Repository navigation
Using GitHub secrets for adding hostRules.token for Private Terraform Cloud Module #830
Description
Hi,
I am using the renovatebot/github-action@v40.1.6 and are trying to fetch a GitHub secret and add it to the hostRules configuration during a GitHub actions run. At the moment my workflow looks like this:
name: Renovate-terraform
on:
schedule:
- cron: '0 */6 * * *'
workflow_dispatch:
jobs:
renovate:
runs-on: ubuntu-latest
steps:
- name: Get token
id: get_token
uses: getsentry/action-github-app-token@v3
with:
app_id: ${{ secrets.APP_ID }}
private_key: ${{ secrets.APP_PRIVATE_KEY }}
- name: Checkout
uses: actions/checkout@v4.1.1
- name: Self-hosted Renovate
uses: renovatebot/github-action@v40.1.6
with:
configurationFile: terraform-renovate.json
token: '${{ steps.get_token.outputs.token }}'
env:
LOG_LEVEL: 'debug'
RENOVATE_DETECT_HOST_RULES_FROM_ENV: true
TERRAFORM_CLOUD_TOKEN: ${{ secrets.TERRAFORM_CLOUD_TOKEN }}My renovate.json looks like this:
{
"repositories": [
"XXXX/ent-app-aks-infrastructure"
],
"printConfig": false,
"allowCustomCrateRegistries": true,
"allowScripts": true,
"exposeAllEnv": true,
"assignAutomerge": false,
"automerge": false,
"branchPrefix": "renovate/",
"platform": "github",
"forkProcessing": "disabled",
"assigneesFromCodeOwners": true,
"prHourlyLimit": 0,
"timezone": "Europe/Oslo",
"dependencyDashboard": false,
"extends": ["config:recommended", ":disableDependencyDashboard"],
"kubernetes": {"enabled": true, "fileMatch": ["\\.ya?ml$"]},
"packageRules": [
{"matchManagers": ["terraform"], "groupName": "terraform"},
{"matchManagers": ["kubernetes"], "groupName": "kubernetes"}
],
"vulnerabilityAlerts": {"addLabels": ["security"]},
"username": "Renovate-bot-XXXXXX[bot]",
"gitAuthor": "Renovate-bot-XXXXXX <136432898+renovate-bot-XXXXXX[bot]@users.noreply.github.com>",
"hostRules": [
{
"hostType": "terraform-module",
"matchHost": "app.terraform.io",
"token": "{{ env.TERRAFORM_CLOUD_TOKEN }}"
}
]
}When I run the above config, it seems like the token is added to the setup, but it fails when it is trying to fetch the module:
DEBUG: Combined config
"config": {
"repositories": ["XXXXXX/ent-app-aks-infrastructure"],
"printConfig": false,
"allowCustomCrateRegistries": true,
"allowScripts": true,
"exposeAllEnv": true,
"assignAutomerge": false,
"automerge": false,
"branchPrefix": "renovate/",
"platform": "github",
"forkProcessing": "disabled",
"assigneesFromCodeOwners": true,
"prHourlyLimit": 0,
"timezone": "Europe/Oslo",
"dependencyDashboard": false,
"extends": ["config:recommended", ":disableDependencyDashboard"],
"kubernetes": {"enabled": true, "fileMatch": ["\\.ya?ml$"]},
"packageRules": [
{"matchManagers": ["terraform"], "groupName": "terraform"},
{"matchManagers": ["kubernetes"], "groupName": "kubernetes"}
],
"vulnerabilityAlerts": {"addLabels": ["security"]},
"username": "Renovate-bot-spv[bot]",
"gitAuthor": "Renovate-bot-spv <136432898+renovate-bot-XXXXXX[bot]@users.noreply.github.com>",
"hostRules": [
{
"hostType": "terraform-module",
"matchHost": "app.terraform.io",
"token": "***********"
}
],
"detectHostRulesFromEnv": true,
"token": "***********"
}
DEBUG: hostRules: applying *** for app.terraform.io (repository=XXXXXX/ent-app-aks-infrastructure)
DEBUG: hostRules: no authentication for registry.terraform.io (repository=XXXXXX/ent-app-aks-infrastructure)
DEBUG: GET https://app.terraform.io/api/registry/v1/modules/XXXXXX/spoke-subnet/module = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=401 retryCount=0, duration=49) (repository=XXXXXX/ent-app-aks-infrastructure)
DEBUG: Datasource unauthorized (repository=XXXXXX/ent-app-aks-infrastructure)
"datasource": "terraform-module",
"packageName": "app.terraform.io/XXXXXX/spoke-subnet/module",
"url": "https://app.terraform.io/api/registry/v1/modules/XXXXXX/spoke-subnet/module"
DEBUG: Failed to look up terraform-module package app.terraform.io/XXXXXX/spoke-subnet/module (repository=XXXXXX/ent-app-aks-infrastructure, packageFile=01-subnet/main.tf, dependency=app.terraform.io/XXXXXX/spoke-subnet/module)
When I add the token value directly in the config like
"token": "xxxxxxx"
it works perfectly.
I wonder if there is a way for me to fetch the token for Terraform Cloud from a GitHub secret? It could be something I don't really understand here and would love some pointers in the right direction if possible.
Activity
rarkins commentedon Apr 11, 2024
Renovate does not automatically populate the contents of
envforrenovate.jsonas this would be a security risk. You'd be better to create your hostRules in a config.js file which is admin-controlled and allowed to read env using process.env.X