dependabot / dependabot/dependabot-core
Fails with `private_source_authentication_failure` for a public repository
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Package ecosystem
Docker
### Package manager version
_No response_
### Language version
_No response_
### Manifest location and content before the Dependabot update
Dockerfile: https://github.com/efasel/fleet-dependabot/blob/main/Dockerfile
```
FROM fleetdm/fleet:v4.64.0
```
### dependabot.yml content
https://github.com/efasel/fleet-dependabot/blob/main/.github/dependabot.yml
```
version: 2
updates:
- package-ecosystem: "docker"
directory: "/"
schedule:
interval: "weekly"
```
### Updated dependency
* from: [v4.64.0](https://hub.docker.com/layers/fleetdm/fleet/v4.64.0/images/sha256-be6d416dc209718f8c4b4328b6704880bb51039a548df09cc40736787e5bf291)
* to: [v4.64.1](https://hub.docker.com/layers/fleetdm/fleet/v4.64.1/images/sha256-7cbd70d03edad1f27221489406440e23e2bde5a7f277952b217d6a378244198a)
### What you expected to see, versus what you actually saw
I expected to get a pull request like "Bump fleetdm/fleet from v4.64.0 to v4.64.1 in /"
Instead the dependabot run failed.
* log of failing dependabot run: https://github.com/efasel/fleet-dependabot/actions/runs/13567189333/job/37922845763
[summary at the end:](https://github.com/efasel/fleet-dependabot/runs/37922845763?check_suite_focus=true#step:3:7233)
```
Dependabot encountered '1' error(s) during execution, please check the logs for more details.
+-------------------------------------------------------+
| Dependencies failed to update |
+---------------+---------------------------------------+
| fleetdm/fleet | private_source_authentication_failure |
+---------------+---------------------------------------+
Failure running container 6a1bf00a7faa552294f48f53af6a72ad7b1d1e5bddbf8d46c3bb5882faeb5efc
Cleaned up container 6a1bf00a7faa552294f48f53af6a72ad7b1d1e5bddbf8d46c3bb5882faeb5efc
proxy | 2025/02/27 13:17:24 1182/3557 calls cached (33%)
proxy | 2025/02/27 13:17:24 Posting metrics to remote API endpoint
proxy | 2025/02/27 13:17:24 Successfully posted metrics data via api client
Error: Dependabot encountered an error performing the update
Error: The updater encountered one or more errors.
For more information see: https://github.com/efasel/fleet-dependabot/network/updates/971624566 (write access to the repository is required to view the log)
🤖 ~ finished: error reported to Dependabot ~
```
### Native package manager behavior
—
### Images of the diff or a link to the PR, issue, or logs
—
### Smallest manifest that reproduces the issue
https://github.com/efasel/fleet-dependabot is a repo just to show this behaviour. It only contains this one-line Dockerfile plus the dependabot.yml for Docker.
Contributor guide
Research direction
Reproduce the failure with the linked fleet-dependabot repository, its Dockerfile, and .github/dependabot.yml. Start with the linked Actions run and Dependabot update log, then trace the Docker update path handling fleetdm/fleet and private_source_authentication_failure. Done means the public image updates from v4.64.0 to v4.64.1 and produces the expected pull request.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, ruby
- Domain
- devops, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100