Renovate fails to fetch private GitHub repo dependency after migrating from Yarn to pnpm (Host key verification failed)

[maiolica]

How are you running Renovate?

A Mend.io-hosted app

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

GitHub

Please tell us more about your question or problem

After migrating our project from Yarn to pnpm, Renovate stopped being able to fetch dependencies from:

• a private npm package, and
• a private GitHub repository referenced via git+https://.

No changes were made to our .github/renovate.json5.

The private npm package issue was fixed by adding an npm token in the Renovate Web UI and this rule:

  "packageRules": [
    {
      "matchPackageNames": [
        "@private/repo"
      ],
      "npmrc": "//registry.npmjs.org/:_authToken={{ secrets.NPM_TOKEN }}"
    },
  ]

This works fine now.

The private GitHub dependency is referenced in package.json in this way:

"dependency": "git+https://github.com/user/private-repo.git#v1"

Following the Renovate docs, I added:

  "hostRules": [
    {
      "matchHost": "github.com",
      "token": "{{ secrets.RENOVATE_GITHUB_TOKEN }}"
    }
  ],

However, Renovate fails with this error:

ERROR Command failed with exit code 128: git ls-remote --refs git+ssh://git@github.com/<user>/<repo>.git
Host key verification failed.
fatal: Could not read from remote repository.

Note:

• the GitHub token has repo scope and works fine
• with Yarn, everything was working correctly, with the same configuration

Logs (if relevant)

Logs

ERROR Command failed with exit code 128: git ls-remote --refs git+ssh://git@github.com/<user>/<repo>.git
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

[jamietanna]

Can you please share a Job ID for your repository, so we can check the logs on the Mend side?

[maiolica]

Can you please share a Job ID for your repository, so we can check the logs on the Mend side?

Sure:

913ba1c1-b486-4124-861a-328cac08592f

Thanks!

[jamietanna]

Thanks! Am I right in seeing that the most recent jobs seem to not be seeing it any more? Or do you have a more recent Job ID to check, too?

I'll continue digging in based on ☝️

[maiolica]

This unfortunately is still happening in the same repo, all the Renovate PRs cannot be merged because of the above error

[jamietanna]

OK, looking a little further, I believe that the hostRule was the problem - did you then remove it on 2025-11-04 (the next day) and since builds have been passing? Or has there been no change to that?

[maiolica]

I tried several different configurations, with no success, the presence/absence of the following code did not affect the outcome.

  "hostRules": [
    {
      "matchHost": "github.com",
      "token": "{{ secrets.RENOVATE_GITHUB_TOKEN }}"
    }
  ],

[maiolica]

Have tried several different configurations, with no success, seems that Renovate, when using pnpm and a dependency with a private GitHub repo, is not working.
@jamietanna: are you able to reproduce this, or is it happening just to me?

[maiolica]

Thanks, have added the secret, now the error matches with the one I have experienced, please check this job.
Note: the token was generated in the Fine-grained personal access tokens section of my GH settings, with the permissions to access all my renovate-test* repos, and Metadata and Contents permissions

[TheEdgeOfRage]

FWIW, I also have the same issue. I tried with the following host rules:

    {
      matchHost: "github.com",
      enableHttp2: true,
      token: "{{ secrets.GITHUB_TOKEN }}",
      hostType: "npm"
    },
    {
      matchHost: "github.com",
      token: "{{ secrets.GITHUB_TOKEN }}",
      hostType: "git-refs"
    },

With the GITHUB_TOKEN being saved on the mend UI and granted access to our internal repo, but I also get the same ssh error, instead of trying to use https to clone the repo.

I then tried using a package rule like this, but still no luck

    {
      "matchPackageNames": [
        "@<org>/<repo",
      ],
      npmrc: "git+https://{{ secrets.GITHUB_TOKEN }}:x-oauth-basic@github.com/<org>/<repo>.git",
    },

[enkhjile]

I'm having the same issue. I think the problem is during the lock file update, pnpm tries to use SSH instead of HTTPS with PAT.
BTW, I explicitly set pnpm to use https with prefix git+https://

[enkhjile]

I just found out there are similar issues on pnpm side too

pnpm/pnpm#3948
pnpm/pnpm#7243

[enkhjile]

I ran a small experiment where I tried updating a lockfile that includes a private package declared using a git+https:// URL, but without having any access to that private package.
This confirmed that pnpm falls back to SSH when it cannot resolve the repository over HTTPS, even when package.json explicitly uses a git+https:// prefix. (pnpm: Command failed with exit code 128: git ls-remote --refs git+ssh://git@github.com/gertech/my-private-repo.git)
Given this behavior, it seems likely that either my host rules are incorrect or Renovate is hitting a bug or race condition during credential setup.

@jamietanna
Could you please confirm whether my configuration looks correct?
I’ve selected PK_PAT (my personal access token with read access to the private package repository). The package repo is in my org at https://github.com/gertech/my-private-package

"allowedEnv": [
    "GO*",
    "GRADLE_OPTS",
    "RUSTC_BOOTSTRAP"
],
"description": [
    "Hopefully safe environment variables to allow users to configure."
],
"token": "***********",
"redisUrl": "rediss://**redacted**@master.developer-platform-bare-metal-prd-auth.aqffol.use1.cache.amazonaws.com:6379",
"hostRules": [
    {
        "hostType": "docker",
        "matchHost": "docker.io",
        "username": "mdpprod2renovate",
        "password": "***********"
    },
    {
        "hostType": "docker",
        "matchHost": "hub.docker.com",
        "username": "mdpprodrenovatedc2",
        "password": "***********"
    },
    {
        "hostType": "github",
        "matchHost": "api.github.com",
        "token": "***********"
    },
    {
        "hostType": "github-tags",
        "matchHost": "api.github.com",
        "token": "***********"
    },
    {
        "hostType": "github-releases",
        "matchHost": "api.github.com",
        "token": "***********"
    },
    {
        "hostType": "pod",
        "matchHost": "api.github.com",
        "token": "***********"
    },
    {
        "hostType": "terraform-provider",
        "matchHost": "api.github.com",
        "token": "***********"
    },
    {
        "hostType": "rubygems",
        "matchHost": "github.com",
        "token": "***********"
    },
    {
        "matchHost": "https://github.com/gertech",
        "hostType": "github",
        "token": "***********"
    }
],
"secrets": {
    "PK_PAT": "***********"
}

Edit:
I've just noticed a subtle difference between my experiment and the actual jobs log. Experiment had git@github.com whereas job had **redacted**@github.com

Command failed with exit code 128: git ls-remote --refs git+ssh://**redacted**@github.com/gertech/my-private-repo

[github-actions[bot]]

Hi there,

Please help this Discussion progress by creating a minimal reproduction. This means a repository dedicated to reproducing this issue with the minimal dependencies and config possible.

Before we start working on your issue we need to know exactly what's causing the current behavior. A minimal reproduction helps us with this. Discussions without reproductions are less likely to be converted to Issues.

Please follow these steps:

1. Read our guide on creating a minimal reproduction.
2. Go to our minimal reproduction template repository.
3. Select the Use this template button to create a new repository based on the template.
4. Work on the reproduction in your own repository. Ensure it's actually minimal (no unnecesary dependencies or config), or it will be rejected by maintainers.
5. Install the Renovate app to verify that what you say happens (or doesn't happen) reproduces.
6. Fill out the information in your repository's README.md. What you describe there should reflect what you see in this repo, with the hosted app, and not what you saw in your original repo/environment.
7. Add the link to your reproduction to the first post of your Discussion. If you are not the original author, you can post a new comment with the link.
8. Add a Discussion comment mentioning that the reproduction repo is now available and linked.

If you need help with running Renovate on your minimal reproduction repository, please refer to our Running Renovate guide.
Good luck,

The Renovate team