How to set up Renovate for a Python repo on a private GCP artifact registry #24326
Replies: 4 comments 5 replies
-
|
use |
Beta Was this translation helpful? Give feedback.
-
|
Yeah, I have tried that. It isn't quite clear what is meant by the "base64 JSON value". As shown in the link above, I discovered that Google actually uses the following as the password (base64 decoded): {
"type": "service_account",
"project_id": "<my-project>",
"private_key_id": "<my-private-key-id>",
"private_key": "-----BEGIN PRIVATE KEY-----\n <stripped for security reasons> \n-----END PRIVATE KEY-----\n",
"client_email": "my-service-account@my-project.iam.gserviceaccount.com",
"client_id": "<removed for privacy>",
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
"token_uri": "https://oauth2.googleapis.com/token",
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/my-service-account%40my-project.iam.gserviceaccount.com",
"universe_domain": "googleapis.com"
}So it's unclear whether I should give this whole thing (base64 encoded) as the password, just the private key (base64 encoded) as the password, or if there is some other weird configuration to try. I have tried the entire blurb and just the private key. Neither worked. Have you ever successfully had renovate with a Google Cloud Python Artifact Registry that is connecting using a service account? Thanks so much for the help! |
Beta Was this translation helpful? Give feedback.
-
|
I have a follow up, which I can instead convert to a bug, except that I am not quite sure how to report it. After further adjusting and a few PRs today, I was able to get things to work by doing the following:
Once I got this to work again, I turned the encryption back on and it broke again. So I have narrowed the problem to be with the encryption. Details of working solution
|
Beta Was this translation helpful? Give feedback.
-
|
you need to pass the GitHub organization and the GitHub repo (optional) to the encryption form |
Beta Was this translation helpful? Give feedback.
-
|
@lazarillo I think you've misunderstood the purpose of the organizations field. The orgs in that encrypt form are meant to be the github orgs you scope the secret to |
Beta Was this translation helpful? Give feedback.
-
|
OK, thanks! I'm not sure what you mean, though. Can you give an example of what the For instance, we are Cellpoint Digital, we use GitHub and GCP, our GitHub org path is |
Beta Was this translation helpful? Give feedback.
-
|
No, just cellpointdigital |
Beta Was this translation helpful? Give feedback.
-
|
I have a similar setup, only with JFrog Artifactory instead of GCP and after many self-directed exploration of the configuration and documentation of Renovate, I can confirm that either:
To be proven wrong, I'd like to be able to take inspiration from an available, working, example, but the most official documentation I've read, starting with:
have not led to a satisfying conclusion. This discussion by @lazarillo actually offered a working option by suggesting to not use the encrypted fields. |
Beta Was this translation helpful? Give feedback.
-
|
I experience a similar issue. {
"hostType": "pypi",
"matchHost": "europe-west3-python.pkg.dev",
"username": "_json_key_base64",
"password": "<BASE64_PW>"
}renovate succesfully authenticates, but when trying to read the password from the container ENV like so "password": "process.env.GAR_PYTHON_SA_B64"authentication fails with |
Beta Was this translation helpful? Give feedback.
-
How are you running Renovate?
Mend Renovate hosted app on github.com
If you're self-hosting Renovate, tell us what version of Renovate you run.
No response
If you're self-hosting Renovate, select which platform you are using.
None
Was this something which used to work for you, and then stopped?
I never saw this working
Wanted end result.
Include searches for package dependencies on private, Google Artifact Registry Python packages using
pyproject.tomlfor dependency list and a Google service account / token.What you tried so far.
I actually wrote a very detailed question in Stack overflow, then realized I should have probably started here first.
Here is the stack overflow question:
https://stackoverflow.com/q/77066978/534238
Relevant debug logs
Logs
Beta Was this translation helpful? Give feedback.
All reactions