Lookup of dependencies from a private Gitlab Maven repository

[otbe]

Hi,

Im just wondering if there's currently a way to fetch dependency updates from private gitlab repository via Maven.
Depending on the token type you use you have to use different names for the HTTP header that you have to send alongside your requests. See https://docs.gitlab.com/ee/user/packages/maven_repository/#authenticate-to-the-package-registry-with-maven

I found an issue in the old renovate-config repo about this topic renovatebot/config-help#998 and it indicates that it works (or worked) but I cant get it working CI tokens nor PAT.

In my renovate config I use something like:

    {
      "baseUrl": "https://gitlab.com/api/v4/groups/XXXXXXX/-/packages/maven",
      "encrypted": {
        "token": "<encryptedToken>"
      }
    }

and in my pom.xml something like:

	<repositories>
		<repository>
			<id>gitlab-maven</id>
			<url>https://gitlab.com/api/v4/groups/XXXXXXX/-/packages/maven</url>
		</repository>
	</repositories>

Any ideas what I am doing wrong here?

[rarkins]

How are you running Renovate? e.g. self-hosted or hosted app?

[otbe]

Currently we have a mixed approach. Some projects are on self-hosted and some on hosted.
We already use Gitlabs docker registry for our internal images which works quite fine

[rarkins]

What does the debug log "packageFiles with updates" look like right now for that gitlab-hosted package?

[otbe]

I take this knowledge from their docs https://docs.gitlab.com/ee/user/packages/maven_repository/#authenticate-to-the-package-registry-with-maven

It doesn't work without the "custom" header field, even locally.

[rarkins]

Thanks, that would definitely explain it. @viceice I'm surprised that GitLab didn't add support for the standard header for maven at the same time they did for their API

[viceice]

🤷‍♂️

[rarkins]

Here's where you can see that PAT are supported by the API using standard headers: https://docs.gitlab.com/ee/api/

Is it a different access control mechanism for the maven registry?

[otbe]

It seems to work! At least locally I was able to use Authorization: Bearer <token>. Ill dive deeper into the issue later. Thanks!