Cannot renovate repos with .npmrc that uses env vars

[SpainTrain]

.npmrc files allow use of env vars, e.g.,

//registry.npmjs.org/:_authToken=${NPM_TOKEN}

However, after #807 the environment is no longer passed to npm/yarn and when trying to renovate repos with .npmrc files like this, one receives

"err": {
  "name": "ChildProcessError",
  ...
  "stderr": "error An unexpected error occurred: \"Failed to replace env in config: ${NPM_TOKEN}\".\n"

Due to deployment requirements, it is not possible to remove .npmrc from the target repo.

[rarkins]

In your case is it just NPM_TOKEN needed right now? Maybe we can allow a server side white listing of variable names. I need to make sure this doesn't open any exploits for the hosted app.

[SpainTrain]

While in my example the env var is being used for the npm registry token, note that the more general issue is that target repos may have .npmrc files that use arbitrary env vars.

In my case, my specific issue could be resolved in two ways I think:

• your suggestion of passing process.env.NPM_TOKEN to yarn child process
• renovate somehow ignoring the .npmrc file in the target repo (e.g., temporarily renaming it while running yarn child process). This should work because we set RENOVATE_NPMRC to pass the npm token for private modules.

An, arguably over-engineered, general solution to the problem would be supporting explicitly passing env vars to yarn, e.g., RENOVATE_YARN_MY_VAR is passed to yarn child process as MY_VAR

Outside of registry tokens, I am not really sure what folks use the env var interpolation for, so I can't really opine on which approach is best. Any of them solve our specific problem, though.

[rarkins]

@SpainTrain please try the fix. you could set it using env if it can apply to all your repos, otherwise configure it in renovate.json or package.json

[SpainTrain]

Thanks! Will test today!

[SpainTrain]

Works great. Thank you ❤️