Renovate downgraded npm lockfile version from v2 to v1 #14409
Replies: 3 comments 11 replies
-
|
Hi there, We have found that there's a problem with the logs. Depending on which situation applies follow one, some or all of these instructions. No logs at allIf there's no log posted yet, we need you to find and copy/paste the log into the issue template. Finding logs on hosted appClick me to read instructionsIf you use the Renovate app (GitHub):
Finding logs when self-hostingClick me to read instructionsIf you're running self-hosted, run with Insufficient logsClick me to read instructionsIf you already provided logs, and the Renovate team said they are not enough, follow the instructions from the No logs at all section. Formatting your logsClick me to read instructionsPlease put your logs in a |
Beta Was this translation helpful? Give feedback.
-
|
I could enable debug logging and attach the logs if necessary, but is it really necessary? |
Beta Was this translation helpful? Give feedback.
-
|
I wouldn’t have asked if not |
Beta Was this translation helpful? Give feedback.
-
|
Here's the log for the same repo, but different update: renovate.log |
Beta Was this translation helpful? Give feedback.
-
|
Thanks, this log confirms that npm v6 is being run: I recommend |
Beta Was this translation helpful? Give feedback.
-
|
I assume you are using the full renovate docker image? You need to set |
Beta Was this translation helpful? Give feedback.
-
|
You probably don't run renovate via default docker entrypoint, so the |
Beta Was this translation helpful? Give feedback.
-
|
Please describe in detail how you run / start renovate ( the pipeline) |
Beta Was this translation helpful? Give feedback.
-
|
Ah, that's an interesting point 🙂 I am using a setup inspired by your comment here: renovatebot/config-help#674 (comment) It's not the first iteration, I tweaked the setup multiple times (big fan of your tooling and its flexibility by the way 😉 ). Current setup
It seem to source /usr/local/etc/env, so there are multiple variables to set before running. This section was basically the invocation up until now: def renovateImage = 'renovate/renovate:32.6.9@sha256:42de47b9c291bda39339c9348957e7789fa6a6dd12b0763ba6014efb1b0d3562'
def workerLabel = 'renovate-worker'
def getSanitizedRepoString(repo) {
return repo.replaceAll('/','-').toLowerCase()
}
node(workerLabel) {
def volume = getSanitizedRepoString(repo)
docker.image(renovateImage).inside("-v ${volume}:/tmp/renovate") {
stage(repo) {
withCredentials([
...
usernamePassword(credentialsId: 'xxx', passwordVariable: 'GITHUB_COM_TOKEN', usernameVariable: 'GITHUB_COM_USER')
]) {
checkout scm
unstash 'npmrc'
// Note that npm will be dynamically installed if necessary, just display defaults
sh label: 'Display versions', script: """
node --version
npm --version
renovate --version
"""
sh label: 'Restore ~/.npmrc', script: 'cp -f .npmrc ~/.npmrc'
// set dry run to true on non-master branches
def dryRun = env.BRANCH_NAME != "master"
sh label: 'Run Renovate', script: """
export LOG_LEVEL=debug
rm -f renovate.log
renovate --dry-run=${dryRun}
"""
// upload logs via curl
}
}
}
}Fix AttemptsI tried to changed the invocation to include the entrypoint script now, but that did not change the behavior in renovate: docker.image(renovateImage).inside("--entrypoint=/usr/local/bin/docker-entrypoint.sh -v ${volume}:/tmp/renovate") {...}Next try was to directly add the entrypoint script to invoke the renovate cli: sh label: 'Run Renovate', script: """
export LOG_LEVEL=debug
# ensure to delete renovate.log file as containers might get reused
rm -f renovate.log
# binarySource=install will fail otherwise, see https://github.com/renovatebot/renovate/discussions/14409#discussioncomment-2435792
/usr/local/bin/docker-entrypoint.sh renovate --dry-run=${dryRun}
"""That seem to have changed that behavior, the log now indicates that the install tool faces issues to access '/home/ubuntu/.npm': On the PR that raises this message: ⚠ Artifact update problemRenovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below: File name: package-lock.jsonI could create the .npm directory: But the $ docker run --rm -it 65e3a8f747c5 bash
ubuntu@e92540f2e5b8:/usr/src/app$ ls
dist node_modules package.json
ubuntu@e92540f2e5b8:/usr/src/app$ which npm
/usr/local/bin/npm
ubuntu@e92540f2e5b8:/usr/src/app$ ls -lah /usr/local/bin/npm
lrwxrwxrwx 1 root root 31 Mar 23 18:29 /usr/local/bin/npm -> /usr/local/node/14.19.1/bin/npm
ubuntu@e92540f2e5b8:/usr/src/app$ chown 1000:0 /usr/local/bin/npm
chown: changing ownership of '/usr/local/bin/npm': Operation not permitted
ubuntu@e92540f2e5b8:/usr/src/app$ sudo chown 1000:0 /usr/local/bin/npm
bash: sudo: command not found |
Beta Was this translation helpful? Give feedback.
-
|
this is the cause: |
Beta Was this translation helpful? Give feedback.
-
|
Thanks, I got it working in the meantime by invoking the container via the docker cli directly. Somehow the docker Jenkins plugin seem to handle internals differently... but using docker run + engines > npm ^8.5.0 on the target repo and binarySource=install in the bot config solved the problem for me 🙂 |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
How are you running Renovate?
Self-hosted
If you're self-hosting Renovate, tell us what version of Renovate you run.
31.89.12
Please select which platform you are using if self-hosting.
Bitbucket Cloud (bitbucket.org)
If you're self-hosting Renovate, tell us what version of the platform you run.
It's a cloud service, there's no versioning.
Was this something which used to work for you, and then stopped?
Not applicable, because this is a fairly new installation.
Describe the bug
I enabled Renovate for a frontend project yesterday, which uses NPM, and at least one of Renovate's first pull requests contained an update of axios:
However, the diff in package-lock.json was so huge that Bitbucket refuses to display it, and a really unexpected change in that diff was a downgrade of file version from v2 to v1 and removal of the whole
packagesstructure from the file:This appears to be exactly the opposite of what was reported in #14062.
Is there any way for us to prevent such lockfile downgrades in the future? Or any explanation why it would happen in the first place?
Relevant debug logs
No response
Have you created a minimal reproduction repository?
No reproduction repository
Beta Was this translation helpful? Give feedback.
All reactions