go get -t ./... fails for private GitLab subgroup modules — cannot update go.sum

[thespags]

How are you running Renovate?

Self Hosted Argo App

Which platform you running Renovate on?

Gitlab/ArgoCD

Which version of Renovate are you using?

46.213.0

Please tell us more about your question or problem

Problem

I'm running self-hosted Renovate to update Go dependencies in a private GitLab repo. Updating go.mod works correctly. Renovate creates the MR with the right version bumps. However, Renovate's artifact update step (go get -t ./...) fails, leaving go.sum out of date.

Go is reporting a https://gitlab.com/myorg/devx.git error, which is a GitLab group, not a repository. The correct repo is at gitlab.com/myorg/devx/gitlab. I'm guessing this happens because Go's request to find the repository isn't authenticated so Go falls back to guessing the path and guesses wrong.

The token is from a Service account

• Token scopes: read_repository, read_api, write_repository, read_registry, api
• Role: Developer on the root organization group

Config

module.exports = {
  platform: "gitlab",
  endpoint: "https://gitlab.com/api/v4/",
  repositories: ["myorg/devx/pangaea"],
  postUpdateOptions: ["gomodTidy", "gomodUpdateImportPaths"],
  hostRules: [
    {
      matchHost: "gitlab.com",
      username: "svc-renovate-bot",
      password: process.env.RENOVATE_TOKEN,
      hostType: "go",
    },
    {
      matchHost: "https://gitlab.com",
      token: process.env.RENOVATE_TOKEN,
      hostType: "gitlab",
    },
  ],
  customEnvVariables: {
    GOPRIVATE: "gitlab.com/myorg/*",
    GONOSUMDB: "gitlab.com/myorg/*",
  },
};

I've tried adding to no effect.

GIT_CONFIG_COUNT: "1",
GIT_CONFIG_KEY_0: `url.https://oauth2:${process.env.RENOVATE_TOKEN}@gitlab.com/.insteadOf`,
GIT_CONFIG_VALUE_0: "https://gitlab.com/",

Question

Am I missing something in my host rules or configuration in general that I'm getting the error?

Logs (if relevant)

Logs

WARN: artifactErrors (repository=myorg/devx/pangaea, branch=renovate/go)
         "artifactErrors": [
           {
             "fileName": "go.sum",
             "stderr": "Command failed: go get -t ./...\ngo: gitlab.com/myorg/devx/gitlab/template@v0.0.15: reading gitlab.com/myorg/devx/gitlab/template/go.mod at revision gitlab/template/v0.0.15: git
  ls-remote -q --end-of-options https://gitlab.com/myorg/devx.git in /tmp/renovate/cache/others/go/pkg/mod/cache/vcs/5e0d92e684b57a915d1d1bc07f3a847ff5861dc8bb4a3e2f9e431be26cee96b3: exit status
  128:\n\tremote: The project you were looking for could not be found or you don't have permission to view it.\n\tfatal: repository 'https://gitlab.com/myorg/devx.git/' not found\n"
           }
         ]

[thespags]

There's probably a way in the renovate config to do this but I ended up writing this into my cronjob and it worked

  preCommand: "printf 'machine gitlab.com login svc-my-renovate-bot password %s\\n' \"$RENOVATE_TOKEN\" > ~/.netrc && chmod 600 ~/.netrc"