Raise config warning issue when lookups fail

[rarkins]

It's possible that some or all of a repository's private module lookups fail - and are hence not updated - but the users of that repository are unaware. For example this may be occurring now for many after npm reset everyone's tokens.

Idea: raise a config warning issue listing all failed lookups.

The only way to stop this issue coming back - apart from fixing authentication details - would be to add the packages to ignore using ignoreDeps or package rules.

[rarkins]

Problem: how to fix “false positive” results, eg registry temporarily returning incorrect responses.

[kayoub5]

@rarkins should an issue be created for every failure, or use one central issue to report all found problems?

[rarkins]

I think I need more time to think about this one. Right now we treat npmjs and docker hub specially where I’d we detect a failure with their end (5xx errors, etc) then we abort the entire run so as not to end up with flip/flopping PRs. But for private registries it’s hard to know what to do. Right now we ignore if they fail and most users seem fine with this. Ideally though we could be more “deliberate” about handling failures such as letting users configure which registries are critical and which not.

[kayoub5]

We could warn about successive failures, like checking this package failed 4 times in a row, and it used to be passing.

[rarkins]

Can you think of a way to do that using Renovate’s typically “stateless” approach?

[kayoub5]

check PR history, for any PR of that package.

[rarkins]

I would prefer a more deterministic approach.

The strict approach is:

• Abort renovations if registries have internal errors
• Raise a config issue and block renovations for lookup failures, if we think they're not registry internal errors

In theory we could/should allow users to turn this off via config though.

[rarkins]

I'm thinking:

• A single issue that is opened/closed/reopened when lookups fail. This reduces the impact of false positives as we don't continue creating issues all the time. If it's problematic (e.g. too much history loss) then we can consider an option of separate issues later
• Default all dependencies to cause this. Users can ignore dependencies and/or set a config option to ignore failures from certain hosts, using hostRules

[rarkins]

Warnings are displayed in the dependency dashboard now