mirror of
https://github.com/renovatebot/renovate.git
synced 2025-01-12 15:06:27 +00:00
docs: improve private module support documentation (#9711)
This commit is contained in:
HonkingGoose
GitHub
parent
a91c85317a
commit
c542cbe7f5
1 changed files with 11 additions and 10 deletions
|
|
@ -38,7 +38,7 @@ Although npm presets were the first type supported, they are now deprecated and
|
|||
However if you do still use them, private modules should work if you configure the `npmrc` file including token credentials in your bot admin config.
|
||||
Credentials stored on disk (e.g. in `~/.npmrc`) are no longer supported.
|
||||
|
||||
The recommended way of using local presets is to configure then using "local" presets, e.g. like `"extends": ["local>myorg/renovate-config"]`, and ensure that the platform token has access to that repo.
|
||||
The recommended way of using local presets is to configure then using "local" presets, e.g. `"extends": ["local>myorg/renovate-config"]`, and ensure that the platform token has access to that repo.
|
||||
|
||||
It's not recommended that you use a private repository to host your config while then extending it from a public repository.
|
||||
If your preset doesn't contain secrets then you should make it public, while if it does contain secrets then it's better to split your preset between a public one which all repos extend, and a private one with secrets which only other private repos extend.
|
||||
|
|
@ -52,7 +52,7 @@ In summary, the recommended approach to private presets is:
|
|||
## Dependency Version Lookups
|
||||
|
||||
Whenever Renovate detects that a project uses a particular dependency, it attempts to look up that dependency to see if any new versions exist.
|
||||
If such a package is private, then Renovate will need to be configured with the relevant credentials.
|
||||
If such a package is private, then Renovate must be configured with the relevant credentials.
|
||||
Renovate does not use any package managers for this step and performs all HTTP(S) lookups itself, including insertion of authentication headers.
|
||||
|
||||
Configuring Renovate with credentials requires `hostRules`.
|
||||
|
|
@ -64,7 +64,7 @@ It can be either a "platform" name (e.g. `github`, `azure`, etc) or a "datasourc
|
|||
`baseUrl` can be used if you want to only apply the credentials for a nested path within the host, e.g. `https://registry.company.com/nested/path/`.
|
||||
If the same credentials apply to all paths on a host, then use `hostName` instead, e.g. `registry.company.com`.
|
||||
Finally, to apply credentials to all hosts within the domain, use `domainName`, e.g. `company.com`.
|
||||
You need to pick only one of these and not try to use multiple at the same time, or it will be a config error.
|
||||
You need to pick _only one_ of these and not configure more than one of these fields within the same host rule, otherwise it will error.
|
||||
|
||||
In addition to the above options to match against a host, you need to add the credentials.
|
||||
Typically they are either `token`, or `username` + `password`.
|
||||
|
|
@ -91,7 +91,7 @@ Here is an example of some host rules:
|
|||
Renovate applies theses `hostRules` to every HTTP(s) request which is sent, so they are largely independent of any platform or datasource logic.
|
||||
With `hostRules` in place, private package lookups should all work.
|
||||
|
||||
## Release Notes
|
||||
## Looking up Release Notes
|
||||
|
||||
When Renovate creates Pull Requests, its default behavior is to locate and embed release notes/changelogs of packages.
|
||||
These release notes are fetched from the source repository of packages and not from the registries themselves, so if they are private then they will require different credentials.
|
||||
|
|
@ -102,7 +102,7 @@ It can be confusing for people who host their own source code privately to be as
|
|||
|
||||
Currently the preferred way to configure `github.com` credentials for self-hosted Renovate is:
|
||||
|
||||
- Create a read-only Personal Access Token (PAT) for a `github.com` account. It can be any account, and may even be best to be an empty account created just for this purpose.
|
||||
- Create a read-only Personal Access Token (PAT) for a `github.com` account. This can be any GitHub account, it might be better to create a "empty" account just for this purpose.
|
||||
- Add the PAT to Renovate using the environment variable `GITHUB_COM_TOKEN`
|
||||
|
||||
## Package Manager Credentials for Artifact Updating
|
||||
|
|
@ -155,7 +155,7 @@ If you are a user of this app, and have private modules, then the following is a
|
|||
### Private presets with public repositories
|
||||
|
||||
If you have a preset in a private repo but reference ("extend") it from a public repository then it won't work.
|
||||
This is because public repositories are provided with a token scoped to only that particular repository, and not for all repositories within the org.
|
||||
This is because public repositories are provided with a token scoped to only that particular repository, and not for all repositories within the organization.
|
||||
This is a security measure so that if a the token is accidentally leaked publicly, the damage is limited to the public repository it leaked to and not to every repository within the organization.
|
||||
|
||||
The solution to this is that you should break your presets into public and private ones, and reference only the public ones from public repositories.
|
||||
|
|
@ -199,15 +199,16 @@ The WhiteSource Renovate App does not run using GitHub Actions, but such secrets
|
|||
|
||||
## Admin/Bot config vs User/Repository config for Self-hosted users
|
||||
|
||||
"AdminBot config" refers to the config which the Renovate Bot administrator provides at bot startup, e.g. using environment variables, CLI parameters, or the `config.js` configuration file. User/Repository config refers to the in-repository config file which defaults to `renovate.json` but has a large number of alternative filenames supported.
|
||||
"AdminBot config" refers to the config which the Renovate Bot administrator provides at bot startup, e.g. using environment variables, CLI parameters, or the `config.js` configuration file.
|
||||
User/Repository config refers to the in-repository config file which defaults to `renovate.json` but has a large number of alternative filenames supported.
|
||||
|
||||
If there is a need to supply custom rules for certain repository, it can still be done using the `config.js` file and the `repositories` array.
|
||||
|
||||
If per-repository config must be done within the repository, it is still recommended against committing secrets directly (including e.g. `.npmrc` files with tokens) and instead encrypting them with a custom public key first.
|
||||
For instructions on this, see the above section on encrypting secrets for the WhiteSource Renovate App but instead:
|
||||
|
||||
- Save a copy of the <https://app.renovatebot.com/encrypt> html file locally, or host it locally
|
||||
- Save a copy of the <https://app.renovatebot.com/encrypt> HTML file locally, or host it locally
|
||||
- Generate a public/private key pair for the app using the instructions in [privateKey](https://docs.renovatebot.com/self-hosted-configuration/#privatekey)
|
||||
- Replace the existing public key in the html with the public key you generated in the step prior
|
||||
- Use the resulting html encrypt page to encrypt secrets for your app before adding them to user/repository config
|
||||
- Replace the existing public key in the HTML with the public key you generated in the step prior
|
||||
- Use the resulting HTML encrypt page to encrypt secrets for your app before adding them to user/repository config
|
||||
- Configure the app to run with `privateKey` set to the private key you generated above
|
||||
|
|
|
|||
Loading…
Reference in a new issue