,
           "level": 60,
           "logContext": "e22b3465-ef0e-4fbf-a1d1-6269fb440bb3",
           "errorMessage": "git version needs upgrading",
           "msg": "Initialization error"
         }
       ]

[jamietanna]

What's the purpose of GIT_CONFIG_GLOBAL and why do you need to set it? I'm not familiar

[marvin-roesch]

GIT_CONFIG_GLOBAL allows specifying the location of a Git config file that gets used for all Git operations, see https://github.com/steveukx/git-js/blob/c427fbad33f1f2b11341f1cf852eedecbb106400/docs/PLUGIN-UNSAFE-ACTIONS.md?plain=1#L410-L413. As specified in the initial comment, we use it to set up custom insteadOf rules to replace SSH-based Git accesses with HTTPS pulls, as an example.

We could use the GIT_CONFIG_KEY_n environment variables for this, but it gets rather unwieldy especially with insteadOf rules that also can contain quotes etc.

[marvin-roesch]

@jamietanna Any update on this?