mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-26 15:31:53 +00:00
28ed2ee25e
When determining whether a Go module is public - which infers whether to cache it - we had previously miscategorised authenticated traffic to Go module proxies, as we only looked for `GOPROXY`, `GONOPROXY` and `GOPRIVATE`. Instead, we should treat a package as private if there is an authenticated Host Rule that matches the Go module. We can do this by checking for `hostType: go`, to catch only Go module specific authentication, and to avoid catching i.e. auth to `github.com`. If any credentials (`token`, `password` or `httpsPrivateKey`) are found, we treat this as credentialed. Co-authored-by: Claude Opus 5.5 <jamie.tanna+claude-code@mend.io>