Renovate bot Azure DevOps npm feed auth error - azure

Question

I get an 401 error if I try to use my private npm registry in Azure DevOps. My configuration looks like this:
# pipeline.yaml (repo root folder)
steps:
- task: npmAuthenticate#0
inputs:
workingFile: .npmrc
- script: |
git config --global user.email 'bot#renovateapp.com'
git config --global user.name 'Renovate Bot'
npx --userconfig .npmrc renovate
env:
TOKEN: $(System.AccessToken)
PAT: $(PAT)
# config.js (repo root folder)
module.exports = {
platform: 'azure',
endpoint: 'https://devops.<url>.de/.../',
logLevel: 'debug',
token: process.env.TOKEN,
repositories: ['...'],
enabledManagers: ["npm"],
hostRules: [
{
enabled: true,
hostType: 'npm',
matchHost: 'devops.<url>.de',
token: process.env.PAT,
},
],
};
# .npmrc (repo root folder)
registry=https://devops.<url>.de/Collaboration/_packaging/.../npm/registry/
always-auth=true
The installation of renovate works and my registry get used for it. But renovate itself runs into a 401. How can I tell renovate to use the .npmrc generated from the `npmAuthenticate#0` task?
Error stack:
ERROR: Repository has unknown error (repository=...)
"err": {
"statusCode": 401,
"message": "Failed request: (401)",
"stack": "Error: Failed request: (401)\n at RestClient.<anonymous> (/root/.npm/_npx/05eeecd92f4e18e0/node_modules/typed-rest-client/RestClient.js:202:31)\n at Generator.next (<anonymous>)\n at fulfilled (/root/.npm/_npx/05eeecd92f4e18e0/node_modules/typed-rest-client/RestClient.js:6:58)\n at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"
}

Answer 1

The renovate command will modify the repo you defined in the config.js file(e.g. repositories: ['...']).
Since you are using the $(System.AccessToken) as authentication method, you need to grant Contribute permissions (e.g. Contribute,Contribute to pull requests,Create branch ) of target repo to the corresponding build service account.
Project Level Build Service Account Name: Your-project-name Build Service (your-collection-name)
Organization Level Build Service Account Name: Project Collection Build Service (your-collection-name)
You can navigate to Project Settings -> Repositories -> Target Repo -> Security and grant the Contribute permission to the two build service account.
For example:
For more detailed info, you can refer to this doc: Manage build service account permissions
On the other hand, if you need to update the repo from another project. You need to disable the option: Limit job authorization scope to current project for non-release pipelines in Project Settings -> Settings.

Answer 2

It seems that the official renovate docs for azure devops with a private feed isn't correct. This works for me:
Give the pipeline "Build User" contribute permissions on the feed:
Azure Devops Artifacts -> Settings -> Permissions -> Add the user/service that runs the pipeline with contributor.
azure-pipelines.yml
schedules:
- cron: '0 3 * * *'
displayName: 'Every day at 3am'
branches:
include: [main]
always: true
trigger: none
pool:
vmImage: ubuntu-latest
steps:
- task: npmAuthenticate#0
inputs:
workingFile: .npmrc
- bash: |
git config --global user.email 'bot#renovateapp.com'
git config --global user.name 'Renovate Bot'
npx --userconfig .npmrc renovate
env:
LOG_LEVEL: DEBUG
TOKEN: $(System.AccessToken)
RENOVATE_TOKEN: AZURE_DEVOPS_PAT_TOKEN_HERE
GITHUB_COM_TOKEN: REPLACEME
config.js
The important part here is to not use "pkgs.dev.azure.com" as the matchHost value, instead you can see in the debug logs if the feed is different on the 401'd requests, in my case it's "ORG_NAME_LOWERCASED.pkgs.visualstudio.com".
const repositories = require("./repositories");
// Security token used by the running build
const pipelineToken = process.env.TOKEN;
const patTokenForFeed = process.env.RENOVATE_TOKEN;
module.exports = {
platform: "azure",
endpoint: "https://dev.azure.com/ORG_NAME/",
token: pipelineToken,
hostRules: [
{
hostType: "npm",
matchHost: "ORG_NAME_LOWERCASED.pkgs.visualstudio.com",
username: "apikey",
password: patTokenForFeed,
},
],
repositories
};
.npmrc
registry=https://pkgs.dev.azure.com/ORG_NAME/PROJECT_NAME/_packaging/FEED_NAME/npm/registry/
always-auth=true