Regression in 43.164.2: git submodule (git-refs datasource) fails with "Authentication failed"

[sjaakkie]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

43.208.1

Please tell us more about your question or problem

Summary

Starting from 43.164.2, Renovate fails to look up updates for git submodules defined in .gitmodules. The git ls-remote call fails with an authentication error. The same setup worked correctly on 43.164.1.

• Broken since: 43.164.2
• Last working version: 43.164.1
• Diff between versions: 43.164.1...43.164.2

Platform

• GitHub Actions (self-hosted runner)
• Authentication via GitHub App token

Expected behavior

Renovate resolves the latest commit digest for git submodules by running git ls-remote with proper credentials. This worked on 43.164.1.

Actual behavior

Renovate exits with a non-zero exit code. The logged error for the git-refs datasource lookup is:

"message": "remote: Repository not found.\nfatal: Authentication failed for 'https://github.com/org/private-submodule-repo.git/'"

Full error context from the Renovate log:

  {
    "datasource": "git-refs",
    "packageName": "https://github.com/org/private-submodule-repo.git",
    "packageFile": ".gitmodules",
    "err": {
      "task": {
        "commands": ["ls-remote", "https://github.com/org/private-submodule-repo.git"]
      },
      "message": "remote: Repository not found.\nfatal: Authentication failed for 'https://github.com/org/private-submodule-repo.git/'"
    },
    "msg": "lookupUpdates error"
  }

The stack trace shows that a token IS being embedded in the URL (appears as redacted in the log), but GitHub still responds with "Repository not found" + "Authentication failed". The GitHub App has access to the submodule repository (same organization).

Renovate configuration

.gitmodules:

[submodule "org/private-submodule-repo"]
  path = submodule-repo
  url = https://github.com/org/private-submodule-repo.git

renovate.json:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "enabledManagers": ["git-submodules"],
  "git-submodules": {
    "enabled": true
  }
}

GitHub Actions workflow:

- name: Renovate Bot
  run: renovate org/some-project-repo
  env: 
    RENOVATE_TOKEN: ${{ steps.app-token.outputs.token }}

The token is generated via actions/create-github-app-token scoped to the entire organization.

Steps to reproduce

1. Use Renovate 43.164.2 or any later version like 43.208.1 (e.g. Docker image ghcr.io/renovatebot/renovate:43.208.1)
2. Run against a repository with a .gitmodules file pointing to a private GitHub repo
3. Authentication is done via a GitHub App token
4. Observe: lookupUpdates error with "Authentication failed" for the submodule URL

Workaround

Pin back to 43.164.1. The issue does not occur on that version.

Additional notes

The simple-git version used is 3.35.2. The token does appear to be passed in the URL (visible as redacted in the stack trace), so Renovate is attempting to authenticate ? but something in the credential handling or URL construction seems to have changed between 43.164.1 and 43.164.2.

Logs (if relevant)

Logs

2026-05-28T06:45:02.6994161Z  INFO: Renovate is exiting with a non-zero code due to the following logged errors
2026-05-28T06:45:02.6994716Z        "loggerErrors": [
2026-05-28T06:45:02.6994965Z          {
2026-05-28T06:45:02.6995253Z            "name": "renovate",
2026-05-28T06:45:02.6995929Z            "level": 50,
2026-05-28T06:45:02.6996317Z            "logContext": "a3f7c812-9e4b-4d21-b6f0-2c85e1d93047",
2026-05-28T06:45:02.6996850Z            "repository": "org/some-project-repo",
2026-05-28T06:45:02.6997345Z            "baseBranch": "renovate-debug",
2026-05-28T06:45:02.6997961Z            "currentDigest": "0a08b05269cd3f21efa61ac59c3765d44e8f366d",
2026-05-28T06:45:02.6998470Z            "datasource": "git-refs",
2026-05-28T06:45:02.6999062Z            "packageName": "https://github.com/org/private-submodule-repo.git",
2026-05-28T06:45:02.6999671Z            "followTag": null,
2026-05-28T06:45:02.7000042Z            "packageFile": ".gitmodules",
2026-05-28T06:45:02.7000426Z            "pinDigests": false,
2026-05-28T06:45:02.7000763Z            "rollbackPrs": false,
2026-05-28T06:45:02.7001117Z            "updatePinnedDependencies": true,
2026-05-28T06:45:02.7001467Z            "err": {
2026-05-28T06:45:02.7001737Z              "task": {
2026-05-28T06:45:02.7002062Z                "commands": [
2026-05-28T06:45:02.7002420Z                  "ls-remote",
2026-05-28T06:45:02.7002898Z                  "https://github.com/org/private-submodule-repo.git"
2026-05-28T06:45:02.7003424Z                ],
2026-05-28T06:45:02.7003640Z                "format": "utf-8",
2026-05-28T06:45:02.7003896Z                "parser": "[function]"
2026-05-28T06:45:02.7004144Z              },
2026-05-28T06:45:02.7004830Z              "message": "remote: Repository not found.\nfatal: Authentication failed for 'https://github.com/org/private-submodule-repo.git/'\n",
2026-05-28T06:45:02.7008432Z              "stack": "Error: remote: Repository not found.\nfatal: Authentication failed for 'https://**redacted**@3.35.2/node_modules/simple-git/src/lib/plugins/error-detection.plugin.ts:42:29)\n    at PluginStore.exec (file:///usr/local/renovate/node_modules/.pnpm/simple-git@3.35.2/node_modules/simple-git/src/lib/plugins/plugin-store.ts:54:29)\n    at file:///usr/local/renovate/node_modules/.pnpm/simple-git@3.35.2/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:124:42\n    at new Promise (<anonymous>)\n    at GitExecutorChain.handleTaskData (file:///usr/local/renovate/node_modules/.pnpm/simple-git@3.35.2/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:121:14)\n    at GitExecutorChain.attemptRemoteTask (file:///usr/local/renovate/node_modules/.pnpm/simple-git@3.35.2/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:97:40)\n    at GitExecutorChain.attemptTask (file:///usr/local/renovate/node_modules/.pnpm/simple-git@3.35.2/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:61:18)"
2026-05-28T06:45:02.7011539Z            },
2026-05-28T06:45:02.7011808Z            "msg": "lookupUpdates error"
2026-05-28T06:45:02.7012066Z          }
2026-05-28T06:45:02.7012263Z        ]
2026-05-28T06:45:02.8300289Z ##[error]Error: failed to run script step: command terminated with non-zero exit code: error executing command [sh -e /__w/_temp/b5440490-5a60-11f1-952d-33aa63f90bd7.sh], exit code 1
2026-05-28T06:45:02.8382844Z ##[error]Process completed with exit code 1.
2026-05-28T06:45:02.8404504Z ##[error]Executing the custom container implementation failed. Please contact your self hosted runner administrator.

[github-actions[bot]]

Hi there,

You're reporting a problem with an old version of Renovate. Please try the latest version and tell us if that fixes your problem.

Be sure to provide updated logs once you have run with a newer version.

Good luck,

The Renovate team

[sjaakkie]

The same error occurs when using the latest (43.208.1) version.
I only pinpoint the version since when it stopped working, but I've edited my original message.