Bertk
commented
4 years ago I use the following pipeline snippet for npm_and_yarn PRs and this work for public repository (dependabot default - no .npmrc).
pool:
vmImage: 'Ubuntu-16.04'
steps:
- task: UseRubyVersion@0
inputs:
versionSpec: '=2.6.5'
- script: |
gem install bundler
bundle install --retry=3 --jobs=4
displayName: 'bundle install'
- script: |
echo ---------------
export DEPENDABOT_NATIVE_HELPERS_PATH="$(pwd)/native-helpers"
mkdir -p $DEPENDABOT_NATIVE_HELPERS_PATH/{terraform,python,dep,go_modules,hex,composer,npm_and_yarn}
export PATH="$PATH:$DEPENDABOT_NATIVE_HELPERS_PATH/terraform/bin:$DEPENDABOT_NATIVE_HELPERS_PATH/python/bin:$DEPENDABOT_NATIVE_HELPERS_PATH/go_modules/bin:$DEPENDABOT_NATIVE_HELPERS_PATH/dep/bin"
export MIX_HOME="$DEPENDABOT_NATIVE_HELPERS_PATH/hex/mix"
cp -r $(bundle show dependabot-npm_and_yarn)/helpers $DEPENDABOT_NATIVE_HELPERS_PATH/npm_and_yarn/
ls -Rl $DEPENDABOT_NATIVE_HELPERS_PATH/npm_and_yarn/helpers
echo ---------------
$DEPENDABOT_NATIVE_HELPERS_PATH/npm_and_yarn/helpers/build $DEPENDABOT_NATIVE_HELPERS_PATH/npm_and_yarn
bundle exec ruby ./update.rb
env:
SYSTEM_ACCESSTOKEN: $(DependabotToken)
GITHUB_ACCESS_TOKEN: $(GithubToken)
NPM_ACCESS_Token: $(NpmToken)Using a Azure DevOps artifact feed will create this error message:
/opt/hostedtoolcache/Ruby/2.6.5/x64/lib/ruby/gems/2.6.0/gems/dependabot-npm_and_yarn-0.116.6/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb:317:in `check_npm_response': The following source could not be reached as it requires authentication (and any provided details were invalid or lacked the required permissions): pkgs.dev.azure.com/XXXXXXX/_packaging/XXXXXXX/npm/registry (Dependabot::PrivateSourceAuthenticationFailure)
from /opt/hostedtoolcache/Ruby/2.6.5/x64/lib/ruby/gems/2.6.0/gems/dependabot-npm_and_yarn-0.116.6/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb:271:in `npm_details'
from /opt/hostedtoolcache/Ruby/2.6.5/x64/lib/ruby/gems/2.6.0/gems/dependabot-npm_and_yarn-0.116.6/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb:99:in `valid_npm_details?'
from /opt/hostedtoolcache/Ruby/2.6.5/x64/lib/ruby/gems/2.6.0/gems/dependabot-npm_and_yarn-0.116.6/lib/dependabot/npm_and_yarn/update_checker/latest_version_finder.rb:33:in `latest_version_from_registry'
from /opt/hostedtoolcache/Ruby/2.6.5/x64/lib/ruby/gems/2.6.0/gems/dependabot-npm_and_yarn-0.116.6/lib/dependabot/npm_and_yarn/update_checker.rb:170:in `latest_released_version'
from /opt/hostedtoolcache/Ruby/2.6.5/x64/lib/ruby/gems/2.6.0/gems/dependabot-npm_and_yarn-0.116.6/lib/dependabot/npm_and_yarn/update_checker.rb:197:in `latest_version_details'
from /opt/hostedtoolcache/Ruby/2.6.5/x64/lib/ruby/gems/2.6.0/gems/dependabot-npm_and_yarn-0.116.6/lib/dependabot/npm_and_yarn/update_checker.rb:22:in `latest_version'
from /opt/hostedtoolcache/Ruby/2.6.5/x64/lib/ruby/gems/2.6.0/gems/dependabot-npm_and_yarn-0.116.6/lib/dependabot/npm_and_yarn/update_checker.rb:27:in `latest_resolvable_version'
from /opt/hostedtoolcache/Ruby/2.6.5/x64/lib/ruby/gems/2.6.0/gems/dependabot-common-0.116.6/lib/dependabot/update_checkers/base.rb:72:in `preferred_resolvable_version'
from /opt/hostedtoolcache/Ruby/2.6.5/x64/lib/ruby/gems/2.6.0/gems/dependabot-npm_and_yarn-0.116.6/lib/dependabot/npm_and_yarn/update_checker.rb:63:in `updated_requirements'
from /opt/hostedtoolcache/Ruby/2.6.5/x64/lib/ruby/gems/2.6.0/gems/dependabot-common-0.116.6/lib/dependabot/update_checkers/base.rb:248:in `requirements_up_to_date?'
from /opt/hostedtoolcache/Ruby/2.6.5/x64/lib/ruby/gems/2.6.0/gems/dependabot-common-0.116.6/lib/dependabot/update_checkers/base.rb:31:in `up_to_date?'
from ./update.rb:74:in `block in <main>'
from ./update.rb:65:in `each'
from ./update.rb:65:in `<main>'
RobinDink
cbb-it-minds
wizgob
Hey,
first off I think it would be a good idea to expand the documentation for npm support. Which is basically setting "package_manager" to "npm_and_yarn" instead of "nuget" in the update.rb. However, even though the bot correctly recognizes outdated npm-packages, I'm still getting some weird error:
Any idea on how to fix this?
Cheers, Robin