Artifact updates write an untracked .npmrc into every workspace package dir, and postUpgradeTasks then commit them

[aqeelat]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

44.134.1

Please tell us more about your question or problem

A pnpm workspace monorepo with a repo-level npmrc config option (registry mapping only) and postUpgradeTasks. A dependency bump PR unexpectedly included a new .npmrc in every workspace package directory: one file per libs/*/apps/* package.

During artifact updates, Renovate writes the resolved npmrc into every package file's directory

renovate/lib/modules/manager/npm/post-update/index.ts

Lines 149 to 170 in dfbf52d

	const basedir = upath.dirname(packageFile.packageFile!);
	const npmrc = packageFile.npmrc;
	const npmrcFilename = upath.join(basedir, '.npmrc');
	// Write out the file unless the npmrc came from the workspace
	// npmrcFilename will be set whenever the file was read from disk during extract
	if (
	isString(npmrc) &&
	(npmrcFilename === packageFile.managerData.npmrcFileName ||
	!packageFile.managerData.npmrcFileName)
	) {
	try {
	if (!originalNpmrcFiles.has(npmrcFilename)) {
	const originalNpmrc = await readLocalFile(npmrcFilename, 'utf8');
	if (isString(originalNpmrc)) {
	originalNpmrcFiles.set(npmrcFilename, originalNpmrc);
	}
	}
	await writeLocalFile(npmrcFilename, npmrc.replace(regEx(/\n?$/), '\n'));
	} catch (err) /* v8 ignore next -- TODO: add test #40625 */ {
	logger.warn({ npmrcFilename, err }, 'Error writing .npmrc');
	}
	}

In a workspace, every libs/*/apps/* package.json is a package file, so each gets a copy. The cleanup counterpart, restoreNpmrcFiles (lines 279-284), only restores files recorded in originalNpmrcFiles, and that map is only populated when a file already existed (lines 160-163). Files Renovate created have no original, so they are never removed.

They then survive into the post-upgrade git status snapshot and are committed by the default postUpgradeTasks.fileFilters (**/*).

Observed on 44.61.3; the code path is unchanged in 44.134.1 (which we run now) and in current main.

Reproduction:

1. pnpm workspace monorepo, pnpm-workspace.yaml with packages: [libs/*, apps/*]
2. Renovate config with "npmrc": "@scope:registry=https://…/" (no .npmrc committed to the repo)
3. A postUpgradeTasks rule with a command that triggers pnpm's implicit install (pnpm exec … / pnpm run …) and default fileFilters
4. Any bump PR → N new untracked <package-dir>/.npmrc files committed

Possible fix: track created files as well as overwritten ones (e.g. store an absent marker in originalNpmrcFiles for newly created files) and delete them in restoreNpmrcFiles, so the checkout returns to its pre-update state.

Workarounds we applied:

• Removed the repo npmrc config option (registry config supplied via user-level ~/.npmrc in the worker) — verified: the post-removal run created no .npmrc files and resolved all dependencies cleanly
• Tight fileFilters per task, so only intended output paths are committed

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[RahulGautamSingh]

Thanks for the detailed report.

Converting to an issue, PR welcome.

[RahulGautamSingh]

Issue: #46923