Renovate: versions after 19.52.3 fail to connect to azure devops

[stocksr]

What Renovate type are you using?
I am using the docker version

Describe the bug
Running this command
docker run --rm renovate/renovate:19.52.3 --platform azure --endpoint https://{REDACTED}.visualstudio.com/ --token {REDACTED} "{REDACTED}/{REDACTED}"

logs this:

INFO: Using default gitAuthor: Renovate Bot [e-mail]
INFO: Renovating repository (repository={REDACTED}/{REDACTED})
INFO: Initialising git repository into /tmp/renovate/repos/azure/{REDACTED}/{REDACTED} (repository={REDACTED}/{REDACTED})
INFO: Platform error - skipping (repository={REDACTED}/{REDACTED})
INFO: Finished repository (repository={REDACTED}/{REDACTED})
INFO: Renovate finished

running with a version number of 19.52.2 works correctly

4540 is the change that was introduced in version 19.52.3

[rarkins]

@jycouet @JamieMagee I think we need to consider reverting #4540, unless we can quickly determine why this is happening or if it's an isolated case.

[JamieMagee]

Testing now...

[JamieMagee]

@rarkins This also fails for me. I vote for reverting.

I tried with 19.52.3 and 19.56.0, as well as *.visualstudio.com and dev.azure.com/* and all fail.

@jycouet Can you share what settings you used to get this to work on Azure DevOps SaaS?

[rarkins]

Thanks, I have reverted it in master just now. Let's keep this issue open to track efforts to re-implement

[jycouet]

Working very well on my side! Running every day with @latest tag.
Here is my config:

***/*** --platform azure --endpoint https://***.visualstudio.com/ --token ***

I'm not using the "docker version". Can you get more logs?

:(

[jycouet]

On my side I'm using windows machines. Can it have an effect?

[rarkins]

I guess that different implementations of git could potentially have an affect

[JamieMagee]

@jycouet Are you running via PowerShell? I've experienced in the past that it will authenticate you behind the scenes and allow you to do things like clone a repo via https:// without any auth prompt.

[jycouet]

I'm on windows.

Powershell, Windows Command Line, Git Bash for Cloud & On-Premise git clone https://:<PAT>@MYHOST/yourOrgName/yourProjectName/_git/yourRepoName => Working.

Powershell, Windows Command Line, Git Bash for Cloud git clone https://token:<PAT>@MYHOST/yourOrgName/yourProjectName/_git/yourRepoName => Working.

Powershell, Windows Command Line, Git Bash for On-Premise git clone https://token:<PAT>@MYHOST/yourOrgName/yourProjectName/_git/yourRepoName => Not Working!

[codepunkt]

More data for you:
On-premise Azure Devops Server 2019 Version Dev17.M153.3.

Linux, git version 2.17.1

• git clone https://token:<PAT>@MYHOST/collection/project/_git/repo fails
• git clone https://:<PAT>@MYHOST/collection/project/_git/repo fails
• git clone https://<PAT>@MYHOST/collection/project/_git/repo fails
• git clone https://<PAT>:<PAT>@MYHOST/collection/project/_git/repo fails

Windows, git version 2.19.2.windows.1

• git clone https://token:<PAT>@MYHOST/collection/project/_git/repo fails
• git clone https://:<PAT>@MYHOST/collection/project/_git/repo works
• git clone https://<PAT>@MYHOST/collection/project/_git/repo works
• git clone https://<PAT>:<PAT>@MYHOST/collection/project/_git/repo fails

Microsoft states that their documentation on this matter is wrong but they don't plan on updating it because they think it's a rarely used case:
https://github.com/MicrosoftDocs/vsts-docs/issues/2444#issuecomment-438837800

There's a lot more information about what others have tried here:
https://stackoverflow.com/questions/53106546/cannot-clone-git-from-azure-devops-using-pat

What works for me on both linux and windows (with the aforementioned git versions) is using http.extraheader like this:

• git -c http.extraheader="Authorization: Basic <BASE64>" clone https://MYHOST/collection/project/_git/repo where BASE64 is the base64 encoding of token:<PAT>

I'm not sure if this works for Azure DevOps Service. Can someone please test that out?

[JamieMagee]

@codepunkt Thanks for the detailed investigation. I haven't checked for myself, but I do know that Azure Pipelines uses the http.extraheader method to checkout at the start of every build. Here's an excerpt from a PR I did recently:

git -c http.extraheader="AUTHORIZATION: bearer ***" fetch --force --tags --prune --progress --no-recurse-submodules origin +refs/heads/*:refs/remotes/origin/* +refs/pull/53915/merge:refs/remotes/pull/53915/merge

[rarkins]

What's the next step here? Should this issue be closed and another opened to support self-hosted azure devops?

[JamieMagee]

@rarkins Yes, Renovate works against Azure DevOps now so this issue is closed. However there appears to be some work to do around the on premises version. At the very least clarifying what the issue is more.

[nishants]

git clone https://<PAT>@MYHOST/collection/project/_git/repo works does not seem to work for self-hosted Azure Devops Server.

Though git clone https://<user:passoword>@MYHOST/collection/project/_git/repo works did work.

Like bitbucket allowing user/password configuration for self-hosted Azure DevOps Server should work.

[viceice]

@nishants please open a new issue here and fill the template. Azure DevOps Server should generally work