Problem using host rules

[renewfresho]

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Mend Renovate hosted app on github.com

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

We have private gems hosted on github.com
So bundler needs to authenticate.
We don't want to use https because we don't want the credentials to be stored into the lockfile.
So we need to use the username and password - it's not possible to set environment variables that don't start with MEND_ so we would like to use the host rules.
When we set up host rules like so:

  "hostRules": [
    {
      "matchHost": "github.com",
      "hostType": "rubygems",
      "username": "{{ secrets.MEND_GITHUB_USERNAME }}",
      "password": "{{ secrets.MEND_GITHUB_PASSWORD }}"
    }
  ],

We are still getting an auth problem:

Host key verification failed.\r\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists

Here's the repo and job you can inspect:

https://developer.mend.io/github/Fresho-Org/fresho-document-store/-/job/990c1a2c-e0f5-4bd3-90ac-990e50cdb2bd

Cheers,
Rene

Logs (if relevant)

Logs

Host key verification failed.\r\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists

[rarkins]

Are the private gems in the same github org (Fresho-Org)? Are the repos which need to access it also private repos?

[rarkins]

What type of dependency is it? Is it a git dependency (e.g. https://github.com/Fresho-org/something) or on GitHub's package registry (rubygems.pkg.github.com)?

[JodyVanden]

the dependency is a git dependency

[JodyVanden]

Is it possible to store a ssh key to be able to access a github repo?
I think we have tried a lot of options and the only remaining options would be:

• pass a ssh key to access the gem
• split the gemfile in multiple gemfiles and gemfile.lock and have all private gems in one that renovate could ignore - seems too annoying for our ways of working
• move all our gems to be accessed through https with a token - seems also annoying in terms of way of working

[JodyVanden]

we got it working 🥳
we changed the gemfile to only access through HTTPS and used the hostrules in the mend UI

git_source(:github) do |repo|
    "https://github.com/#{repo}.git"
end

Now we have to figure out how our devs are able to access the gem with a github token

thank you for help!

[JodyVanden]

to overcome our switch from ssh to github token, we used the github CLI to easily retrieve our token and store it for bundler to use it
might be good to put that in the documentation for future devs 🚀

gh auth login -h github.com --skip-ssh-key
export BUNDLE_GITHUB__COM=$(gh auth token)