GitHub clone fails with "could not read Username" since 44.161.0 (libcurl 8.5.0-2ubuntu10.16 in base image)

[soakes]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

44.161.0 (also 44.161.1, 44.161.2, 44.162.0, 44.163.0); last good 44.160.1

Please tell us more about your question or problem

Since 44.161.0 (renovate-base-image 13.130.0), self-hosted Renovate on GitHub.com can no longer clone private repositories when RENOVATE_TOKEN is a personal access token. Every run ends in external-host-error. 44.160.1 works with the same token and repository; public repositories still work on 44.161.0 because they need no credentials. Still failing on 44.161.1, 44.161.2, 44.162.0 and 44.163.0. Same result on linux/amd64 and linux/arm64.

Cause (as far as I can tell)

Git and its binaries are byte-identical between the two images (git 1:2.55.0-0ppa1~ubuntu24.04.2). The only change on this path is Ubuntu's libcurl3t64-gnutls going from 8.5.0-2ubuntu10.15 to 8.5.0-2ubuntu10.16 (a noble-security update bundling several CVE patches).

With 10.16, git sends Authorization on the info/refs request but not on the follow-up git-upload-pack request when the URL carries a username with an empty password. GitHub then redirects (.git → .git/) and git, having no credentials, fails with could not read Username. GIT_TRACE_CURL shows the header present on both requests in the 44.160.1 image and missing from the second one in 44.161.0.

For a PAT, getRepoUrl in lib/modules/platform/github/utils.ts builds exactly that form, https://<token>@github.com/<owner>/<repo>.git (token as username, empty password). getHttpUrl in lib/util/git/url.ts already uses x-access-token:<token> for GitHub, and that form keeps working on 10.16.

Minimal reproduction (plain git inside the image)

docker run --rm -e T=<PAT> --entrypoint bash ghcr.io/renovatebot/renovate:44.161.0 -c '
  GIT_TERMINAL_PROMPT=0 git ls-remote --heads "https://${T}@github.com/<owner>/<private-repo>.git"
  GIT_TERMINAL_PROMPT=0 git ls-remote --heads "https://x-access-token:${T}@github.com/<owner>/<private-repo>.git"'

On 44.161.0 the first command fails (warning: redirecting to …/<private-repo>.git/, fatal: could not read Username) and the second succeeds. On 44.160.1 both succeed.

Reproduction with Renovate

docker run --rm \
  -e RENOVATE_TOKEN=<PAT> -e RENOVATE_PLATFORM=github \
  -e RENOVATE_REPOSITORIES=<owner>/<private-repo> \
  -e RENOVATE_DRY_RUN=extract -e RENOVATE_REQUIRE_CONFIG=optional -e RENOVATE_ONBOARDING=false \
  -e RENOVATE_EXIT_CODE_FOR_ERRORS=true \
  ghcr.io/renovatebot/renovate:44.161.0   # exits 7; 44.160.1 exits 0

Suggested fix

Use x-access-token:<token> as the credentials in GitHub's getRepoUrl when the token has no : (as getHttpUrl already does), so git always has a non-empty password to re-send. It may also be worth reporting the libcurl behaviour change to Ubuntu, since it will affect other git users with username-only token URLs.

Workaround for now: pin the CLI to 44.160.1.

Logs (if relevant)

Logs

DEBUG: Found valid git version: 2.55.0
 INFO: Repository started (repository=<owner>/<private-repo>)
 WARN: Host error (repository=<owner>/<private-repo>)
       "hostType": "git",
       "err": {
         "task": {
           "commands": ["ls-remote", "--heads", "https://**redacted**@github.com/<owner>/<private-repo>.git"]
         },
         "message": "warning: redirecting to https://github.com/<owner>/<private-repo>.git/\nfatal: could not read Username for 'https://github.com': No such device or address\nfatal: expected flush after ref listing\n"
       }
 INFO: External host error causing abort - skipping (repository=<owner>/<private-repo>)
 INFO: Repository finished (repository=<owner>/<private-repo>)
       "cloned": false,
       "result": "external-host-error",

[viceice]

Thanks, confirmed:

• getRepoUrl (lib/modules/platform/github/utils.ts) puts a PAT into the username with an empty password. Ubuntu's current curl (8.5.0-2ubuntu10.16, also jammy's 7.81.0-1ubuntu1.30) no longer re-sends username-only credentials on the git-upload-pack request, with Ubuntu's git as well as a source-built one. GitHub App tokens already use x-access-token: and aren't affected.
• Fix: use x-access-token:<token> for the clone URL when the token has no : (fix(platform/github): use x-access-token for personal access tokens in clone URLs #47073).
• Workaround: set RENOVATE_TOKEN=x-access-token:<PAT>, or pin 44.160.1.

Posted by Claude (Claude Code) on behalf of @viceice.

[viceice]

a fix is on the way

[soakes]

Thanks very much for the speedy fix and reply.

[jamietanna]

• GitHub: fix(platform/github): use x-access-token for personal access tokens in clone URLs #47073
• Forgejo/Gitea: fix(platform/gitea,forgejo): use a non-empty password in token clone URLs #47076
• SCM-Manager: fix(platform/scm-manager): use a fallback username in token clone URLs #47084
• (Other platforms): fix(util/git): use non-empty passwords for token credentials on more platforms #47085 / fix(util/git): use a non-empty password for token-only git credentials #47077

[soakes]

Confirmed fixed on 44.164.1. Our hold on 44.160.1 is gone. We updated to 44.164.1 and the repo clones again with the PAT. A full run went through cleanly, with exitCodeForErrors on.

Thanks again @viceice for working out the cause so quickly, and @jamietanna for linking the fix. Going from report to release in about an hour is impressive. Happy for this to be closed. Thanks again.

[jamietanna]

I've captured #47103 to see if we can add a test for this