Regression in 24.89.2

[bytestream]

What Renovate type, platform and version are you using?

GitLab self-hosted

Describe the bug

See #9211 (comment)

Relevant debug logs

See above

Have you created a minimal reproduction repository?

• Version 24.91.2 - npm install fails and comment is added to MR
  https://gitlab.com/bytestream/renovate-bot/-/jobs/1117160215
• Version 24.89.1 - npm install works and comment is removed
  https://gitlab.com/bytestream/renovate-bot/-/jobs/1117173042

• This is a really small bug, it does not need a reproduction (think small typo)
• I have provided a minimal reproduction repository
• I don't have time for that, but it happens in a public repository I have linked to
• I don't have time for that, and cannot share my private repository
• The nature of this bug means it's impossible to reproduce publicly

Additional context

[rarkins]

Where is the .npmrc coming from? i.e. the one referred to by Error: Failed to replace env in config: ${GITLAB_TOKEN}.

e.g. is it a .npmrc that's mounted into the home directory of the GitLab runner? I don't see it in the repository.

[github-actions]

Thank you for providing a reproduction! 🎉 🚀

The Renovate team will take a look at the reproduction repository. Once we confirm the provided repository reproduces the problem, the label will be changed to reproduction:confirmed.

[bytestream]

It's in the repository that renovate is running on: https://gitlab.com/bytestream/renovate-npm/-/blob/master/.npmrc

[rarkins]

I think it's possible that prior, Renovate used to delete that .npmrc file temporarily before running npm install. Would that have still worked?

[bytestream]

Yes I think so too. I run npm config before running renovate which at the moment does the same thing as the .npmrc file, so I guess that's why it still works in v24.89.1

The .npmrc file is there to ease setup in the repository, and the environment variable replacement is a documented npm feature. https://docs.npmjs.com/using-private-packages-in-a-ci-cd-workflow#create-and-check-in-a-project-specific-npmrc-file

[rarkins]

If you are the owner of both the bot and the repos then setting trustLevel=high in config.js will mean that environment variables are used in .npmrc files.

[rarkins]

You can also manually configure using customEnvVariables, e.g.

  customEnvVariables: {
    GITLAB_TOKEN: process.env.GITLAB_TOKEN
  }

[bytestream]

It looks like customEnvVariables has done the trick; I'll continue to monitor. Thanks very much @rarkins