Dependency lookup blocked by IP safelisting for bridgecrewio/checkov-action
#17826
Replies: 5 comments 27 replies
-
|
This isn't a renovate bug. It's a github restriction and renovate can't skip this. Also renovate app worker don't have fixed IP's (they will wandomly changed on worker updates), so they can't be whitelisted in any way. |
Beta Was this translation helpful? Give feedback.
-
|
Bridgecrew are going to need to remove this restriction or separate their open source/ closed source into different orgs |
Beta Was this translation helpful? Give feedback.
-
|
Unauthenticated requests for the public resources (in this case tags) for the repository are definitely not affected by this. Is there any way we could disable auth completely for requests to this repository? I checked the |
Beta Was this translation helpful? Give feedback.
-
|
Renovate uses GraphQL to fetch tags and release so it must be authenticated to succeed |
Beta Was this translation helpful? Give feedback.
-
|
Quick reproduction script in Python. You need Change the config in the Script#!/usr/bin/env python3
import jwt
import requests
import time
import json
class graphQL:
# Authorization is set in __init__
headers = {}
def __init__(self, token):
super(graphQL, self).__init__()
self.headers["Authorization"] = f"token {token}"
def run_query(self, query, variables): # A simple function to use requests.post to make the API call. Note the json= section.
request = requests.post('https://api.github.com/graphql', json={'query': query, 'variables': variables}, headers=self.headers)
if request.status_code == 200:
return request.json()
else:
raise Exception("Query failed to run by returning code of {}. Message {}".format(request.status_code, request.text))
def getTags(self, variables):
listOfNames = []
query = '''
query($owner: String!, $name: String!, $cursor: String, $count: Int!) {
repository(owner: $owner, name: $name) {
isRepoPrivate: isPrivate
payload:
refs(
first: $count
after: $cursor
orderBy: {field: TAG_COMMIT_DATE, direction: DESC}
refPrefix: \"refs/tags/\"
) {
pageInfo {
hasNextPage
endCursor
}
nodes {
version: name
target {
type: __typename
... on Commit {
oid
releaseTimestamp: committedDate
}
... on Tag {
target {
... on Commit {
oid
}
}
tagger {
releaseTimestamp: date
}
}
}
}
}
}
}
'''
result = self.run_query(query, variables) #execute query
print(json.dumps(result))
def get_jwt(pem, app_id):
# Open PEM
with open(pem, 'rb') as pem_file:
signing_key = jwt.jwk_from_pem(pem_file.read())
payload = {
# Issued at time
'iat': int(time.time()),
# JWT expiration time (10 minutes maximum)
'exp': int(time.time()) + 600,
# GitHub App's identifier
'iss': app_id
}
# Create JWT
jwt_instance = jwt.JWT()
encoded_jwt = jwt_instance.encode(payload, signing_key, alg='RS256')
return encoded_jwt
########################################
# Set config in the following block
########################################
pem = "key.pem" # Path to the private key of the app
app_id = 123456 # ID of your app
installation_id = 123456 # ID of your app installation
variables = {
"owner": "bridgecrewio",
"name": "checkov-action",
"count": 5,
}
########################################
jwt = get_jwt(pem, app_id)
request = requests.post(f"https://api.github.com/app/installations/{installation_id}/access_tokens", headers={
"Accept": "application/vnd.github+json",
"Authorization": f"Bearer {jwt}",
"X-GitHub-Api-Version": "2022-11-28"
})
token = ""
if request.status_code == 201:
token = request.json()["token"]
else:
raise Exception("Query failed to run by returning code of {}. Message {}".format(request.status_code, request.text))
query = graphQL(token)
query.getTags(variables) |
Beta Was this translation helpful? Give feedback.
-
|
@morremeyer were you able to get a solution from Github? |
Beta Was this translation helpful? Give feedback.
-
|
Still talking to them, the issue is known to the responsible engineering team. No solution or ETA for one yet. |
Beta Was this translation helpful? Give feedback.
-
|
While I still have an open issue with the GitHub support (see #17826 (reply in thread)), I've been annoyed enough to look for a workaround. I found one: Using a host rule that uses a PAT (since these are not affected by this bug) |
Beta Was this translation helpful? Give feedback.
-
|
Does anyone know if GitHub resolved this problem on their own? This repo seems to work and we haven't turned on fixed IPs in the app yet: nabeelsaabnaTests/pdmp-static-ip-test#3 |
Beta Was this translation helpful? Give feedback.
-
|
They did not resolve the problem. It works for the repo you mentioned because that's a personal repo. The combination that is broken is "org repo" + "GitHub app" |
Beta Was this translation helpful? Give feedback.
-
|
Thanks! So any org repo fails, any personal repo succeeds? |
Beta Was this translation helpful? Give feedback.
-
|
Yup, that’s the current state of my understanding. If we find any where this differs, it might help the GitHub engineers to debug this issues, but it also seems to be very low on their priority list. |
Beta Was this translation helpful? Give feedback.
-
|
As of today, it seems that the problem is still not solved. We encountered odd behavior of Renovate opening and auto-closing updates for |
Beta Was this translation helpful? Give feedback.
-
|
Yup, I'm still poking the GitHub support every now and then, this is just very low on their priority list. |
Beta Was this translation helpful? Give feedback.
-
How are you running Renovate?
Mend Renovate hosted app on github.com
If you're self-hosting Renovate, tell us what version of Renovate you run.
No response
If you're self-hosting Renovate, select which platform you are using.
No response
If you're self-hosting Renovate, tell us what version of the platform you run.
No response
Was this something which used to work for you, and then stopped?
It used to work, and then stopped
Describe the bug
We're getting a dependency lookup failure for the
bridgecrewio/checkov-actionGitHub Action that used to work. From what we can see, IP safelisting is causing the problem and blocking the Renovate lookup:The full log output can be seen in this job log:
github/cds-snc/scan-files/814142718I'm assuming all we can do is add this dependency to our
ignoreDepsconfig if we don't want to see the warning on PRs and in our dependency dashboard.Relevant debug logs
Logs
Have you created a minimal reproduction repository?
I have linked to a minimal reproduction repository in the bug description
Beta Was this translation helpful? Give feedback.
All reactions