AWS Codeartifact support

[jonathanpruvost]

Hi,

We are currently testing the Renovate implementation on the repos of our applications.

Our stack:

• renovate hosted Github app
• pnpm
• lockFileMaintenance: true
• AWS codeartifact

We are having a problem with our private packages.
We use AWS codeartifact for our own npm registry.

We tested adding hostedRules with a hard-written token in the config and it works fine.

The problem is that the maximum duration of an AWS codeartifact token is 12 hours.
We haven't found in the documentation to be able to do this dynamically.

In the self-hosted version it seems possible to run the github action and pass the RENOVATE_HOST_RULES environment variable.

What solution do you recommend?

Thank you

[HonkingGoose]

Related issue:

• Update doc for ecr and codeartifact #13833

[viceice]

hosted app doesn't execute any scripts for security reasons

[rarkins]

In theory we could support having the user configure a long lived credential which is used to retrieve a short lived one at runtime

[jonathanpruvost]

Cool, good news, that would be a good solution.

[D3X]

In theory we could support having the user configure a long lived credential which is used to retrieve a short lived one at runtime

Do you mean a long lived credential for calling a user-defined endpoint/service that returns the short lived credential for CodeArtifact (or any other repository for that matter)? I would love to see that, it would allow us to use the renovate github app instead of self hosting.

[shriyanskapoor]

Could u share your config.json?

[Lewenhaupt]

Any update on this issue? We're facing problems because of this because renovate bot is unable to to update the pnpm lock file when it can't access AWS CodeArtifact. We use the cloud version.

[D3X]

@Lewenhaupt you actually need to use a github PAT for that.

More details in the links below:
https://docs.renovatebot.com/mend-hosted/credentials/#automating-secrets-via-apis-github-only
#36475

edit: I just realised a github PAT won't work if you don't use GH 🤦
Unfortunately, I don't know how to do it any other way. Maybe someone from the Renovate staff will be able to help. (I'm just a mere user)

[Lewenhaupt]

Ah crap ^^ Thanks anyway, I'll see if I can find someone from renovate :)

[Lewenhaupt]

@viceice Do you know if we can do this via bitbucket? Or would we need to setup a proxy that can accept a longlived credential and call downstream using codeartifact login?

[Lewenhaupt]

I should add that the reason why I'm looking for a solution for this is because when using pnpm the lock-file can't be updated. It seems that our projects that are still using npm are fine because renovate seems to be able to handle it as it appears to manually update the package-lock instead of running an actual install.

[viceice]

@viceice Do you know if we can do this via bitbucket? Or would we need to setup a proxy that can accept a longlived credential and call downstream using codeartifact login?

no, I'm not involved in mend hosted apps.

[github-actions[bot]]

Hi there,

This is intended as a polite, automated request that users avoid @ mentioning repository maintainers like @viceice. Doing so causes annoying mobile notifications and makes it harder to maintain this repository.

We know it might be common elsewhere but we participate in hundreds of discussions a week and would need to turn off GitHub mobile notifications if we were mentioned in every one.

As a general rule, we will read and respond to all discussions in this repository, so there is no need to mention us.

Thanks, the Renovate team