GitLab Group Access Token Rotation

[seanparmelee]

What would you like help with?

I would like help with my configuration

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

GitLab, renovate-runner v17.196.0, renovate v37.327.2

Please tell us more about your question or problem

Hello,
We are self-hosting the GitLab renovate-runner and using a group access token. We recently rotated the group access token as the previous one about to expire and in doing so we noticed that a new dependency dashboard was created in each repo and any previous ignored/blocked MRs were reopened. I suspect this is due to

Each time you create a group access token, a bot user is created and added to the group

as mentioned in the gitlab docs, but I was curious if there's anything we can do to help smooth this out the next time we need to rotate the token? For example, is there a way to get the runner to detect that a dependency dashboard already exists (even though it was created by a previous renovate bot) and use that instead of creating a new one?

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[ryancausey]

I was looking for an answer to the same question. Is there some configuration value so that the Renovate bot recognizes the existing dependency dashboard issue and uses that instead?

I also saw behavior that appeared like it would ignore any previously closed MRs for a dependency, and re-open them. I assume this is because it only treats MRs the same user opened that were closed as ignored updates. Is this behavior also configurable such that it recognizes closed dependency MRs from other users?

[rarkins]

Renovate by default asks the server to filter issues and PRs by its own author/account for efficiency reasons. Some repos have 10s of 1000s which don't belong to the bot, and they'd need to be downloaded.

If you set ignorePrAuthor then the full list of MRs will be fetched. This is not currently supported for issues but could be. All this setting does is skip the &scope=created_by_me filter on the query

[ryancausey]

That makes a lot of sense. Too bad there isn't some other way to tag a PR or Issue with something renovate could use recognize the object as "its own". It would also have to be consistent across the APIs of the repo providers such as GitLab or GitHub.

[gaeljw]

Does ignorePrAuthor makes it fetch only open MR/issues though or all ever created? If it's only the open ones, it could be acceptable for me.

[haydenseitz]

Came here for the exact same reason. My org's group access token is expiring soon and when we tried rotating it, Dependency Dashboards were being opened as duplicate issues in our projects.

We have looked at setting gitAuthor, but from the information here, it seems that would not help if it's the bot user that is used to query the dependency issue and MRs

[rarkins]

Can Renovate determine that a GitLab token is a group access token by looking at its string? e.g. it always starts with group_ ?

We might want to add some intelligence to drop the author-based filtering of Issues and MRs if we find a group access token being used.

[ryancausey]

I believe "glpat" is supposed to stand for "GitLab Personal Access Token".

[ryancausey]

It does look like the bot's username includes the group id: @group_<group_id_here>_bot_bee9136e36db44e24de6e1ab1267b768

[ryancausey]

Here's the docs on the group bot username formats: https://docs.gitlab.com/ee/user/group/settings/group_access_tokens.html#bot-users-for-groups

[ryancausey]

Looks like there's a similar doc for project bots: https://docs.gitlab.com/ee/user/project/settings/project_access_tokens.html#bot-users-for-projects

[ryancausey]

So maybe it could somehow key off of the @group_<group id> or the @project_<project id> in the username?

[rarkins]

• fix(gitlab): filter issues for ignorePrAuthor #28996

[mschoettle]

I stumbled upon this yesterday when taking a look at new changes in Renovate. It so happened that today our group access token on GitLab for our Renovate Bot expired. I was worried about the issue described here.

I ended up rotating the token itself via GitLab's API (https://docs.gitlab.com/ee/api/group_access_tokens.html#rotate-a-group-access-token) which keeps the user that GitLab generated for this bot originally and creates a new access token for this user. I did a test run with Renovate using this new token and it was able to continue as before (updating existing MRs and the existing dependency dashboard issue).

[ryancausey]

This is a great find, thanks for sharing!

[haydenseitz]

This is great! It will be easier to keep the same bot user in the future, good find.

[rarkins]

Could someone contribute this find to our documentation for GitLab? The doc is here: https://github.com/renovatebot/renovate/blob/main/lib/modules/platform/gitlab/readme.md

[mschoettle]

Created a PR that adds this: #29136