globalExtends from an internal host can't be granted via hostRules, and ignores internalHostAccess

[lindeskar]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

44.127.1 (first seen on 44.103.0)

Please tell us more about your question or problem

globalExtends presets from an internal host can't be granted with hostRules / allowInternal, and internalHostAccess isn't applied to them either. It looks like they're fetched before either is set up.

We serve our global preset from a sidecar on http://localhost:8088, mainly so the early globalExtends fetch doesn't use GitHub's anonymous rate limit. Since 44.10x every run logs the "internal host whose response becomes configuration" warning for it, and we can't find any config that clears it:

• a scoped grant, hostRules: [{ matchHost: 'http://localhost:8088', allowInternal: true }], still warns;
• internalHostAccess: 'block' also only warns, and the preset is still fetched and merged;
• internalHostAccess: 'allow' also still warns.

So once the default becomes block, I think any globalExtends from an internal host will be refused whatever the admin configures.

Code checked with Claude Code: getGlobalConfig() → parseConfigs() resolves globalExtends before GlobalConfig.set({ internalHostAccess, … }) and before globalInitialize() registers hostRules (lib/workers/global/index.ts, lib/workers/global/config/parse/index.ts). The fetch is therefore judged against the built-in warn default, with no grants. The comment at the GlobalConfig.set call shows the same problem was already handled for the platform's own init requests, so maybe globalExtends just needs the same treatment? E.g. apply internalHostAccess and the file/env hostRules before resolveGlobalExtends().

Minimal reproduction

config.js:

module.exports = {
  onboarding: false,
  requireConfig: 'optional',
  internalHostAccess: 'block',
  globalExtends: ['http://localhost:18088/default.json'],
  hostRules: [{ matchHost: 'http://localhost:18088', allowInternal: true }],
};

Serve default.json ({ "labels": ["from-global-extends"] }) on localhost, then run against any local git repo:

python3 -m http.server 18088 --bind 127.0.0.1 --directory ./presets &
RENOVATE_CONFIG_FILE=$PWD/config.js LOG_FORMAT=json LOG_LEVEL=debug \
  npx --package renovate@44.127.1 -- renovate --platform=local --dry-run=lookup

Expected: no warning, since the host has a scoped allowInternal grant. Under internalHostAccess: 'block' with no grant, the request should be refused.

Actual: one WARN as below, and the preset is fetched and merged (from-global-extends ends up in the resolved config), with the grant or without it, under block, warn and allow alike.

Logs (if relevant)

Logs

{"level":30,"msg":"Renovate started","renovateVersion":"44.127.1"}
{"level":40,"hostname":"localhost","hostType":"preset","msg":"HTTP request to an internal host whose response becomes configuration, which `internalHostAccess=block` would refuse - permit it with a `hostRules` entry setting `allowInternal: true`, scoped with a `hostType` or a URL-prefix `matchHost`, or set `internalHostAccess=block` to enforce this now. The default will become `block` in a future major release."}

Investigation and reproduction done with help from Claude.

[jamietanna]

Interesting! (And good to see another use-case for how folks use globalExtends)

Yes, we'd be happy with a fix to make it so hostRules get initialised before globalExtends - PR welcome if you feel you'll be able to get to it? If not, I can get an Issue raised and someone can pick it up when they get a chance

[lindeskar]

Thanks for the quick attention on this!

I created a PR here: #46666