Announcement: Encrypted Secrets will be disabled in Mend-hosted Renovate Apps #33407
Replies: 3 comments 8 replies
-
|
Thanks for the post - we have a pipeline that automatically generated new encrypted credentials every day to use in our renovate config. Given we can't do this anymore.. is there an API we can use to save directly to mend.io instead? Or an alternative? |
Beta Was this translation helpful? Give feedback.
-
|
An API to allow uploading of secrets is in planning. We'll see if we can postpone the permanent disabling of the private key until this is done |
Beta Was this translation helpful? Give feedback.
-
|
We have postponed the permanent disabling of the private key until we have developed and released an API to upload secrets. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for this announcement. We tried to update our configuration after reading this section on GitHub packages only to later realise it's been classed as experimental (after stumbling on this discussion #29773). Are there any plans to support using the GitHub app token on the cloud hosted version of Renovate for Github-hosted packages? |
Beta Was this translation helpful? Give feedback.
-
|
GitHub (the company) does not support using app tokens for github packages. It's a limitation which has been known for years and there's no confirmation it will be fixed |
Beta Was this translation helpful? Give feedback.
-
|
More importantly, presets are only supported for repo-based presets and not packages |
Beta Was this translation helpful? Give feedback.
-
|
Ah sorry then, and thanks @rarkins! I thought GitHub started supporting this since the cloud-hosted app requested the "Read packages" permission 😅 Thanks for clarifying! |
Beta Was this translation helpful? Give feedback.
-
|
As far as I'm aware, this is the only "public" acknowledgement of this limitation, although there might be others: https://github.com/orgs/community/discussions/26920 |
Beta Was this translation helpful? Give feedback.
-
|
Hi, Is it possible to add organization’s secrets that is accessible in all repos in the organization? Am I missing permissions or do I misunderstand the feature? |
Beta Was this translation helpful? Give feedback.
-
|
Yes, Org secrets automatically become available to all repos in the Org. |
Beta Was this translation helpful? Give feedback.
-
|
To add Org secrets, navigate to the Org page (the page that lists all installed repositories) and open the "Settings" on that page. |
Beta Was this translation helpful? Give feedback.
-
Tell us more.
Summary
If you have encrypted secrets in your Renovate config, you must migrate the secrets to the Developer Portal UI, or Renovate will stop running on your repo when using Mend-hosted Renovate Apps. (Renovate App on GitHub.com, Mend App on Bitbucket and Azure Dev Ops)
Background
In July 2024 Mend announced that the ability to use encrypted secrets in Developer Platform is deprecated and will be eliminated by 1-Oct-2024.
After the original date passed, there were over 9,000 repos that were still using encrypted secrets. Because of this, it was decided to delay fully disabling encrypted secrets until more repos had removed the encrypted secrets.
Plan Details
Brown-out Plan
Step 1: Remove private key for 48 hours
On Tuesday, 7 Jan 2025 at around 9am CET, the private key required for decrypting secrets will be removed from the Developer Platform backend (Renovate Cloud).
Renovate jobs that run after this time will fail if the renovate config file (eg. renovate.json) contains encrypted secrets. An issue will be created in the failing repo with subject “
Action Required: Configuration Error” and will indicate that the Renovate job failed because the encrypted secret was invalid.It is hoped that repo users with encrypted secrets will notice this issue and migrate their encrypted secrets from the Renovate config file to the Developer Portal.
Monitoring and Rollback
The Renovate team will monitor jobs, messages and the Renovate GitHub website for indications of widespread mayhem. If it appears that the brown-out is causing too much hardship, the team will immediately restore the private key to Developer Platform.
Step 2: Restore private key
48 hours later, the private key will be restored to the Developer Platform backend, allowing jobs with encrypted secrets to run successfully. The Action Required issue created the day before will be auto-closed.
Fully Disabling Encrypted Secrets
Provided there was no unforeseen mayhem, the Renovate team will remove the private key from Developer Platform on Tuesday, 14 Jan 2025.
This removal is expected to be final. From that point on, repos with encrypted secrets in the Renovate config file will continue to fail.
Update: We will delay the permanent disabling of encrypted secrets until we have released an API that allows for secrets to be uploaded.
Beta Was this translation helpful? Give feedback.
All reactions