diff --git a/Dockerfile.updater b/Dockerfile.updater index 55cd518296c..eefee4e3077 100644 --- a/Dockerfile.updater +++ b/Dockerfile.updater @@ -46,6 +46,9 @@ bundle install # executes the package manager outputs to every job log COPY --chown=dependabot:dependabot updater/config/.yarnrc updater/config/.npmrc $DEPENDABOT_HOME/ +# For Yarn Berry we can set this via an environment variable +ENV NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt + # END: HACKY WORKAROUND FOR NPM GIT INSTALLS SPAWNING CHILD PROCESS # Add project diff --git a/npm_and_yarn/lib/dependabot/npm_and_yarn/helpers.rb b/npm_and_yarn/lib/dependabot/npm_and_yarn/helpers.rb index 0c0525b2657..832de4beabd 100644 --- a/npm_and_yarn/lib/dependabot/npm_and_yarn/helpers.rb +++ b/npm_and_yarn/lib/dependabot/npm_and_yarn/helpers.rb @@ -23,6 +23,21 @@ def self.npm_version_numeric(lockfile_content) def self.run_yarn_commands(*commands) # We never want to execute postinstall scripts SharedHelpers.run_shell_command("yarn config set enableScripts false") + if (http_proxy = ENV.fetch("HTTP_PROXY", false)) + SharedHelpers.run_shell_command("yarn config set httpProxy #{http_proxy}") + end + if (https_proxy = ENV.fetch("HTTPS_PROXY", false)) + SharedHelpers.run_shell_command("yarn config set httpsProxy #{https_proxy}") + end + if (ca_file_path = ENV.fetch("NODE_EXTRA_CA_CERTS", false)) + output = SharedHelpers.run_shell_command("yarn --version") + major_version = Version.new(output).major + if major_version >= 4 + SharedHelpers.run_shell_command("yarn config set httpsCaFilePath #{ca_file_path}") + else + SharedHelpers.run_shell_command("yarn config set caFilePath #{ca_file_path}") + end + end commands.each { |cmd| SharedHelpers.run_shell_command(cmd) } end end