Configure Mend for Azure Repos to resolve your private dependencies

matchHost

String

Required. The URL of the private registry where the private dependencies are hosted. Here are a few examples:

• Azure Artifacts:

• JFrog Artifactory:

• GitHub Packages:

hostType

String

Required. The type of private registry. Supported values:

• npm (for both NPM and Yarn projects)

• maven (for both Maven and Gradle projects)

• pypi (for Pip and Pipenv)

• go

• nuget

• ruby

• sbt

Note: When using Renovate with a Ruby private registry, add a hostRules block with hostType=rubygems within the remediateSettings block.

userName

String

Optional. The value used when the private registry requires a username credential for resolution access to its private dependencies.

encrypted.password

String

Required. The value used when the private registry requires a password credential for resolution access to its private dependencies. The value first needs to be encrypted into a secret on this page.

This encrypted secret will be applied as a credential to the set in the matchHost block and must be included inside the encrypted parameter:

      "encrypted": {
        "password": "3f832f2983yf89hsd98ahadsjfasdfjaslf............"
      }

encrypted.token

String

Required. The value used when the private registry requires a token credential for resolution access to its private dependencies. The value first needs to be encrypted into a secret on this page.

This encrypted secret will be applied as a credential to the set in the matchHost block and must be included inside the encrypted parameter:

      "encrypted": {
        "token": "3f832f2983yf89hsd98ahadsjfasdfjaslf............"
      }

envVariablesMapping

Object

Use this parameter if you used environmental variables in the settings of your package manager to include username and password/token (e.g. for a specified package index). envVariablesMapping takes a value as an object with two literals: userName and password / token.
For example, if you have:

[[source]]
url = "https://${USER_PRIVATE_REPO}:{PASS_PRIVATE_REPO}:@pypi/PACKAGE_NAME/simple"
verify_ssl = true
name = "IndexName"

or

  {
    url 'https://private.jfrog.io/artifactory/dependencies'
    credentials {
      username System.getenv("USER_PRIVATE_REPO") ?: "${USER_PRIVATE_REPO}"
      password System.getenv("PASS_PRIVATE_REPO") ?: "${PASS_PRIVATE_REPO}"
    }
}

Then, set envVariablesMapping to:

"envVariablesMapping": {"userName": "USER_PRIVATE_REPO" ,"password":"PASS_PRIVATE_REPO"}

sourceName

String

Only for Pipenv private registries. Optional. Use this parameter if you don’t have a specified package index. In this case, Mend will create one for you based on other parameters of hostRules. The value of sourceName should be the index name used for your private dependencies.

For example, if you have packages with the following index:

[packages]
<package_name> = { version = "*", index = "IndexName" }

Then, set sourceName to:

"sourceName": "IndexName"

C#

NuGet

Configuration file(s): nuget.config

• If the nuget.config preexists, it is appended with the hostRulesprovided.

• If the nuget.config does not exist, it is temporarily created with the hostRules provided for scanning purposes.

Go

Modules

Configuration file(s): .netrc

• If the .netrc preexists, it is appended with the hostRulesprovided.

• If the .netrc does not exist, it is temporarily created with the hostRules provided for scanning purposes.

Specifications:

• Only HTTPS is available for matchHost, HTTP is not supported.

• If the private registry is hosted on GitHub, only token can be used in the encrypted parameter (password is not supported).

Java

Gradle

Configuration file(s): build.gradle, settings.gradle

• If the build.gradle or settings.gradle preexists, it is appended with the hostRulesprovided.

• If the build.gradle or settings.gradle does not exist, it is temporarily created with the hostRules provided for scanning purposes.

Specifications:

• We also support the Kotlin format (KTS) of the Gradle configuration files.

• The buildscript or pluginManagement blocks need to be at the beginning of the build.gradle or settings.gradle, respectively.

• The matchHost parameter should contain the full path to the private registries, not just the domain.

• Use the envVariablesMapping parameter if you used environmental variables in your Gradle settings to include the username and password/token.

Java

Maven

Configuration file(s): settings.xml

• If the settings.xml preexists, it is appended with the hostRulesprovided.

• If the settings.xml does not exist, it is temporarily created with the hostRules provided for scanning purposes.

JavaScript

NPM

Configuration file(s): .npmrc

• If the .npmrc preexists, it is appended with the hostRulesprovided.

• If the .npmrc does not exist, it is temporarily created with the hostRules provided for scanning purposes.

Specifications:

• If .npmrc is missing and only one host is used in the project, it should be connected to the official public registry: http://npmjs.com. Otherwise, only private dependencies will be scanned and all public dependencies of this registry will be omitted.

• If several hosts are used in the project, it is required that .npmrc file preexists in the project and contains information about these hosts.

JavaScript

Yarn

Configuration file(s): .npmrc (Yarn 1), .yarnrc (Yarn 2, 3)

• If the .npmrc or .yarnrc preexists, it is appended with the hostRulesprovided.

• If the .npmrc or .yarnrc does not exist, it is temporarily created with the hostRules provided for scanning purposes.

Specifications:

• If .yarnrc is missing (or npmRegistryServer in it is not set) and only one host is used in the project - it will be set to the hostRules.matchHost from the config. In the same case, if several hosts are used, npmRegistryServer will be set to https://registry.yarnpkg.com.

Python

Pip

Specifications:

• Certain special characters are not valid in the credential part of a URL. If the user or password part of the login credentials contains any of these special characters, then they must be percent-encoded.

Python

Pipenv

Specifications:

• Use the envVariablesMapping parameter if you used environmental variables in your Pipenv settings to include the username and password/token.

• Use the sourceName parameter if you don't have a specified package index.

Ruby

Bundler

N/A

Scala

SBT

N/A