containerbase/node-prebuild: No tool releases found.

[umbertooo]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

GitLab, Renovate Version 39.188.4

Please tell us more about your question or problem

Renovate is unable to perform lock file maintenance. Instead it fails with "No tool releases found." due to a "GitHub failure: rate limit".

The log mentions a tool "containerbase/node-prebuild"

       "toolConfig": {
         "datasource": "github-releases",
         "packageName": "containerbase/node-prebuild",
         "versioning": "node"
       }

expected bahaviour

I expected Renovate to respect the configured packageRule for "matchDatasources: 'github-releases'" and the configured registryUrl.

actual behaviour

The error stack looks like Renovate is not using my configuration in this case. Instead it performs POST https://api.github.com/graphql which fails with HTTPError: Response code 403 (rate limit exceeded).

My setup:

• a self hosted Renovate on a GitLab platform
• access public registries through jfrog artifactory. see the logs containing the config with packageRules + registryUrls
• see a demo repository here https://github.com/umbertooo/renovate-github-rate-limit-demo

Logs (if relevant)

Logs

DEBUG: Combined config
       "config": {
         "platform": "gitlab",
         "endpoint": "https://gitlab.example.com/api/v4/",
         "token": "***********",
         "gitAuthor": "*********",
         "maven": {"enabled": true},
         "hostRules": [
         ],
         "autodiscover": false,
         "onboarding": true,
         "forkProcessing": "auto",
         "branchPrefix": "renovate-",
         "labels": ["renovate"],
         "fetchChangeLogs": "off",
         "lockFileMaintenance": {"enabled": true, "schedule": ["at any time"]},
         "updateLockFiles": true,
         "prHourlyLimit": 0,
         "prConcurrentLimit": 0,
         "configMigration": true,
         "packageRules": [
           {
             "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
             "platformAutomerge": true,
             "automerge": true,
             "gitLabIgnoreApprovals": true,
             "matchPackageNames": ["!/yarn/", "!/\\/node$/"]
           },
           {"matchUpdateTypes": ["major"], "labels": ["renovate", "major"]},
           {
             "matchManagers": ["npm"],
             "registryUrls": [
               "https://my-custom-artifactory.example.com/artifactory/api/npm/default-npm-3rdparty/"
             ]
           },
           {
             "matchDatasources": ["github-releases"],
             "registryUrls": [
               "https://my-custom-artifactory.example.com/artifactory/api-github-generic-remote/"
             ]
           }
         ],
         "autodiscoverFilter": [],
         "repositories": [
           "renovate-github-rate-limit-demo"
         ],
         "baseBranches": ["main"],
         "useBaseBranchConfig": "merge"
       }
.
.
.
DEBUG: hostRules: no authentication for api.github.com (repository=/renovate-github-rate-limit-demo, baseBranch=main, branch=renovate-lock-file-maintenance)
DEBUG: Using queue: host=api.github.com, concurrency=16 (repository=/renovate-github-rate-limit-demo, baseBranch=main, branch=renovate-lock-file-maintenance)
DEBUG: POST https://api.github.com/graphql = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=403 retryCount=0, duration=56) (repository=/renovate-github-rate-limit-demo, baseBranch=main, branch=renovate-lock-file-maintenance)
DEBUG: GitHub failure: rate limit (repository=/renovate-github-rate-limit-demo, baseBranch=main, branch=renovate-lock-file-maintenance)
       "err": {
         "name": "HTTPError",
         "code": "ERR_NON_2XX_3XX_RESPONSE",
         "timings": {
           "start": 1741272391789,
           "socket": 1741272391833,
           "lookup": 1741272391833,
           "connect": 1741272391833,
           "secureConnect": 1741272391841,
           "upload": 1741272391841,
           "response": 1741272391845,
           "end": 1741272391845,
           "phases": {
             "wait": 44,
             "dns": 0,
             "tcp": 0,
             "tls": 8,
             "request": 0,
             "firstByte": 4,
             "download": 0,
             "total": 56
           }
         },
         "message": "Response code 403 (rate limit exceeded)",
         "stack": "HTTPError: Response code 403 (rate limit exceeded)\n    at Request.<anonymous> (/usr/local/renovate/node_modules/.pnpm/[email protected]/node_modules/got/dist/source/as-promise/index.js:118:42)\n    at processTicksAndRejections (node:internal/process/task_queues:105:5)",
         "options": {
           "headers": {
             "user-agent": "RenovateBot/39.188.4 (https://github.com/renovatebot/renovate)",
             "accept": "application/json, application/vnd.github.v3+json",
             "content-type": "application/json",
             "content-length": "653",
             "accept-encoding": "gzip, deflate, br"
           },
           "url": "https://api.github.com/graphql",
           "hostType": "github-releases",
           "username": "",
           "password": "",
           "method": "POST",
           "http2": false
         },
         "response": {
           "statusCode": 403,
           "statusMessage": "rate limit exceeded",
           "body": {
             "message": "API rate limit exceeded for xxx.xxx.xxx.xxx. (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.)",
             "documentation_url": "https://docs.github.com/rest/overview/resources-in-the-rest-api#rate-limiting"
           },
           "headers": {
             "date": "Thu, 06 Mar 2025 14:46:31 GMT",
             "server": "Varnish",
             "strict-transport-security": "max-age=31536000; includeSubdomains; preload",
             "x-content-type-options": "nosniff",
             "x-frame-options": "deny",
             "x-xss-protection": "1; mode=block",
             "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'",
             "access-control-allow-origin": "*",
             "access-control-expose-headers": "ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-RateLimit-Used, X-RateLimit-Resource, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, Deprecation, Sunset",
             "content-type": "application/json; charset=utf-8",
             "referrer-policy": "origin-when-cross-origin, strict-origin-when-cross-origin",
             "x-github-media-type": "github.v3; format=json",
             "x-ratelimit-limit": "0",
             "x-ratelimit-remaining": "0",
             "x-ratelimit-reset": "1741275991",
             "x-ratelimit-resource": "graphql",
             "x-ratelimit-used": "0",
             "content-length": "279",
             "x-github-request-id": "54F1:1D296C:XXXXXX:C7C75B:67C9B547",
             "connection": "close"
           },
           "httpVersion": "1.1",
           "retryCount": 0
         }
       }
DEBUG: Datasource unknown error (repository=/renovate-github-rate-limit-demo, baseBranch=main, branch=renovate-lock-file-maintenance)
       "datasource": "github-releases",
       "packageName": "containerbase/node-prebuild",
       "err": {
         "message": "rate-limit-exceeded",
         "stack": "Error: rate-limit-exceeded\n    at handleGotError (/usr/local/renovate/lib/util/http/github.ts:113:12)\n    at GithubHttp.handleError (/usr/local/renovate/lib/util/http/github.ts:331:11)\n    at GithubHttp.request (/usr/local/renovate/lib/util/http/http.ts:240:12)\n    at processTicksAndRejections (node:internal/process/task_queues:105:5)\n    at GithubHttp.requestJsonUnsafe (/usr/local/renovate/lib/util/http/github.ts:345:20)\n    at GithubHttp.requestJson (/usr/local/renovate/lib/util/http/http.ts:341:17)\n    at GithubGraphqlDatasourceFetcher.doRawQuery (/usr/local/renovate/lib/util/github/graphql/datasource-fetcher.ts:125:17)\n    at GithubGraphqlDatasourceFetcher.doShrinkableQuery (/usr/local/renovate/lib/util/github/graphql/datasource-fetcher.ts:201:20)\n    at GithubGraphqlDatasourceFetcher.doPaginatedFetch (/usr/local/renovate/lib/util/github/graphql/datasource-fetcher.ts:250:27)\n    at GithubGraphqlDatasourceFetcher.doCachedQuery (/usr/local/renovate/lib/util/github/graphql/datasource-fetcher.ts:290:7)\n    at GithubGraphqlDatasourceFetcher.getItems (/usr/local/renovate/lib/util/github/graphql/datasource-fetcher.ts:328:17)\n    at Function.query (/usr/local/renovate/lib/util/github/graphql/datasource-fetcher.ts:60:19)\n    at queryReleases (/usr/local/renovate/lib/util/github/graphql/index.ts:27:15)\n    at GithubReleasesDatasource.getReleases (/usr/local/renovate/lib/modules/datasource/github-releases/index.ts:74:28)\n    at getRegistryReleases (/usr/local/renovate/lib/modules/datasource/index.ts:85:15)\n    at fetchReleases (/usr/local/renovate/lib/modules/datasource/index.ts:318:15)\n    at getPkgReleases (/usr/local/renovate/lib/modules/datasource/index.ts:410:31)\n    at resolveConstraint (/usr/local/renovate/lib/util/exec/containerbase.ts:306:23)\n    at generateInstallCommands (/usr/local/renovate/lib/util/exec/containerbase.ts:362:27)\n    at prepareRawExec (/usr/local/renovate/lib/util/exec/index.ts:121:11)"
       }
 WARN: No tool releases found. (repository=/renovate-github-rate-limit-demo, baseBranch=main, branch=renovate-lock-file-maintenance)
       "toolConfig": {
         "datasource": "github-releases",
         "packageName": "containerbase/node-prebuild",
         "versioning": "node"
       }
DEBUG: lock file error (repository=/renovate-github-rate-limit-demo, baseBranch=main, branch=renovate-lock-file-maintenance)
       "err": {
         "message": "No tool releases found.",
         "stack": "Error: No tool releases found.\n    at resolveConstraint (/usr/local/renovate/lib/util/exec/containerbase.ts:311:11)\n    at processTicksAndRejections (node:internal/process/task_queues:105:5)\n    at generateInstallCommands (/usr/local/renovate/lib/util/exec/containerbase.ts:362:27)\n    at prepareRawExec (/usr/local/renovate/lib/util/exec/index.ts:121:11)\n    at exec (/usr/local/renovate/lib/util/exec/index.ts:147:39)\n    at Object.generateLockFile (/usr/local/renovate/lib/modules/manager/npm/post-update/npm.ts:200:5)\n    at getAdditionalFiles (/usr/local/renovate/lib/modules/manager/npm/post-update/index.ts:423:17)\n    at processBranch (/usr/local/renovate/lib/workers/repository/update/branch/index.ts:497:31)\n    at writeUpdates (/usr/local/renovate/lib/workers/repository/process/write.ts:170:17)\n    at update (/usr/local/renovate/lib/workers/repository/process/extract-update.ts:235:11)\n    at Object.renovateRepository (/usr/local/renovate/lib/workers/repository/index.ts:89:19)\n    at attributes.repository (/usr/local/renovate/lib/workers/global/index.ts:206:11)\n    at start (/usr/local/renovate/lib/workers/global/index.ts:191:7)\n    at /usr/local/renovate/lib/renovate.ts:19:22"
       },
       "type": "npm"
DEBUG: No updated lock files in branch (repository=/renovate-github-rate-limit-demo, baseBranch=main, branch=renovate-lock-file-maintenance)
DEBUG: No changes to package files, skipping post-upgrade tasks (repository=/renovate-github-rate-limit-demo, baseBranch=main, branch=renovate-lock-file-maintenance)

[rarkins]

If you need to access public registries through artifactory then you cannot support binarySource=install. Use the -full image instead, which will use preinstalled tools only (binarySource=global).

Alternatively configure a github.com token if it's allowed to access github.com directly.

[umbertooo]

Thanks for looking into this.

[philippe-granet]

@rarkins I have the same problem, and the -full image doesn't help me because I have npm/node contrains in package.json, so I need to install specific version of node.

The problem seems happen since this commit: 492a0fe#diff-879989ce7ded67c7d6e90b5153df946ce27e6c976b31077110636da9d862381eR138-R142

Before this commit, it download node from here (https://github.com/containerbase/base/blob/main/docs/custom-registries.md?plain=1#L380):

• https://github.com/containerbase/node-prebuild/releases
• https://nodejs.org/dist

and we can also override these urls with custom registry.

After this commit, it download node from Github API, and it's a problem if you have a ratelimit on Github API or don't have access to Github API (it is the case in my organization)

[rarkins]

There is no plan to change this. Supply a GitHub token or don't use dynamic install

[philippe-granet]

The problem is that in our organization, we don't have access to Github API, and only have access to Github througth an Artifactory proxy instance, that permit only access to releases artefacts, but not to the Github API.
And we have to install specific node version to be able to update package-lock.json.

But I understand that you don't want to handle all these specific cases.