git submodules: reuse an existing SSH key

[Crocmagnon]

Tell us more.

Hello 👋🏻

Idea/request

Re-use an existing ssh key when fetching git submodules if renovate already works in an ssh context.

Context

Following off-topic conversation in #32083

We currently use ssh submodules with a .gitmodules similar to this on a self hosted bitbucket instance:

[submodule ".sub"]
	path = .sub
	url = ssh://git@bitbucket.example.com:7999/PROJECT/repo.git

We enabled git submodules with:

  "git-submodules": {
    "enabled": true
  }

We observed in renovate logs that it tried to pull the dependency using https instead of ssh. However, https access for SCM has been disabled by the instance admins:

{"name":"renovate","hostname":"xxx","pid":204,"level":50,"logContext":"xxx","repository":"PROJECT/repo2","baseBranch":"develop","currentDigest":"xxx","currentValue":"master","datasource":"git-refs","packageName":"https://bitbucket.example.com/scm/PROJECT/repo.git","followTag":null,"packageFile":".gitmodules","pinDigests":false,"rollbackPrs":false,"updatePinnedDependencies":true,"unconstrainedValue":false,"err":{"task":{"commands":["ls-remote","https://**redacted**@bitbucket.example.com/scm/PROJECT/repo.git"],"format":"utf-8","parser":"[function]"},"message":"fatal: remote error: SCM access over HTTP(S) has been disabled\nSCM access over HTTP(S) has been disabled\n","stack":"Error: fatal: remote error: SCM access over HTTP(S) has been disabled\nSCM access over HTTP(S) has been disabled\n\n    at Object.action (/usr/local/renovate/node_modules/.pnpm/simple-git@3.25.0/node_modules/simple-git/src/lib/plugins/error-detection.plugin.ts:42:29)\n    at PluginStore.exec (/usr/local/renovate/node_modules/.pnpm/simple-git@3.25.0/node_modules/simple-git/src/lib/plugins/plugin-store.ts:54:29)\n    at /usr/local/renovate/node_modules/.pnpm/simple-git@3.25.0/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:124:42\n    at new Promise (<anonymous>)\n    at GitExecutorChain.handleTaskData (/usr/local/renovate/node_modules/.pnpm/simple-git@3.25.0/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:121:14)\n    at GitExecutorChain.<anonymous> (/usr/local/renovate/node_modules/.pnpm/simple-git@3.25.0/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:97:40)\n    at Generator.next (<anonymous>)\n    at fulfilled (/usr/local/renovate/node_modules/.pnpm/simple-git@3.25.0/node_modules/simple-git/dist/cjs/index.js:52:24)"},"msg":"lookupUpdates error","time":"2024-12-12T09:51:08.838Z","v":0}

There's an additional log indicating that renovate found hostRules for the url:

{"name":"renovate","hostname":"687faa362b5d","pid":204,"level":20,"logContext":"ENAXv4o1WDs7f2iw5IT86","repository":"PRISMCMDB/cmdb-api","baseBranch":"develop","msg":"Found hostRules username and password for url https://bitbucket.example.com/scm/PROJECT/repo.git","time":"2024-12-12T09:51:08.260Z","v":0}

I've confirmed with the instance admins that they indeed have credentials setup for API calls to get information on pull requests.

Question from @rarkins:

How does Renovate successfully clone your repo to begin with? e.g. have you mounted an SSH key into the Renovate container and got it to work that way?

That's correct.

[rarkins]

How does Renovate know already to use SSH for cloning instead of HTTPS? e.g. do you configure gitUrl?

[Crocmagnon]

From our instance admins:

We start a renovate docker container, then inside the container, we git clone the repo over ssh (with --recursive), prepare some configuration, and then, run renovate.

[rarkins]

That doesn't seem to make sense. Renovate clones each repo itself

[Crocmagnon]

They're cloning the repo themselves before to fetch and compute stuff before running renovate's analysis.

[rarkins]

Sorry, I'm not familiar with this use case / way of running so can't support further