Tools installed from a registry always pull from the default registry #44608
Unanswered
Annonymus-v02
asked this question in
Request Help
Replies: 1 comment
|
I proposed a PR which solves this: |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
How are you running Renovate?
Self-hosted Renovate CLI
Which platform you running Renovate on?
GitLab (.com or self-hosted)
Which version of Renovate are you using?
43.261.4
Please tell us more about your question or problem
When renovate is run in an image that does not have pnpm preinstalled, on a repository which uses it, it tries to install it on-demand.
When it does so it ignores the configured
packageRules, always pulling it fromregistry.npmjs.org. This fails in an environment that restricts access to the global registry.From the logs:
but later
The 403 is expected as our firewall blocks direct access to the registry, but renovate should not have tried to reach npmjs.org in the first place, as it was configured to use our internal nexus instance instead.
At first I thought we were missing a configuration option, and after some unsuccessful digging, took a look around the code in the stacktrace to see if I could find out what we need to do.
I found that it calls getPkgReleases, passing in the toolConfig that was printed to the logs and that getPkgReleases looks at the
defaultRegistryUrls,registryUrlsandadditionalRegistryUrlsfields of the passed config object to determine where to pull from.The toolConfig has none of these, so it falls back to the default registry URLs of the datasource which for
npmis the global registry.The
ToolConfigtype makes it clear that it can never have these fields.So my conclusion is that it is impossible to affect which registry tools are installed from.
That means renovate cannot run on pnpm projects in an environment which restricts access to the global registry, at least not without using the
fullimage, and presumably the same goes for all projects requiring tools pulled from a registry which is required by the environment to be routed to an alternative location.Is my analysis correct or did I miss something? In the former case, do you have any advice on why that is so, and how best to work around it?
Logs (if relevant)
Logs
I've tried to copy just the relevant parts, but do let me know if I've left out something important.All reactions