GitHub Dependabot security updates are failing with 401 Authentication error, when it initiates a connection with Artifactory pypi private registry for security updates

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

pip

Package manager version

poetry

Language version

python = "~3.10.4"

Manifest location and content before the Dependabot update

/.../poerty.lock

dependabot.yml content

registries:
  tqt:
    type: python-index
    url: https://########.jfrog.io/artifactory/api/pypi/pypi/simple
    username: ######
    password: ${{secrets.##################}}
    replaces-base: false
  gcr:
    type: docker-registry
    url: #################
    username: _json_key
    password: ${{secrets.##################}}
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "daily"
    commit-message:
      prefix: "[Draft]"
    rebase-strategy: "disabled"
  - package-ecosystem: "pip"
    directory: #################
    registries: "*"
    insecure-external-code-execution: allow
    schedule:
      interval: "daily"
    commit-message:
      prefix: "[Draft]"
    target-branch: "main"
    open-pull-requests-limit: 25
    rebase-strategy: "disabled"
  - package-ecosystem: "pip"
    directory: #################
    registries: "*"
    insecure-external-code-execution: allow
    schedule:
      interval: "daily"
    commit-message:
      prefix: "[Draft]"
    target-branch: "main"
    open-pull-requests-limit: 25
    rebase-strategy: "disabled"
  - package-ecosystem: "pip"
    directory: #################
    registries: "*"
    insecure-external-code-execution: allow
    schedule:
      interval: "daily"
    commit-message:
      prefix: "[Draft]"
    target-branch: "main"
    open-pull-requests-limit: 25
    rebase-strategy: "disabled"
  - package-ecosystem: "docker"
    directory: "/api"
    registries:
      - gcr
    schedule:
      interval: "daily"
    commit-message:
      prefix: "[Draft]"
    target-branch: "main"
    open-pull-requests-limit: 25
    rebase-strategy: "disabled"
  - package-ecosystem: "docker"
    directory: #################
    registries:
      - gcr
    schedule:
      interval: "daily"
    commit-message:
      prefix: "[Draft]"
    target-branch: "main"
    open-pull-requests-limit: 25
    rebase-strategy: "disabled"
  - package-ecosystem: "docker"
    directory: #################
    registries:
      - gcr
    schedule:
      interval: "daily"
    commit-message:
      prefix: "[Draft]"
    target-branch: "main"
    open-pull-requests-limit: 25
    rebase-strategy: "disabled"

Updated dependency

starlette >= 0.13.5, < 0.27.0. to 0.27.0

What you expected to see, versus what you actually saw

We expect the dependabot to create a PR after security update

Images of the diff or a link to the PR, issue, or logs

  proxy | 2023/05/23 05:36:40 Listening (:1080)
updater | 2023-05-23T05:36:41.563875496 [666711683:main:WARN:src/devices/src/legacy/serial.rs:222] Detached the serial input due to peer close/error.
updater | time="2023-05-23T05:36:43Z" level=info msg="guest starting" commit=8ab4a20db815b67034070152643b9878c12b051d
updater | time="2023-05-23T05:36:43Z" level=info msg="starting job..." fetcher_timeout=10m0s job_id=666711683 updater_timeout=45m0s updater_version=49704c16cb0893c0ab8c5f884471c324baf39b83-pip
updater | 2023/05/23 05:36:45 INFO Raven 3.1.2 ready to catch errors
updater | 2023/05/23 05:36:47 INFO <job_666711683> Starting job processing
  proxy | 2023/05/23 05:36:47 [002] GET https://api.github.com:443/repos/###############
  proxy | 2023/05/23 05:36:47 [002] * authenticating github api request with token for api.github.com
  proxy | 2023/05/23 05:36:48 [002] 200 https://api.github.com:443/repos/###############
  proxy | 2023/05/23 05:36:48 [004] GET https://api.github.com:443/repos/###############/git/refs/heads/main
  proxy | 2023/05/23 05:36:48 [004] * authenticating github api request with token for api.github.com
  proxy | 2023/05/23 05:36:48 [004] 200 https://api.github.com:443/repos/###############/git/refs/heads/main
  proxy | 2023/05/23 05:36:48 [006] GET https://api.github.com:443/repos/###############/contents/daemon?ref=b493d916acd54991f161dee2eab633907eb49373
  proxy | 2023/05/23 05:36:48 [006] * authenticating github api request with token for api.github.com
  proxy | 2023/05/23 05:36:48 [006] 200 https://api.github.com:443/repos/###############/contents/daemon?ref=b493d916acd54991f161dee2eab633907eb49373
  proxy | 2023/05/23 05:36:48 [008] GET https://api.github.com:443/repos/###############/contents/daemon/pyproject.toml?ref=b493d916acd54991f161dee2eab633907eb49373
  proxy | 2023/05/23 05:36:48 [008] * authenticating github api request with token for api.github.com
  proxy | 2023/05/23 05:36:48 [008] 200 https://api.github.com:443/repos/###############/contents/daemon/pyproject.toml?ref=b493d916acd54991f161dee2eab633907eb49373
  proxy | 2023/05/23 05:36:48 [010] GET https://api.github.com:443/repos/###############/contents/daemon/poetry.lock?ref=b493d916acd54991f161dee2eab633907eb49373
  proxy | 2023/05/23 05:36:48 [010] * authenticating github api request with token for api.github.com
  proxy | 2023/05/23 05:36:48 [010] 200 https://api.github.com:443/repos/###############/contents/daemon/poetry.lock?ref=b493d916acd54991f161dee2eab633907eb49373
  proxy | 2023/05/23 05:36:48 [012] GET https://api.github.com:443/repos/###############/contents/daemon/.devcontainer?ref=b493d916acd54991f161dee2eab633907eb49373
  proxy | 2023/05/23 05:36:48 [012] * authenticating github api request with token for api.github.com
  proxy | 2023/05/23 05:36:48 [012] 200 https://api.github.com:443/repos/###############/contents/daemon/.devcontainer?ref=b493d916acd54991f161dee2eab633907eb49373
  proxy | 2023/05/23 05:36:48 [014] GET https://api.github.com:443/repos/###############/contents/daemon/tx_in_daemon?ref=b493d916acd54991f161dee2eab633907eb49373
  proxy | 2023/05/23 05:36:48 [014] * authenticating github api request with token for api.github.com
  proxy | 2023/05/23 05:36:48 [014] 200 https://api.github.com:443/repos/###############/contents/daemon/tx_in_daemon?ref=b493d916acd54991f161dee2eab633907eb49373
  proxy | 2023/05/23 05:36:48 [016] GET https://api.github.com:443/repos/###############/contents/lib/tx_in_utils/setup.py?ref=b493d916acd54991f161dee2eab633907eb49373
  proxy | 2023/05/23 05:36:48 [016] * authenticating github api request with token for api.github.com
  proxy | 2023/05/23 05:36:48 [016] 404 https://api.github.com:443/repos/###############/contents/lib/tx_in_utils/setup.py?ref=b493d916acd54991f161dee2eab633907eb49373
  proxy | 2023/05/23 05:36:48 [018] GET https://api.github.com:443/repos/###############/contents/lib/tx_in_utils?ref=b493d916acd54991f161dee2eab633907eb49373
  proxy | 2023/05/23 05:36:48 [018] * authenticating github api request with token for api.github.com
  proxy | 2023/05/23 05:36:49 [018] 200 https://api.github.com:443/repos/###############/contents/lib/tx_in_utils?ref=b493d916acd54991f161dee2eab633907eb49373
  proxy | 2023/05/23 05:36:49 [020] GET https://api.github.com:443/repos/###############/contents/lib/tx_in_utils/pyproject.toml?ref=b493d916acd54991f161dee2eab633907eb49373
  proxy | 2023/05/23 05:36:49 [020] * authenticating github api request with token for api.github.com
  proxy | 2023/05/23 05:36:49 [020] 200 https://api.github.com:443/repos/###############/contents/lib/tx_in_utils/pyproject.toml?ref=b493d916acd54991f161dee2eab633907eb49373
  proxy | 2023/05/23 05:36:49 [022] GET https://api.github.com:443/repos/###############/contents/lib/tx_in_utils/setup.cfg?ref=b493d916acd54991f161dee2eab633907eb49373
  proxy | 2023/05/23 05:36:49 [022] * authenticating github api request with token for api.github.com
  proxy | 2023/05/23 05:36:49 [022] 404 https://api.github.com:443/repos/###############/contents/lib/tx_in_utils/setup.cfg?ref=b493d916acd54991f161dee2eab633907eb49373
  proxy | 2023/05/23 05:36:49 [024] GET https://api.github.com:443/repos/###############/contents/?ref=b493d916acd54991f161dee2eab633907eb49373
  proxy | 2023/05/23 05:36:49 [024] * authenticating github api request with token for api.github.com
  proxy | 2023/05/23 05:36:49 [024] 200 https://api.github.com:443/repos/###############/contents/?ref=b493d916acd54991f161dee2eab633907eb49373
updater | 2023/05/23 05:36:49 INFO <job_666711683> Finished job processing
updater | time="2023-05-23T05:36:49Z" level=info msg="task complete" container_id=job-666711683-file-fetcher exit_code=0 job_id=666711683 step=fetcher
updater | 2023/05/23 05:36:51 INFO Raven 3.1.2 ready to catch errors
updater | 2023/05/23 05:36:52 INFO <job_666711683> Starting job processing
updater | 2023/05/23 05:36:57 INFO <job_666711683> Starting update job for ###############
updater | 2023/05/23 05:36:57 INFO <job_666711683> Checking if starlette 0.26.1 needs updating
  proxy | 2023/05/23 05:36:57 [030] GET https://pypi.org:443/simple/starlette/
  proxy | 2023/05/23 05:36:57 [030] 200 https://pypi.org:443/simple/starlette/
  proxy | 2023/05/23 05:36:58 [032] GET https://#######.jfrog.io:443/artifactory/api/pypi/pypi/simple/starlette/
  proxy | 2023/05/23 05:36:58 [032] 401 https://#######.jfrog.io:443/artifactory/api/pypi/pypi/simple/starlette/
  proxy | 2023/05/23 05:36:58 [034] GET https://#######.jfrog.io:443/artifactory/api/pypi/pypi/simple/
  proxy | 2023/05/23 05:36:58 [034] 401 https://#######.jfrog.io:443/artifactory/api/pypi/pypi/simple/
updater | 2023/05/23 05:36:58 INFO <job_666711683> Handled error whilst updating starlette: private_source_authentication_failure {:source=>"https://#######.jfrog.io/artifactory/api/pypi/pypi/simple/"}
updater | 2023/05/23 05:36:59 INFO <job_666711683> Finished job processing
updater | 2023/05/23 05:36:59 INFO Results:
updater | Dependabot encountered '1' error(s) during execution, please check the logs for more details.
updater | +---------------------------------------------------+
updater | |           Dependencies failed to update           |
updater | +-----------+---------------------------------------+
updater | | starlette | private_source_authentication_failure |
updater | +-----------+---------------------------------------+
updater | time="2023-05-23T05:36:59Z" level=info msg="task complete" container_id=job-666711683-updater exit_code=0 job_id=666711683 step=updater```

Start with the pip registry configuration in dependabot.yml and the dependency data in poetry.lock, then reproduce the starlette security update using the reported Artifactory credentials. Compare the request behavior with the logged private_source_authentication_failure. Done means the update completes authentication and creates the expected pull request.