renovate/renovate
1
0
Fork 0
mirror of https://github.com/renovatebot/renovate.git synced 2025-01-12 06:56:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

feat: log when using fine-grained PATs (#20097)

Browse source 
Co-authored-by: Rhys Arkins <rhys@arkins.net>
This commit is contained in:
Jamie Magee 2023-01-30 02:48:29 -05:00 committed by GitHub
parent e1cbd3f70f
commit e3b163f07a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
6 changed files with 44 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
lib/modules/platform/github/index.md
View file

@ -2,7 +2,8 @@
## Authentication
First, [create a Personal Access Token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token) for the bot account, select `repo` scope.
First, [create a classic Personal Access Token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token#creating-a-personal-access-token-classic) for the bot account, select `repo` scope.
Fine-grained Personal Access Tokens do not support the GitHub GraphQL API and cannot be used with Renovate.
Let Renovate use your PAT by doing _one_ of the following:

8
lib/modules/platform/github/index.spec.ts
View file

@ -56,6 +56,14 @@ describe('modules/platform/github/index', () => {
);
});
it('should throw if fine-grained token', async () => {
await expect(
github.initPlatform({ token: 'github_pat_XXXXXX' })
).rejects.toThrow(
'Init: Fine-grained Personal Access Tokens do not support the GitHub GraphQL API and cannot be used with Renovate.'
);
});
it('should throw if user failure', async () => {
httpMock.scope(githubApiHost).get('/user').reply(404);
await expect(github.initPlatform({ token: '123test' })).rejects.toThrow();

5
lib/modules/platform/github/index.ts
View file

@ -129,6 +129,11 @@ export async function initPlatform({
if (!token) {
throw new Error('Init: You must configure a GitHub token');
}
if (token.startsWith('github_pat_')) {
throw new Error(
'Init: Fine-grained Personal Access Tokens do not support the GitHub GraphQL API and cannot be used with Renovate.'
);
}
token = token.replace(/^ghs_/, 'x-access-token:ghs_');
platformConfig.isGHApp = token.startsWith('x-access-token:');

7
lib/workers/global/config/parse/__snapshots__/env.spec.ts.snap
View file

@ -1,5 +1,12 @@
// Jest Snapshot v1, https://goo.gl/fbAQLP
exports[`workers/global/config/parse/env .getConfig(env) does not support GitHub fine-grained PATs 1`] = `
{
"hostRules": [],
"token": "a github.com token",
}
`;
exports[`workers/global/config/parse/env .getConfig(env) supports Azure DevOps 1`] = `
{
"endpoint": "an Azure DevOps endpoint",

10
lib/workers/global/config/parse/env.spec.ts
View file

@ -148,6 +148,16 @@ describe('workers/global/config/parse/env', () => {
});
});
it('does not support GitHub fine-grained PATs', () => {
const envParam: NodeJS.ProcessEnv = {
GITHUB_COM_TOKEN: 'github_pat_XXXXXX',
RENOVATE_TOKEN: 'a github.com token',
};
expect(env.getConfig(envParam)).toMatchSnapshot({
token: 'a github.com token',
});
});
it('supports GitHub custom endpoint and gitlab.com', () => {
const envParam: NodeJS.ProcessEnv = {
RENOVATE_ENDPOINT: 'a ghe endpoint',

18
lib/workers/global/config/parse/env.ts
View file

@ -133,12 +133,18 @@ export function getConfig(inputEnv: NodeJS.ProcessEnv): AllConfig {
});
if (env.GITHUB_COM_TOKEN) {
logger.debug(`Converting GITHUB_COM_TOKEN into a global host rule`);
config.hostRules.push({
hostType: 'github',
matchHost: 'github.com',
token: env.GITHUB_COM_TOKEN,
});
if (env.GITHUB_COM_TOKEN.startsWith('github_pat_')) {
logger.warn(
'GITHUB_COM_TOKEN: Fine-grained Personal Access Tokens do not support do not support the GitHub GraphQL API. Use a classic PAT instead.'
);
} else {
logger.debug(`Converting GITHUB_COM_TOKEN into a global host rule`);
config.hostRules.push({
hostType: 'github',
matchHost: 'github.com',
token: env.GITHUB_COM_TOKEN,
});
}
}
// These env vars are deprecated and deleted to make sure they're not used