Handle private Composer packages

[mremi]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

GitLab, docker image ghcr.io/renovatebot/renovate:39, Renovate 39.262.0

Please tell us more about your question or problem

Hi,

I have a PHP project with public packages hosted on Packagist (here symfony/console), and private Composer packages hosted on a self-hosted GitLab, without Packagist server (here foo/bar).
Basically, my composer.json looks like:

{
    "name": "my/app",
    "require": {
        "symfony/console": "^7.2",
        "foo/bar": "^3.1"
    },
    "repositories": [
        {
            "type": "vcs",
            "url": "https://self-hosted.gitlab.com/foo/bar.git"
        }
    ]
}

In order to handle foo/bar, I tried to configure Renovate with the environment variable RENOVATE_HOST_RULES:

[{"matchHost": "self-hosted.gitlab.com", "token": "$CI_JOB_TOKEN", "hostType": "git-tags"}]

But Renovate still lookups to Packagist for this library.

Could you please help me to make it works with both public and private packages?

Thanks

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks

[github-actions[bot]]

Hi there,

Please locate the debug message packageFiles with updates in your logs and paste the contents here. Depending on your question, we may need the full list of packages or only one.

If you self-host Renovate: make sure you run Renovate with LOG_LEVEL=debug to get the debug log messages! Next, open the debug-level logs and search for packageFiles with updates. This text marks the start of a structured log message that shows every package file, dependency, and update that Renovate found.

Find the relevant dependency/dependencies in the log message, and copy/paste those parts into this discussion. If you do not know which bits we need, you can copy/paste the full log message.

Read the Renovate docs, Troubleshooting to learn more about getting the docs, and getting the correct type of logs.

Thanks, the Renovate team

[mremi]

Hi,

Here the log message:

DEBUG: packageFiles with updates (repository=mremi/renovate-test, baseBranch=main)
       "config": {
         "composer": [
           {
             "deps": [
               {
                 "depType": "require",
                 "depName": "symfony/console",
                 "currentValue": "^7.2",
                 "lockedVersion": "7.2.1",
                 "datasource": "packagist",
                 "updates": [
                   {
                     "bucket": "non-major",
                     "newVersion": "7.2.5",
                     "newValue": "^7.2",
                     "releaseTimestamp": "2025-03-12T08:11:12.000Z",
                     "newVersionAgeInDays": 47,
                     "newMajor": 7,
                     "newMinor": 2,
                     "newPatch": 5,
                     "updateType": "patch",
                     "isRange": true,
                     "isLockfileUpdate": true,
                     "libYears": 0.24981310[248](https://self-hosted.gitlab.com/mremi/renovate/-/jobs/6739872#L248)604768,
                     "branchName": "renovate/symfony-console-7.x-lockfile"
                   }
                 ],
                 "packageName": "symfony/console",
                 "versioning": "composer",
                 "warnings": [],
                 "sourceUrl": "https://github.com/symfony/console",
                 "registryUrl": "https://repo.packagist.org",
                 "homepage": "https://symfony.com",
                 "currentVersion": "7.2.1",
                 "currentVersionTimestamp": "2024-12-11T03:49:26.000Z",
                 "currentVersionAgeInDays": 139,
                 "isSingleVersion": true,
                 "fixedVersion": "7.2.1"
               },
               {
                 "depType": "require",
                 "depName": "foo/bar",
                 "currentValue": "^3.1",
                 "lockedVersion": "3.1.0",
                 "datasource": "packagist",
                 "updates": [],
                 "packageName": "foo/bar",
                 "versioning": "composer",
                 "warnings": [
                   {
                     "topic": "foo/bar",
                     "message": "Failed to look up packagist package foo/bar"
                   }
                 ]
               }
             ],
             "lockFiles": ["composer.lock"],
             "packageFile": "composer.json"
           }
         ]
       }

Thanks

[rarkins]

It looks like the repositories you have in composer.json aren't being parsed/detected properly. Please create a valid reproduction with a dummy repository host so we can debug it.

[mremi]

Hi,

I finally found that Renovate expects the package name for each private package in composer.json, so in my example:

{
    "name": "my/app",
    "require": {
        "symfony/console": "^7.2",
        "foo/bar": "^3.1"
    },
    "repositories": [
        {
            "name": "foo/bar",
            "type": "vcs",
            "url": "https://self-hosted.gitlab.com/foo/bar.git"
        }
    ]
}

[github-actions[bot]]

Hi there,

Please help this Discussion progress by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues.

Please follow these steps:

1. Read our guide on creating a minimal reproduction.
2. Go to our minimal reproduction template repository.
3. Select the Use this template button to create a new repository based on the template.
4. Work on the minimal reproduction in your own repository.
5. Fill out the information in your repository's README.md.
6. Add the link to your reproduction to the first post of your Discussion. If you are not the original author, you can post a new comment with the link.

If you need help with running Renovate on your minimal reproduction repository, please refer to our Running Renovate guide.
Good luck,

The Renovate team