Self-Hosted Renovate logging "Failed to look up github-releases package containerbase/python-prebuild" on a python poetry project (GitHub failure: Bad credentials)

[Bassadin]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us what version of Renovate you run.

37.214.0 (docker)

If you're self-hosting Renovate, select which platform you are using.

GitLab self-hosted

Was this something which used to work for you, and then stopped?

I have not seen this working

Describe the problem

We used to have renovate configured to only crawl Node.js/npm projects but we recently wanted to expand package checking to some poetry-based python projects. However, when renovate tries to crawl/check that repo, the following error messages pasted in the Relevant Debug Logs occur.

I found this thread and tried to change binarySource to "global" but that didn't work.

We "self-host" renovate in the sense that we just run the docker container in our GitLab-Pipeline (as image: ghcr.io/renovatebot/renovate:37.214.0).

Is this a GitHub rate limit issue or something of that sort? I'm unsure.
I can provide more info about our pipeline file or config.js is necessary :)

Thanks for making such a great piece of software!

Relevant debug logs

Logs

DEBUG: GitHub failure: Bad credentials (repository=xxx/libraries/utility, branch=renovate/python-dotenv-0.x)
       "token": "***********",
       "err": {
         "name": "HTTPError",
         "code": "ERR_NON_2XX_3XX_RESPONSE",
         "timings": {
           "start": 1708949543908,
           "socket": 1708949543908,
           "lookup": 1708949543909,
           "connect": 1708949543927,
           "secureConnect": 1708949543950,
           "upload": 1708949543950,
           "response": 1708949544076,
           "end": 1708949544076,
           "phases": {
             "wait": 0,
             "dns": 1,
             "tcp": 18,
             "tls": 23,
             "request": 0,
             "firstByte": 126,
             "download": 0,
             "total": 168
           }
         },
         "message": "Response code 401 (Unauthorized)",
         "stack": "HTTPError: Response code 401 (Unauthorized)\n    at Request.<anonymous> (/usr/local/renovate/node_modules/.pnpm/got@11.8.6/node_modules/got/dist/source/as-promise/index.js:118:42)\n    at processTicksAndRejections (node:internal/process/task_queues:95:5)",
         "options": {
           "headers": {
             "user-agent": "RenovateBot/37.214.0 (https://github.com/renovatebot/renovate)",
             "accept": "application/json, application/vnd.github.v3+json",
             "authorization": "***********",
             "content-type": "application/json",
             "content-length": "649",
             "accept-encoding": "gzip, deflate, br"
           },
           "url": "https://api.github.com/graphql",
           "hostType": "github-changelog",
           "username": "",
           "password": "",
           "method": "POST",
           "http2": false
         },
         "response": {
           "statusCode": 401,
           "statusMessage": "Unauthorized",
           "body": {
             "message": "Bad credentials",
             "documentation_url": "https://docs.github.com/graphql"
           },
           "headers": {
             "server": "GitHub.com",
             "date": "Mon, 26 Feb 2024 12:12:24 GMT",
             "content-type": "application/json; charset=utf-8",
             "content-length": "83",
             "x-github-media-type": "github.v4",
             "x-ratelimit-limit": "0",
             "x-ratelimit-remaining": "0",
             "x-ratelimit-reset": "1708953144",
             "x-ratelimit-used": "0",
             "x-ratelimit-resource": "graphql",
             "access-control-expose-headers": "ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset",
             "access-control-allow-origin": "*",
             "strict-transport-security": "max-age=31536000; includeSubdomains; preload",
             "x-frame-options": "deny",
             "x-content-type-options": "nosniff",
             "x-xss-protection": "0",
             "referrer-policy": "origin-when-cross-origin, strict-origin-when-cross-origin",
             "content-security-policy": "default-src 'none'",
             "vary": "Accept-Encoding, Accept, X-Requested-With",
             "x-github-request-id": "880A:1484C1:1262F92:128FEB9:65DC8027",
             "connection": "close"
           },
           "httpVersion": "1.1",
           "retryCount": 0
         }
       }

DEBUG: getReleaseList error (repository=theskumar/python-dotenv, branch=renovate/python-dotenv-0.x)
       "type": "github",
       "apiBaseUrl": "https://api.github.com/",
       "err": {
         "message": "bad-credentials",
         "stack": "Error: bad-credentials\n    at handleGotError (/usr/local/renovate/lib/util/http/github.ts:131:12)\n    at GithubHttp.request (/usr/local/renovate/lib/util/http/github.ts:372:13)\n    at processTicksAndRejections (node:internal/process/task_queues:95:5)\n    at GithubHttp.requestJson (/usr/local/renovate/lib/util/http/index.ts:352:17)\n    at GithubGraphqlDatasourceFetcher.doRawQuery (/usr/local/renovate/lib/util/github/graphql/datasource-fetcher.ts:123:17)\n    at GithubGraphqlDatasourceFetcher.doShrinkableQuery (/usr/local/renovate/lib/util/github/graphql/datasource-fetcher.ts:199:20)\n    at GithubGraphqlDatasourceFetcher.doPaginatedFetch (/usr/local/renovate/lib/util/github/graphql/datasource-fetcher.ts:243:27)\n    at GithubGraphqlDatasourceFetcher.doCachedQuery (/usr/local/renovate/lib/util/github/graphql/datasource-fetcher.ts:283:7)\n    at GithubGraphqlDatasourceFetcher.getItems (/usr/local/renovate/lib/util/github/graphql/datasource-fetcher.ts:321:17)\n    at Function.query (/usr/local/renovate/lib/util/github/graphql/datasource-fetcher.ts:59:19)\n    at queryReleases (/usr/local/renovate/lib/util/github/graphql/index.ts:27:15)\n    at Object.getReleaseList (/usr/local/renovate/lib/workers/repository/update/pr/changelog/github/index.ts:97:20)\n    at getReleaseList (/usr/local/renovate/lib/workers/repository/update/pr/changelog/release-notes.ts:44:16)\n    at getReleaseNotes (/usr/local/renovate/lib/workers/repository/update/pr/changelog/release-notes.ts:139:20)\n    at addReleaseNotes (/usr/local/renovate/lib/workers/repository/update/pr/changelog/release-notes.ts:439:22)\n    at GitHubChangeLogSource.getChangeLogJSON (/usr/local/renovate/lib/workers/repository/update/pr/changelog/source.ts:180:11)\n    at getChangeLogJSON (/usr/local/renovate/lib/workers/repository/update/pr/changelog/index.ts:50:12)\n    at embedChangelog (/usr/local/renovate/lib/workers/repository/changelog/index.ts:12:21)\n    at /usr/local/renovate/node_modules/.pnpm/p-map@4.0.0/node_modules/p-map/index.js:57:22"
       }
 WARN: Package lookup failures (repository=xxx/libraries/utility, branch=renovate/python-dotenv-0.x)
       "warnings": ["Failed to look up github-releases package containerbase/python-prebuild"],
       "files": ["pyproject.toml"]

For other (npm) packages, GitHub lookup seems to (mostly) work just fine.

Have you created a minimal reproduction repository?

I have explained in the description why a minimal reproduction is impossible

[rarkins]

Use of the github.com API requires the provisioning of a github.com token. See https://docs.renovatebot.com/getting-started/running/#githubcom-token-for-changelogs

[Bassadin]

We had GITHUB_COM_TOKEN token set but actually, it seemed like it was a very old one (it had neither a prefix of ghp_ nor github_pat_). Thanks for your tip :)

[danijam]

@rarkins what scope does the token (PAT) need? Struggling to find info on this? Trying to give it just the minimum it needs.

[rarkins]

No scopes necessary for a classic PAT

[danijam]

Thanks!

[github-actions[bot]]

Hi there,

This is intended as a polite, automated request that users avoid @ mentioning repository maintainers like @rarkins or @viceice. Doing so causes annoying mobile notifications and makes it harder to maintain this repository.

We know it might be common elsewhere but we participate in hundreds of discussions a week and would need to turn off GitHub mobile notifications if we were mentioned in every one.

As a general rule, we will read and respond to all discussions in this repository, so there is no need to mention us.

Thanks, the Renovate team