Skip to content

Selfhosted Artifactory not considered for private maven dependencies

Hi,

I'm currently trying to setup dependabot, but I can't make it pick up the private repository to search for updates.

My last attempt was with the following config:

version: 2
registries:
  maven-artifactory:
    type: maven-repository
    url: https://artifactory.internal.net/artifactory/libs-release
    username: ${{ARTIFACTORY_USERNAME}}
    password: ${{ARTIFACTORY_PASSWORD}}
updates:
  - package-ecosystem: "maven"
    directory: "/"
    registries:
      - maven-artifactory

It seems to me that the defined maven-artifactory registry is just ignored as even if I put some random url in the url the outcome is the same as if I didn't define a repo at all. The only time I could make it fail was when I removed the protocol.

And from a test project, looks like the public public libraries can be updated and only the private ones fail:

...
[2022-04-04 12:58:42 +0000 tid=1agm] INFO  -- [mrb.ch/logging-webservice=>maven] Fetching configuration for mrb.ch/logging-webservice from master
[2022-04-04 12:58:42 +0000 tid=1agm] WARN  -- [mrb.ch/logging-webservice=>maven] Missing github_access_token. Dependency updates may fail if api rate limit is exceeded.
[2022-04-04 12:58:42 +0000 tid=1agm] INFO  -- [mrb.ch/logging-webservice=>maven] Fetching info for org.springframework.boot:spring-boot-starter-parent
[2022-04-04 12:58:43 +0000 tid=1agm] INFO  -- [mrb.ch/logging-webservice=>maven]   updating org.springframework.boot:spring-boot-starter-parent: 2.2.2.RELEASE => 2.6.6
[2022-04-04 12:58:46 +0000 tid=1agm] INFO  -- [mrb.ch/logging-webservice=>maven]  merge request https://gitlab.ch.internal.net/mrb.ch/logging-webservice/-/merge_requests/2 doesn't require updating <== Public library works
[2022-04-04 12:58:46 +0000 tid=1agm] INFO  -- [mrb.ch/logging-webservice=>maven] Fetching info for com.core-platform:core-platform
[2022-04-04 12:58:46 +0000 tid=1agm] WARN  -- [mrb.ch/logging-webservice=>maven]   update for 'com.core-platform:core-platform: 2.0.15' is impossible <== Private library doesn't work

Is there something wrong in the setup or could we increase the logging on why the update is impossible?

Edited by George Koltsov