preCommands not executing for binarySource=global and bundler authentication

[lbarros-asml]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

GitHub

Please tell us more about your question or problem

EDIT: Sorry, I've linked the wrong ISSUE and PR in the first post version. Fixed now.

I'm running renovate using full image (binarySource=global) and the bundler authentication for hostnames containing hyphen ("-") is not working,
After looking at the code and the logs, I realized there is one problem with preCommands exec for binarySource=global and one improvement that could be made to remove a bundler workaround for hostnames with an hyphen, I'll detail both here:

1. Bundler hyphen workaround:
   I found this issue and a PR, but there is actually a better fix for that problem: Bundler accepts replacing the hyphen "-" by three underscores "___" when using environment vars for authentication. For instance, you can set the credendials for "gems-private.com" by using the env var "BUNDLE_GEMS___PRIVATE__COM".
   My proposal is to revert feat(bundler): add config command for hyphen hosts #9821 and change this function to also replace "-" by "___".

2. preCommands not being executed when binarySource=global
   The bundler workaround mentioned on item 1 uses the "preCommands" array within the "ExecOptions" to execute the authentication bundler command, but when looking at the "prepareRawExec" function, it doesn't inclue the "preCommands" array to the "rawCommands" return if no "if" statement matches (binarySource=global)

Logs (if relevant)

Logs

Note: I've replaced some company information, but kept all relevant info using a similar format, e.g: repo-hyphen.com and the bundle suggested env var "BUNDLE_REPO___HYPHEN__COM"

DEBUG: bundler.updateArtifacts(Gemfile) (repository=org/repo, branch=renovate-bump/xxxx-6.x)
DEBUG: Lockfile for Gemfile found in Gemfile.lock (repository=org/repo, branch=renovate-bump/xxxx-6.x)
DEBUG: Using bundler version specified in lockfile (repository=org/repo, branch=renovate-bump/xxxx-6.x)
DEBUG: Lockfile for Gemfile found in Gemfile.lock (repository=org/repo, branch=renovate-bump/xxxx-6.x)
DEBUG: Executing command (repository=org/repo, branch=renovate-bump/xxxx-6.x)
       "command": "bundler lock --patch --strict --update xxxx"                                      <--- HERE WE SHOULD HAVE THE preCommands FIRST
DEBUG: rawExec err (repository=org/repo, branch=renovate-bump/xxxx-6.x)
       "err": {
         "cmd": "/bin/sh -c bundler lock --patch --strict --update xxxx",
         "stderr": "Authentication is required for repo-hyphen.com.\nPlease supply credentials for this source. You can do this by running:\n`bundle config set --global repo-hyphen.com username:password`\nor by storing the credentials in the `BUNDLE_REPO___HYPHEN__COM`\nenvironment variable\n",
         "stdout": "Writing lockfile to /tmp/renovate/repos/github/org/repo/Gemfile.lock\n",
         "options": {
           "cwd": "/tmp/renovate/repos/github/org/repo",
           "encoding": "utf-8",
           "env": {
             "GEM_HOME": "/tmp/renovate/cache/others/bundler",
             "HOME": "/home/ubuntu",
             "PATH": "/home/ubuntu/.local/bin:/home/ubuntu/bin:/home/ubuntu/.local/bin:/home/ubuntu/bin:/home/ubuntu/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
             "LC_ALL": "C.UTF-8",
             "LANG": "C.UTF-8",
             "SSL_CERT_FILE": "/tmp/renovate-ca.crt"
           },
           "maxBuffer": 10485760,
           "timeout": 900000
         },
         "exitCode": 17,
         "name": "ExecError",
         "message": "Command failed: bundler lock --patch --strict --update xxxx\nAuthentication is required for repo-hyphen.com.\nPlease supply credentials for this source. You can do this by running:\n`bundle config set --global repo-hyphen.com username:password`\nor by storing the credentials in the `BUNDLE_REPO___HYPHEN__COM`\nenvironment variable\n",
         "stack": "ExecError: Command failed: bundler lock --patch --strict --update xxxx\nAuthentication is required for repo-hyphen.com.\nPlease supply credentials for this source. You can do this by running:\n`bundle config set --global repo-hyphen.com username:password`\nor by storing the credentials in the `BUNDLE_REPO___HYPHEN__COM`\nenvironment variable\n\n    at ChildProcess.<anonymous> (/usr/local/renovate/lib/util/exec/common.ts:101:11)\n    at ChildProcess.emit (node:events:530:35)\n    at ChildProcess.emit (node:domain:489:12)\n    at Process.ChildProcess._handle.onexit (node:internal/child_process:293:12)"
       },
       "durationMs": 500
DEBUG: Gemfile.lock update failed due to missing credentials - skipping branch (repository=org/repo, branch=renovate-bump/xxxx-6.x)
       "err": {
         "cmd": "/bin/sh -c bundler lock --patch --strict --update xxxx",
         "stderr": "Authentication is required for repo-hyphen.com.\nPlease supply credentials for this source. You can do this by running:\n`bundle config set --global repo-hyphen.com username:password`\nor by storing the credentials in the `BUNDLE_REPO___HYPHEN__COM`\nenvironment variable\n",
         "stdout": "Writing lockfile to /tmp/renovate/repos/github/org/repo/Gemfile.lock\n",
         "options": {
           "cwd": "/tmp/renovate/repos/github/org/repo",
           "encoding": "utf-8",
           "env": {
             "GEM_HOME": "/tmp/renovate/cache/others/bundler",
             "HOME": "/home/ubuntu",
             "PATH": "/home/ubuntu/.local/bin:/home/ubuntu/bin:/home/ubuntu/.local/bin:/home/ubuntu/bin:/home/ubuntu/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
             "LC_ALL": "C.UTF-8",
             "LANG": "C.UTF-8",
             "SSL_CERT_FILE": "/tmp/renovate-ca.crt"
           },
           "maxBuffer": 10485760,
           "timeout": 900000
         },
         "exitCode": 17,
         "name": "ExecError",
         "message": "Command failed: bundler lock --patch --strict --update xxxx\nAuthentication is required for repo-hyphen.com.\nPlease supply credentials for this source. You can do this by running:\n`bundle config set --global repo-hyphen.com username:password`\nor by storing the credentials in the `BUNDLE_REPO___HYPHEN__COM`\nenvironment variable\n",
         "stack": "ExecError: Command failed: bundler lock --patch --strict --update xxxx\nAuthentication is required for repo-hyphen.com.\nPlease supply credentials for this source. You can do this by running:\n`bundle config set --global repo-hyphen.com username:password`\nor by storing the credentials in the `BUNDLE_REPO___HYPHEN__COM`\nenvironment variable\n\n    at ChildProcess.<anonymous> (/usr/local/renovate/lib/util/exec/common.ts:101:11)\n    at ChildProcess.emit (node:events:530:35)\n    at ChildProcess.emit (node:domain:489:12)\n    at Process.ChildProcess._handle.onexit (node:internal/child_process:293:12)"
       }

[rarkins]

(1) Sounds good to me. FYI @Chumper were you aware of that?

[Chumper]

Sounds good to me, I was not aware at that time

[lbarros-asml]

What would be the next steps? May I create a PR myself? Should an issue be created for me to link a PR to it?
Also, what about the issue mentioned on item 2 @rarkins ? Do you recognize it? Should I also open another PR to fix it?

[rarkins]

Please go ahead with a PR for (1)

[lbarros-asml]

#33339