Mix npm public repositories with private gitlab npm

[hieroshima]

Hi,

I would like to ask if possible is to mix private npm on gitlab with public npm registry? Currently, I have that kind of configuration:

...
"ignoreNpmrcFile": true,
"hostRules": [
    {
      "hostName": "gitlab.com",
      "ignoreNpmrcFile": false
    }
  ],
...

and I'm using self-hosted Renovate installation. Inside the main dir where config.js is, I have .npmrc file with auth to the gitlab.com npm repo. Once I'm running a bot, I'm getting error:

WARN: artifactErrors (repository=, branch=dependencies/update-dependencies-)
"artifactErrors": [
{
"lockFile": "src//package-lock.json",
"stderr": "npm ERR! code E404\nnpm ERR! 404 Not Found - GET https://registry.npmjs.org/[name-of-the-private-repository-on-gitlab] - Not found\nnpm ERR! 404 \nnpm ERR! 404 [private-repository-on-gitlab]@^0.31.0' is not in the npm registry.\nnpm ERR! 404 "

I think that .npmrc is overwritten npm registry, but that is why I used ignoreNpmrcFile for all and used hostRules for gitlab.

Can someone advice how it should be done to work in that way? :)

Thanks in advance

[viceice]

ignoreNpmrcFile can't be used in host rules, it is a top level config option only

[hieroshima]

@rarkins Sorry, I used wrong word - it is the scope - not the repository :)

@viceice debug:

{
                 "depType": "dependencies",
                 "depName": "@<private-scope>/shared-library",
                 "currentValue": "^0.18.0",
                 "datasource": "npm",
                 "prettyDepType": "dependency",
                 "lockedVersion": "0.18.0",
                 "depIndex": 0,
                 "updates": [
                   {
                     "fromVersion": "0.18.0",
                     "toVersion": "0.31.0",
                     "newValue": "^0.31.0",
                     "newMajor": 0,
                     "newMinor": 31,
                     "updateType": "minor",
                     "isSingleVersion": false,
                     "isRange": true
                   }
                 ],
                 "warnings": [],
                 "fixedVersion": "0.18.0"
               },

Error:

DEBUG: Executing command
"command": "npm install --package-lock-only --ignore-scripts --no-audit"
DEBUG: lock file error 
"err": {
"killed": false,
"code": 1,
"signal": null,
"cmd": "npm install --package-lock-only --ignore-scripts --no-audit",
"stdout": "",
"stderr": "npm ERR! code E404\nnpm ERR! 404 Not Found - GET https://**redacted**@<private-scope>%2fshared-library\nnpm ERR! 404 \nnpm ERR! 404  '@<private-scope>/shared-library@^0.31.0' is not inthe npm registry.\nnpm ERR! 404 You should bug the author to publish it (or use the name yourself!)\nnpm ERR! 404 It was specified as a dependency of 'team-assets'\nnpm ERR! 404 \nnpm ERR! 404 Note that you canalso install from a\nnpm ERR! 404 tarball, folder, http url, or git url.\n\nnpm ERR! A complete log of this run can be found in:\nnpm ERR!     /tmp/renovate/cache/others/npm/_logs/2021-01-26T09_59_37_647Z-debug.log\n",
"message": "Command failed: npm install --package-lock-only --ignore-scripts --no-audit\nnpm ERR! code E404\nnpm ERR! 404 Not Found - GET https://**redacted**@<private-scope>%2fshared-library\nnpm ERR! 404 \nnpm ERR! 404  '@<private-scope>/shared-library@^0.31.0' is not in the npm registry.

When I open this 404 link - it is to gitlab npm with my library - I can see whole library with all versions

[hieroshima]

I don't have an idea how it is possible that he knows about to what version this lib should be upgraded, but at the same time it returns 404 error that lib does not exist

[rarkins]

This means that Renovate knows how to look up the private package but now npm does not. i.e. the .npmrc which npm is accessing does not contain the right registry and/or token.

[rarkins]

Please make sure that the baseUrl in your hostRules is https://gitlab.com/api/v4/packages/npm/ and not the shortened https://gitlab.com

[hieroshima]

🤦 How I could miss this... Thank you so much! It works now perfectly :)