Disable inferring credentials from environment variables

[fgreinacher]

(Originally discussed at #12118)

What would you like Renovate to be able to do?

I don't want Renovate to guess credentials from my environment variables so that I have full control over which credentials are presented to which registry.

If you have any ideas on how this should be implemented, please tell us here.

I'd like to have a configuration option to disable this behavior. Maybe inferCredentialsFromEnv?

Is this a feature you are interested in implementing yourself?

Yes

[rarkins]

Maybe model it on https://docs.renovatebot.com/self-hosted-configuration/#detectglobalmanagerconfig ?

Instead of it being in the "env parsing" logic (which would mean you could only disable it with another env variable) it instead could be performed as a secondary step after basic config parsing is done.

Could also be named similarly: detectHostRulesFromEnv

Finally, maybe we should do another major version bump and default it to disabled

[viceice]

Yeah, i like that idea.

As I know the current feature i always need to think about how to pass credentials via env which don't trigger this automatic parsing.

😉

[renovate-release]

🎉 This issue has been resolved in version 29.0.0 🎉

The release is available on:

• GitHub release
• 29.0.0

Your semantic-release bot 📦🚀