apm artifact updates get no credentials for private dependencies

[MPV]

How are you running Renovate?

A Mend.io-hosted app

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

44.134.1

Please tell us more about your question or problem

When apm.yml pins a dependency in a private GitHub repository and the project commits apm.lock.yaml, Renovate can find the update but can't refresh the lockfile.

On the Mend app, the lookup needs a host rule first. The app's own token can't read the private repository, even with the app installed on it. Without a rule, GitHub's GraphQL API doesn't find the repository, and the lookup fails. From the job log:

DEBUG: Datasource unknown error (datasource=github-tags, packageName=MPV/renovate-apm-private-skill)
       "err": {"message": "Could not resolve to a Repository with the name 'MPV/renovate-apm-private-skill'."}
DEBUG: Failed to look up github-tags package MPV/renovate-apm-private-skill: no-result

With a github-tags host rule whose token can read the repository, the lookup works and Renovate opens the update. The artifact update then runs apm install (lib/modules/manager/apm/artifacts.ts) without any credentials: exec passes the child only allowlisted variables plus extraEnv, and the manager sets no extraEnv.

APM can't find a token on its own. For a github.com dependency, APM 0.33.0 tries anonymously first. After a 401, 403 or 404 it looks, in order, at:

1. GITHUB_APM_PAT_<ORG>, GITHUB_APM_PAT, GITHUB_TOKEN, GH_TOKEN;
2. gh auth token;
3. git credential fill.

That order is in apm_cli/core/auth.py, and Renovate's child process has none of these.

withGitEnvironment(), as gomod, cargo and vendir use, would not be enough either. It passes credentials as url.<authenticated>.insteadOf entries in GIT_CONFIG_* variables, and APM's tokenless HTTPS attempt removes GIT_CONFIG_COUNT, which discards them (apm_cli/deps/git_auth_env.py).

So Renovate can't update such a project. In the reproduction's job, apm install ran with only HOME, PATH, LC_ALL, LANG, CI and CONTAINERBASE_CACHE_DIR set, and APM answered "No token available. Set GITHUB_APM_PAT or GITHUB_TOKEN" (logs below). For the first two hours after a release, Renovate then aborts the job with a lock file error ("PR is less than 2 hours old - raise error instead of PR"). After that it opens the PR with an "Artifact update problem" comment, and the lockfile and deployed files stay at the old version.

Expected: Renovate passes apm install the token its github-tags lookups use, so APM can fetch what the lookup found. That's the github-tags host rule's token, or else the platform's. mise passes a token the same way with GITHUB_TOKEN, and github-actions with GH_TOKEN. APM's own variable for it is GITHUB_APM_PAT. Public dependencies wouldn't change, because APM still tries github.com anonymously first.

Minimal reproduction: https://github.com/MPV/renovate-apm-private-dependency. The skill it pins is in a private repository, so only the job log shows the failure.

Renovate's PR, with the artifact error: MPV/renovate-apm-private-dependency#1. It changes only apm.yml. Its comment quotes only APM's stderr, a policy warning; APM prints the authentication error to stdout, so only the job log above shows it.

I have a fix ready: #46876

Logs (if relevant)

Logs

DEBUG: Executing command (branch=renovate/mpv-renovate-apm-private-skill-skills-hello-1.x)
       "command": "apm install",
       "env": ["HOME", "PATH", "LC_ALL", "LANG", "CI", "CONTAINERBASE_CACHE_DIR"]
DEBUG: rawExec err (branch=renovate/mpv-renovate-apm-private-skill-skills-hello-1.x)
       "cmd": "apm install",
       "exitCode": 1,
       "stdout":
[>] Installing dependencies from apm.yml...
[>] Resolving renovate-apm-private-skill-hello...
[i] Targets: claude  (source: apm.yml)
  [x] 1 package failed:
    +- renovate-apm-private-skill-hello -- Failed to download dependency
MPV/renovate-apm-private-skill: Failed to clone repository: Failed to clone
repository MPV/renovate-apm-private-skill via plain HTTPS. To allow
cross-protocol fallback (not recommended), pass --allow-protocol-fallback, set
APM_ALLOW_PROTOCOL_FALLBACK=1, or run: apm config set allow-protocol-fallback
true Authentication failed for clone on github.com.
No token available.
Set GITHUB_APM_PAT or GITHUB_TOKEN, or run 'gh auth login'.
If packages span multiple organizations, set per-org tokens: GITHUB_APM_PAT_MPV
Run with --verbose for detailed auth diagnostics. Last error: Cloning into bare
repository '/tmp/apm_shared_330b30bae48c610d_ens9vrug/bare'...
remote: Invalid username or token. Password *** is not supported for Git
operations.
fatal: Authentication failed for
'https://github.com/MPV/renovate-apm-private-skill.git/'
[x] Installation failed with 1 error(s) in 1.5s. No install transaction changes
were committed.
DEBUG: Failed to update apm.lock.yaml
DEBUG: PR is less than 2 hours old - raise error instead of PR
DEBUG: Passing lockfile-error up
 INFO: Lock file error - aborting

[RahulGautamSingh]

Thanks for the analysis.

The fix in #46876, which passes the github.com token to apm install looks correct.

For the lookup step, you still need a github-tags host rule with a token that can read the private repository, as you found.