NuGet end-to-end updater needs to populate user-local `NuGet.Config` file

[brettfo]

Also add support for the replaces-base parameter.

[AndrewBabbitt97]

Would this potentially be why credentials for a private registry don't seem to be working?

Getting private_source_authentication_failure

[brettfo]

No, the end-to-end updater isn't currently in use.

If you're getting auth failures you need to have a NuGet.Config file in the root of your repo that lists the custom package feeds and those feeds will have to be repeated in your dependabot.yml file with the appropriate token or username/password supplied via secrets.

Otherwise at the very top of the log should be some messages from the proxy indicating that it's pre-authenticating your custom feeds.

[AndrewBabbitt97]

In confused, because that was never needed back in December. We used to be able to specify our feeds in dependabot.yml along with credentials and it would just work, now we just get errors.

Feels like a regression

[brettfo]

@AndrewBabbitt97 Do you have a full log as well as a dependabot.yml file you can share? This scenario should have continued to work, but there must be something unique about your setup.

[AndrewBabbitt97]

@brettfo Heres the yaml:

We have also tried to use token instead of username and password to no avail.

I'm pretty sure adding the main nuget feed was also required at one point of time but seems to be duplicated in the latest versions and now is in the list of registries twice when dependabot runs.

version: 2
updates:
  - package-ecosystem: "nuget"
    directory: "/"
    open-pull-requests-limit: 30
    schedule:
      interval: "daily"
    commit-message:
      prefix: build
    registries:
      - nuget
      - github-nuget

registries:
  nuget:
    type: nuget-feed
    url: https://api.nuget.org/v3/index.json
  github-nuget:
    type: nuget-feed
    url: https://nuget.pkg.github.com/recro/index.json
    username: USERNAME
    password: ${{ secrets.NUGET_PAT }}

The last time it worked was on Jan 16th with these logs:

dependabot-01-16-2025.txt

It stopped working on Jan 17th with private_source_authentication_failure in these logs:

dependabot-01-17-2025.txt

And for reference, here's a current log with the same configuration ran today:

dependabot-04-03-2025.txt

[AndrewBabbitt97]

Of note, it seems like it may have gotten worse and now get private_source_authentication_failure on packages that arent on our private registry like OpenTelemetry.Instrumentation.Runtime and MailKit seen in the latest log.

[brettfo]

@AndrewBabbitt97 Thank you for the logs, this is hugely informative.

Looking through the logs I think that your secret or token expired between the runs on 16 and 17 January.

The non-failing log from 16 January, line 5173 shows a request to the URL https://nuget.pkg.github.com:443/recro/aspire.azure.storage.blobs/index.json. This is NuGet asking that feed what information (if any) it has about that package. The next line in the log shows the proxy injecting authentication, then the next line after that shows a result of 404. This means the NuGet feed got your request, but doesn't have that particular package.

Now looking at the failing log from 17 January, line 5161 shows a request to the URL https://nuget.pkg.github.com:443/recro/telerik.core.export/index.json. While this URL is different from the one above, it's the same shape and asking the same thing: what information do you have about this package? The next line in the log shows the proxy injecting authentication, then on line 5163 it shows the 403.

I checked through my changes and didn't see anything I changed between those two dates that could account for this and I also checked the proxy (that repo is private, but I did check) and there also weren't changes around that time that would account for this.

Given that on one day (16 January) the private feed responded with a non-403 but the next day responded to essentially the same request with a 403 indicates an issue with token. The line about the proxy adding authentication means that there is a token that the proxy is tracking and injecting, but that the source rejected it on the second day.

[AndrewBabbitt97]

I looked deeper into this to try and figure out why, and finally found an organization setting had been changed for PAT tokens for expirations. So this is working again, however PAT tokens still aren't ideal.

Dependabot really should be able to have its token con figured to be able to fetch packages instead of having to rely on a classic PAT, #8411 (Support internal GitHub Packages without PAT) is still desperately needed.