Open r-plus opened 1 year ago
I'm running into the same thing. @r-plus, have you found a workaround, by any chance?
I think the fix for this should be a matter of replacing scp-style urls before shelling out to SwiftPM.
As a workaround, can you try replacing the url with an https url?
It's the same issue with https URLs, unfortunately. Dependabot just seems to ignore that we've given it access to the private repo which contains the private dependency.
Did you replace it in both manifest and lockfile? Can you copy redacted logs, just to see what the errors with https look like?
Yep, there's no trace of any non-https git URLs in our project.
Package.swift:
let package = Package(
[…]
dependencies: [
.package(url: "https://github.com/redacted-org/redacted-repo", exact: "0.4.8"),
[…]
]
[…]
)
Package.resolved:
[…]
{
"identity" : "redacted-repo",
"kind" : "remoteSourceControl",
"location" : "https://github.com/redacted-org/redacted-repo",
"state" : {
"revision" : "redacted-sha",
"version" : "0.4.8"
}
},
[…]
Logs:
[…]
proxy | 2023/10/23 19:46:07 [104] GET https://github.com:443/redacted-org/redacted-repo/info/refs?service=git-upload-pack
proxy | 2023/10/23 19:46:07 [104] * authenticating git server request (host: github.com)
proxy | 2023/10/23 19:46:07 [104] 404 https://github.com:443/redacted-org/redacted-repo/info/refs?service=git-upload-pack
proxy | 2023/10/23 19:46:07 [104] * auth'd git request returned 404, retrying without auth
proxy | 2023/10/23 19:46:07 [104] * de-auth'd request returned 401, replacing response
[…]
updater | error: Failed to clone repository https://github.com/redacted-org/redacted-repo:
updater | Cloning into bare repository '/home/dependabot/dependabot-updater/repo/Packages/.build/repositories/redacted-repo-aed36908'...
updater | fatal: could not read Username for 'https://github.com': terminal prompts disabled
updater | 2023/10/23 19:48:31 ERROR <job_739621514> /home/dependabot/common/lib/dependabot/shared_helpers.rb:344:in `run_shell_command'
updater | 2023/10/23 19:48:31 ERROR <job_739621514> /home/dependabot/swift/lib/dependabot/swift/file_parser/dependency_parser.rb:39:in `formatted_deps'
updater | 2023/10/23 19:48:31 ERROR <job_739621514> /home/dependabot/swift/lib/dependabot/swift/file_parser/dependency_parser.rb:25:in `block (2 levels) in parse'
updater | 2023/10/23 19:48:31 ERROR <job_739621514> /home/dependabot/common/lib/dependabot/shared_helpers.rb:195:in `with_git_configured'
updater | 2023/10/23 19:48:31 ERROR <job_739621514> /home/dependabot/swift/lib/dependabot/swift/file_parser/dependency_parser.rb:24:in `block in parse'
updater | 2023/10/23 19:48:31 ERROR <job_739621514> /home/dependabot/common/lib/dependabot/shared_helpers.rb:42:in `block in in_a_temporary_repo_directory'
updater | 2023/10/23 19:48:31 ERROR <job_739621514> /home/dependabot/common/lib/dependabot/shared_helpers.rb:42:in `chdir'
updater | 2023/10/23 19:48:31 ERROR <job_739621514> /home/dependabot/common/lib/dependabot/shared_helpers.rb:42:in `in_a_temporary_repo_directory'
updater | 2023/10/23 19:48:31 ERROR <job_739621514> /home/dependabot/swift/lib/dependabot/swift/file_parser/dependency_parser.rb:21:in `parse'
updater | 2023/10/23 19:48:31 ERROR <job_739621514> /home/dependabot/swift/lib/dependabot/swift/file_parser.rb:18:in `parse'
updater | 2023/10/23 19:48:31 ERROR <job_739621514> /home/dependabot/dependabot-updater/lib/dependabot/dependency_snapshot.rb:99:in `parse_files!'
updater | 2023/10/23 19:48:31 ERROR <job_739621514> /home/dependabot/dependabot-updater/lib/dependabot/dependency_snapshot.rb:90:in `initialize'
updater | 2023/10/23 19:48:31 ERROR <job_739621514> /home/dependabot/dependabot-updater/lib/dependabot/dependency_snapshot.rb:22:in `new'
updater | 2023/10/23 19:48:31 ERROR <job_739621514> /home/dependabot/dependabot-updater/lib/dependabot/dependency_snapshot.rb:22:in `create_from_job_definition'
updater | 2023/10/23 19:48:31 ERROR <job_739621514> /home/dependabot/dependabot-updater/lib/dependabot/update_files_command.rb:17:in `perform_job'
updater | 2023/10/23 19:48:31 ERROR <job_739621514> /home/dependabot/dependabot-updater/lib/dependabot/base_command.rb:53:in `run'
updater | 2023/10/23 19:48:31 ERROR <job_739621514> bin/update_files.rb:24:in `<main>'
[…]
Ok, there's a workaround that was helpfully suggested to me by GitHub support: with a GH access token in Dependabot secrets, we can register GH as a package registry and use that instead of relying on setting permissions in org settings (which doesn't seem to work for SPM, so this issue should still be kept open).
[…]
registries:
github-private:
type: git
url: https://github.com
username: x-access-token
password: ${{secrets.GITHUB_TOKEN_NAME_REPLACE_ME}}
updates:
- package-ecosystem: "swift"
schedule:
interval: "daily"
registries:
- github-private
[…]
Dependabot can now clone the private repository with the workaround suggested in https://github.com/dependabot/dependabot-core/issues/8027#issuecomment-1779394703, but it still fails to authenticate when downloading a package from Github Package Registry (published via KMMBridge). Is this supported? I couldn't find any related info the docs.
proxy | 2024/01/10 22:13:36 [116] 401 [https://maven.pkg.github.com:443/[...].zip](https://maven.pkg.github.com/[...].zip)
Is there an existing issue for this?
Package ecosystem
swift
Package manager version
5.8
Language version
5.8
Manifest location and content before the Dependabot update
/Package.swift
repository is
appbrew/try-dependabot-spm
,appbrew
is the organization name.and
Package.resolved
dependabot.yml content
Updated dependency
try-dependabot-spm-private
repo is not yet updated from 0.0.1, so I expect dependabot will not create pull request without error.What you expected to see, versus what you actually saw
I expect dependabot will not create pull request without error.
But dependabot will show repository clone error even if grant dependabot access to
try-dependabot-spm-private
repo that describing in this docs.Native package manager behavior
no output without error.
Images of the diff or a link to the PR, issue, or logs
No response
Smallest manifest that reproduces the issue
No response