Renovate exits because of "Bad credentials" response from Github API

[papermana]

How are you running Renovate?

Mend Renovate hosted app on github.com

If you're self-hosting Renovate, tell us what version of Renovate you run.

No response

If you're self-hosting Renovate, select which platform you are using.

None

Was this something which used to work for you, and then stopped?

It used to work, and then stopped

Describe the problem

Every time Renovate runs, it crashes when trying to make a GET request to https://api.github.com/repos/renovatebot/osv-offline/releases. On the developer.mend.io dashboard, it shows runs happening many times a day, sometimes multiple times an hour, which fail every time. Until roughly a week ago (seemingly coinciding with this PR being merged), we were getting a lot of "API rate limit exceeded" errors, but Renovate would pass from time to time.

There was a short discussion about this on another "Discussion" page. Link for reference.

Minimal reproduction: https://github.com/cosuno/renovate-reproduction. This repo contains a setup somewhat similar to our real setup, but only one has one dependency.

Relevant debug logs

Logs

DEBUG: Renovate exiting
INFO: Renovate is exiting with a non-zero code due to the following logged errors
{
  "loggerErrors": [
    {
      "name": "renovate",
      "level": 50,
      "logContext": "1Wfzpq8h2wzdfijQo5Lat",
      "repository": "cosuno/cosuno",
      "err": {
        "name": "HttpError",
        "status": 401,
        "response": {
          "url": "https://api.github.com/repos/renovatebot/osv-offline/releases",
          "status": 401,
          "headers": {
            "access-control-allow-origin": "*",
            "access-control-expose-headers": "ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset",
            "connection": "close",
            "content-length": "80",
            "content-security-policy": "default-src 'none'",
            "content-type": "application/json; charset=utf-8",
            "date": "Wed, 31 Jan 2024 09:53:16 GMT",
            "referrer-policy": "origin-when-cross-origin, strict-origin-when-cross-origin",
            "server": "GitHub.com",
            "strict-transport-security": "max-age=31536000; includeSubdomains; preload",
            "vary": "Accept-Encoding, Accept, X-Requested-With",
            "x-content-type-options": "nosniff",
            "x-frame-options": "deny",
            "x-github-media-type": "github.v3; format=json",
            "x-github-request-id": "BCB4:7168:21B1950:4487DCB:65BA188C",
            "x-ratelimit-limit": "60",
            "x-ratelimit-remaining": "0",
            "x-ratelimit-reset": "1706696556",
            "x-ratelimit-resource": "core",
            "x-ratelimit-used": "186",
            "x-xss-protection": "0"
          },
          "data": {
            "message": "Bad credentials",
            "documentation_url": "https://docs.github.com/rest"
          }
        },
        "request": {
          "method": "GET",
          "url": "https://api.github.com/repos/renovatebot/osv-offline/releases",
          "headers": {
            "accept": "application/vnd.github.v3+json",
            "user-agent": "octokit-rest.js/20.0.2 octokit-core.js/5.1.0 Node.js/18.19.0 (linux; x64)",
            "authorization": "***********"
          },
          "request": {
            "fetch": "[function]",
            "hook": "[function]"
          }
        },
        "message": "Bad credentials",
        "stack": "HttpError: Bad credentials\n    at /opt/containerbase/tools/renovate/37.153.2/node_modules/@octokit/request/dist-node/index.js:124:21\n    at processTicksAndRejections (node:internal/process/task_queues:95:5)\n    at tryDownloadDb (/opt/containerbase/tools/renovate/37.153.2/node_modules/@renovatebot/osv-offline/dist/lib/download.js:46:26)\n    at OsvOffline.initialize (/opt/containerbase/tools/renovate/37.153.2/node_modules/@renovatebot/osv-offline/dist/lib/osv-offline.js:14:24)\n    at Function.create (/opt/containerbase/tools/renovate/37.153.2/node_modules/@renovatebot/osv-offline/dist/lib/osv-offline.js:26:9)\n    at Vulnerabilities.initialize (/opt/containerbase/tools/renovate/37.153.2/node_modules/renovate/lib/workers/repository/process/vulnerabilities.ts:56:23)\n    at Function.create (/opt/containerbase/tools/renovate/37.153.2/node_modules/renovate/lib/workers/repository/process/vulnerabilities.ts:61:5)\n    at getDashboardMarkdownVulnerabilities (/opt/containerbase/tools/renovate/37.153.2/node_modules/renovate/lib/workers/repository/dependency-dashboard.ts:502:32)\n    at ensureDependencyDashboard (/opt/containerbase/tools/renovate/37.153.2/node_modules/renovate/lib/workers/repository/dependency-dashboard.ts:415:16)\n    at Object.renovateRepository (/opt/containerbase/tools/renovate/37.153.2/node_modules/renovate/lib/workers/repository/index.ts:92:9)\n    at attributes.repository (/opt/containerbase/tools/renovate/37.153.2/node_modules/renovate/lib/workers/global/index.ts:184:11)\n    at start (/opt/containerbase/tools/renovate/37.153.2/node_modules/renovate/lib/workers/global/index.ts:169:7)\n    at /opt/containerbase/tools/renovate/37.153.2/node_modules/renovate/lib/renovate.ts:18:22"
      },
      "msg": "Repository has unknown error"
    }
  ]
}

Have you created a minimal reproduction repository?

I have linked to a minimal reproduction in the description above

[rarkins]

It's not a crash - please correct

[papermana]

@rarkins Corrected.

[viceice]

can you please make the renovate.json as minimal as possible. there is a lot of unrelated stuff.

[MPV]

We're getting this too.

Though I'm not getting:

[...] Renovate would pass from time to time.

Rather, we're getting it 100% of (Mend's hosted) Renovate's attempts:

---

The only "workaround" so far has been to drop it from renovate.json like this:

-  "osvVulnerabilityAlerts": true,
-  "dependencyDashboardOSVVulnerabilitySummary": "all",

[papermana]

Though I'm not getting:

[...] Renovate would pass from time to time.

Rather, we're getting it 100% of (Mend's hosted) Renovate's attempts:

Us too, at this point. What I meant was that before this behavior started, we were dealing with another issue that was causing what appeared to be like 80–90% failure rate. Currently, the failure rate is 100% for us as well.

[viceice]

are the repos private or public?

[MPV]

Private in my case.

[viceice]

@rarkins I've an idea 💡 does the token still have the prefix? it probably needs to be removed like on platform and other code places.

[rarkins]

I've forgotten about that one. The x- one?

[viceice]

renovate/lib/modules/platform/github/index.ts

Line 142 in b9dee17

token = token.replace(/^ghs_/, 'x-access-token:ghs_');

yes. it's added explicit to the token in platform init. we need to get rid of it.

[viceice]

• fix(osv): trim github token prefix #27361

[papermana]

Thanks, this change seems to have solved the issue for me. 👍

[taraspos]

According to the last message, problem was identified right? Should this be converted into the issue then?