[GitLab CI] - Fatal: can't create directory '/home/ubuntu/.gnupg': Permission denied

[The-Lomax]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Gitlab CI/CD pipeline, Renovate 39.124.0

Please tell us more about your question or problem

Hello.

I am trying to run the Renovate bot via a gitlab CI/CD pipeline. While the pipeline is running, i get a fatal error and it's crashing every time. The error message is as follows:
Command failed: gpg --batch --no-tty --import /tmp/git-private-gpg.key\ngpg: Fatal: can't create directory '/home/ubuntu/.gnupg': Permission denied\n

Here is the config that i am using:

renovate:
  stage: renovate
  image: ghcr.io/renovatebot/renovate:39.124.0
  variables:
    RENOVATE_BASE_DIR: $CI_PROJECT_DIR/renovate
    RENOVATE_ENDPOINT: $CI_API_V4_URL
    RENOVATE_GIT_AUTHOR: "project_<ID>_bot <project<ID>_bot@noreply<GITLAB URL>.com>"
    RENOVATE_PLATFORM: gitlab
    RENOVATE_DOCKER_USER: "0:0"
    RENOVATE_ONBOARDING_CONFIG: '{"$$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": ["config:recommended"]}'
    RENOVATE_PLATFORM_COMMIT: true
    RENOVATE_ONBOARDING_CONFIG_FILE_NAME: ".gitlab/renovate.json"
    RENOVATE_EXTRA_FLAGS: <REPO NAME>
    LOG_LEVEL: debug
  rules:
    - if: '$actioner == "bot"'
  script:
    - renovate $RENOVATE_EXTRA_FLAGS

Additional information:

• Project Access token is created and supplied via GitLab CICD variable RENOVATE_TOKEN (role: maintainer, permissions: api, write_repo)
• GPG armored secret token exported as per guide below, created with the same details (name, email) as the bot details above) supplied via GitLab CICD variable RENOVATE_GIT_PRIVATE_KEY

# generate a keypair that is written to your keychain
gpg --full-generate-key
# answer the various prompts
# get the key ID of the secret key
gpg --list-secret-keys
# export the secret key from your keychain in armored format
gpg --armor --export-secret-keys <key ID>

Things i've tried so far:

• running the bot without a GPG key supplied runs but throws an error that "commits must be signed with a gpg key" due to organisation policy. I cannot disable that.
• running the bot locally via docker allows to create the folder in question
• used 3 different renovate image version tags: "full", 39.124.0 and 39.118.4
• tested with different re-created GPG keys

I have tried different solutions i could dig out online, but nothing worked. It seems that i can only alter the behaviour of the bot image via environment variables.

Any suggestions would be greatly appreciated.
I've had to edit some project-related info out, i hope you understand. Also, i tried to include everything useful i could think of. If there's anything else i should provide, please let me know and i will supply the information.

Logs (if relevant)

Logs

DEBUG: Executing command (repository=<REPO NAME>)
       "command": "gpg --batch --no-tty --import /tmp/git-private-gpg.key"
DEBUG: rawExec err (repository=<REPO NAME>)
       "err": {
         "cmd": "/bin/sh -c gpg --batch --no-tty --import /tmp/git-private-gpg.key",
         "stderr": "gpg: Fatal: can't create directory '/home/ubuntu/.gnupg': Permission denied\n",
         "stdout": "",
         "options": {
           "cwd": "<REPO NAME>",
           "encoding": "utf-8",
           "env": {
             "HOME": "/home/ubuntu",
             "PATH": "/home/ubuntu/.local/bin:/home/ubuntu/bin:/home/ubuntu/.local/bin:/home/ubuntu/bin:/home/ubuntu/.local/bin:/home/ubuntu/bin:/home/ubuntu/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
             "LC_ALL": "C.UTF-8",
             "LANG": "C.UTF-8",
             "CONTAINERBASE_CACHE_DIR": "<REPO NAME>/renovate/cache/containerbase"
           },
           "maxBuffer": 10485760,
           "timeout": 900000
         },
         "exitCode": 2,
         "name": "ExecError",
         "message": "Command failed: gpg --batch --no-tty --import /tmp/git-private-gpg.key\ngpg: Fatal: can't create directory '/home/ubuntu/.gnupg': Permission denied\n",
         "stack": "ExecError: Command failed: gpg --batch --no-tty --import /tmp/git-private-gpg.key\ngpg: Fatal: can't create directory '/home/ubuntu/.gnupg': Permission denied\n\n    at ChildProcess.<anonymous> (/usr/local/renovate/lib/util/exec/common.ts:101:11)\n    at ChildProcess.emit (node:events:536:35)\n    at ChildProcess.emit (node:domain:489:12)\n    at Process.ChildProcess._handle.onexit (node:internal/child_process:293:12)"
       },
       "durationMs": 9
 WARN: gitPrivateKey: error importing (repository=<REPO NAME>)
       "err": {
         "cmd": "/bin/sh -c gpg --batch --no-tty --import /tmp/git-private-gpg.key",
         "stderr": "gpg: Fatal: can't create directory '/home/ubuntu/.gnupg': Permission denied\n",
         "stdout": "",
         "options": {
           "cwd": "<REPO NAME>",
           "encoding": "utf-8",
           "env": {
             "HOME": "/home/ubuntu",
             "PATH": "/home/ubuntu/.local/bin:/home/ubuntu/bin:/home/ubuntu/.local/bin:/home/ubuntu/bin:/home/ubuntu/.local/bin:/home/ubuntu/bin:/home/ubuntu/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
             "LC_ALL": "C.UTF-8",
             "LANG": "C.UTF-8",
             "CONTAINERBASE_CACHE_DIR": "<REPO NAME>/renovate/cache/containerbase"
           },
           "maxBuffer": 1048[576](<GITLAB URL>)0,
           "timeout": 900000
         },
         "exitCode": 2,
         "name": "ExecError",
         "message": "Command failed: gpg --batch --no-tty --import /tmp/git-private-gpg.key\ngpg: Fatal: can't create directory '/home/ubuntu/.gnupg': Permission denied\n",
         "stack": "ExecError: Command failed: gpg --batch --no-tty --import /tmp/git-private-gpg.key\ngpg: Fatal: can't create directory '/home/ubuntu/.gnupg': Permission denied\n\n    at ChildProcess.<anonymous> (/usr/local/renovate/lib/util/exec/common.ts:101:11)\n    at ChildProcess.emit (node:events:536:35)\n    at ChildProcess.emit (node:domain:489:12)\n    at Process.ChildProcess._handle.onexit (node:internal/child_process:293:12)"
       }
ERROR: Repository has unknown error (repository=<REPO NAME>)
       "err": {
         "message": "gpg-failed",
         "stack": "Error: gpg-failed\n    at GPGKey.writeKey (/usr/local/renovate/lib/util/git/private-key.ts:42:13)\n    at processTicksAndRejections (node:internal/process/task_queues:105:5)\n    at writePrivateKey (/usr/local/renovate/lib/util/git/private-key.ts:142:3)\n    at handleCommitAuth (/usr/local/renovate/lib/util/git/index.ts:991:5)\n    at prepareCommit (/usr/local/renovate/lib/util/git/index.ts:1019:3)\n    at Object.commitFiles (/usr/local/renovate/lib/util/git/index.ts:1189:26)\n    at checkOnboardingBranch (/usr/local/renovate/lib/workers/repository/onboarding/branch/index.ts:120:20)\n    at getRepoConfig (/usr/local/renovate/lib/workers/repository/init/config.ts:17:12)\n    at initRepo (/usr/local/renovate/lib/workers/repository/init/index.ts:58:12)\n    at Object.renovateRepository (/usr/local/renovate/lib/workers/repository/index.ts:64:14)\n    at attributes.repository (/usr/local/renovate/lib/workers/global/index.ts:206:11)\n    at start (/usr/local/renovate/lib/workers/global/index.ts:191:7)\n    at /usr/local/renovate/lib/renovate.ts:19:22"
       }

[rarkins]

Can you try changing the script temporarily to check permissions? I'd like to see the output of some commands like:

• id
• ls -l /home
• ls -al /home/ubuntu

[The-Lomax]

I have tried adding the docker user section to the config like this

i also tried with 'ubuntu' but neither worked. The uid, gid and groups remained the same

[rarkins]

I'm not familiar with how GitLab CI/CD configuration works. I suggest you try the official renovate-runner instead of running the image directly

[The-Lomax]

I see, thank you for the help. The official renovate-runner you mean is this: https://gitlab.com/renovate-bot/renovate-runner ?
And by "trying it" you mean using it via the "include project" way?

am i correct in this thinking?

[rarkins]

Yes, I mean follow the instructions in https://gitlab.com/renovate-bot/renovate-runner's readme

[The-Lomax]

This way was just one of the ways i found it in the runner's template files, so i thought this was the way to go about it.
I will try your suggestion instead. Thank you for the assistance.

[The-Lomax]

Hi again. I wanted to check back on this because i have found the root cause of the problem. The issue was, that our GitLab is running on a dedicated platform, and all the issues were coming from the runners we have been provided with. I have managed to find a runner that wasn't so severely limited (as much as to not have any user accounts, etc.) and specified the job description using GitLab CICD Job Tags. This worked out of the box, including GPG commit signing, etc.
Wanted to post this, in case someone would come across similar issue (though it's rare, as it stems from the type of infrastructure available).
Again, @rarkins thank you for your help!
Here's the proof: