mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-29 16:59:02 +00:00
secustor
6b6b685619
Git's `insteadOf` variables, the git remote URL, and the generated `.npmrc` and `.yarnrc.yml` each preferred a host rule's `token` over its `username` and `password`. The HTTP layer, the docker datasource, composer and bundler prefer Basic. Move all three onto `resolveAuth()`, so one precedence applies everywhere: a `password` wins over a `token`. Behaviour changes, for a rule that ends up carrying both - which rank merging of a broad and a specific rule produces easily enough: - `getGitAuthenticatedEnvironmentVariables()` now writes `url.https://<user>:<password>@host/.insteadOf` where it wrote the token - "prefers username and password over token" in lib/util/git/auth.spec.ts - `getRemoteUrlWithToken()` now returns `https://<user>:<password>@host/` where it returned the token - "prefers username and password over token" in lib/util/git/url.spec.ts - the post-update rules now write `:username=` and `:_password=`, and yarn's `npmAuthIdent`, where they wrote `:_authToken=` (or `:_auth=`) and `npmAuthToken` - "prefers username and password over token" in lib/modules/manager/npm/post-update/rules.spec.ts A `password` set without a `username` is a Basic credential at these sites too now, as it already was for HTTP requests: git gets `https://:<password>@host/` and the npmrc an empty `:username=`. `getGitEnvironmentVariables()` therefore also picks up a rule that carries only a `password`. The `hostRules` documentation now states the precedence, both in general and for `authType`, which only applies to a `token`.