fix: properly pass configured env (renovatebot#35835)

Author: viceice

lib/modules/datasource/crate/index.ts

@@ -4,7 +4,7 @@ import { GlobalConfig } from '../../../config/global';
 import { logger } from '../../../logger';
 import * as memCache from '../../../util/cache/memory';
 import { cache } from '../../../util/cache/package/decorator';
-import { getChildProcessEnv } from '../../../util/exec/env';
+import { getChildEnv } from '../../../util/exec/utils';
 import { privateCacheDir, readCacheFile } from '../../../util/fs';
 import { simpleGitConfig } from '../../../util/git/config';
 import { toSha256 } from '../../../util/hash';
@@ -323,7 +323,7 @@ export class CrateDatasource extends Datasource {
         const git = Git({
           ...simpleGitConfig(),
           maxConcurrentProcesses: 1,
-        }).env(getChildProcessEnv());
+        }).env(getChildEnv());
         const clonePromise = git.clone(registryFetchUrl, clonePath, {
           '--depth': 1,
         });

lib/modules/datasource/git-refs/base.ts

@@ -2,7 +2,7 @@ import is from '@sindresorhus/is';
 import { simpleGit } from 'simple-git';
 import { logger } from '../../../logger';
 import { cache } from '../../../util/cache/package/decorator';
-import { getChildProcessEnv } from '../../../util/exec/env';
+import { getChildEnv } from '../../../util/exec/utils';
 import { getGitEnvironmentVariables } from '../../../util/git/auth';
 import { simpleGitConfig } from '../../../util/git/config';
 import { getRemoteUrlWithToken } from '../../../util/git/url';
@@ -34,12 +34,7 @@ export abstract class GitDatasource extends Datasource {
     const gitSubmoduleAuthEnvironmentVariables = getGitEnvironmentVariables([
       this.id,
     ]);
-    const gitEnv = {
-      // pass all existing env variables
-      ...getChildProcessEnv(),
-      // add all known git Variables
-      ...gitSubmoduleAuthEnvironmentVariables,
-    };
+    const gitEnv = getChildEnv({ env: gitSubmoduleAuthEnvironmentVariables });
     const git = simpleGit(simpleGitConfig()).env(gitEnv);
 
     // fetch remote tags

lib/modules/manager/git-submodules/extract.ts

@@ -4,7 +4,7 @@ import Git from 'simple-git';
 import upath from 'upath';
 import { GlobalConfig } from '../../../config/global';
 import { logger } from '../../../logger';
-import { getChildProcessEnv } from '../../../util/exec/env';
+import { getChildEnv } from '../../../util/exec/utils';
 import { getGitEnvironmentVariables } from '../../../util/git/auth';
 import { simpleGitConfig } from '../../../util/git/config';
 import { getHttpUrl } from '../../../util/git/url';
@@ -44,12 +44,7 @@ async function getDefaultBranch(subModuleUrl: string): Promise<string> {
     'git-tags',
     'git-refs',
   ]);
-  const gitEnv = {
-    // pass all existing env variables
-    ...getChildProcessEnv(),
-    // add all known git Variables
-    ...gitSubmoduleAuthEnvironmentVariables,
-  };
+  const gitEnv = getChildEnv({ env: gitSubmoduleAuthEnvironmentVariables });
   const val = await Git(simpleGitConfig())
     .env(gitEnv)
     .listRemote(['--symref', subModuleUrl, 'HEAD']);

lib/modules/manager/git-submodules/update.ts

@@ -2,7 +2,7 @@ import Git from 'simple-git';
 import upath from 'upath';
 import { GlobalConfig } from '../../../config/global';
 import { logger } from '../../../logger';
-import { getChildProcessEnv } from '../../../util/exec/env';
+import { getChildEnv } from '../../../util/exec/utils';
 import { readLocalFile } from '../../../util/fs';
 import { getGitEnvironmentVariables } from '../../../util/git/auth';
 import type { UpdateDependencyConfig } from '../types';
@@ -16,12 +16,7 @@ export default async function updateDependency({
     'git-tags',
     'git-refs',
   ]);
-  const gitEnv = {
-    // pass all existing env variables
-    ...getChildProcessEnv(),
-    // add all known git Variables
-    ...gitSubmoduleAuthEnvironmentVariables,
-  };
+  const gitEnv = getChildEnv({ env: gitSubmoduleAuthEnvironmentVariables });
   const git = Git(localDir).env(gitEnv);
   const submoduleGit = Git(upath.join(localDir, upgrade.depName)).env(gitEnv);
 

lib/modules/manager/npm/post-update/index.ts

@@ -4,7 +4,7 @@ import deepmerge from 'deepmerge';
 import upath from 'upath';
 import { logger } from '../../../../logger';
 import { ExternalHostError } from '../../../../types/errors/external-host-error';
-import { getChildProcessEnv } from '../../../../util/exec/env';
+import { getEnv } from '../../../../util/env';
 import {
   ensureCacheDir,
   getSiblingFileName,
@@ -391,8 +391,10 @@ export async function getAdditionalFiles(
 
   const { additionalNpmrcContent, additionalYarnRcYml } = processHostRules();
 
+  // This isn't passed directly to the child process, so no need to filter.
+  // But pass custom env and user vars.
   const env = {
-    ...getChildProcessEnv(),
+    ...getEnv(),
     NPM_CONFIG_CACHE: await ensureCacheDir('npm'),
     YARN_CACHE_FOLDER: await ensureCacheDir('yarn'),
     YARN_GLOBAL_FOLDER: await ensureCacheDir('berry'),

lib/util/exec/env.ts

@@ -1,5 +1,4 @@
 import { GlobalConfig } from '../../config/global';
-import { getEnv } from '../env';
 
 const basicEnvVars = [
   'HTTP_PROXY',
@@ -43,22 +42,21 @@ const basicEnvVars = [
 export function getChildProcessEnv(
   customEnvVars: string[] = [],
 ): NodeJS.ProcessEnv {
-  const combinedEnv = getEnv();
   const env: NodeJS.ProcessEnv = {};
   if (GlobalConfig.get('exposeAllEnv')) {
-    return { ...combinedEnv };
+    return { ...process.env };
   }
   const envVars = [...basicEnvVars, ...customEnvVars];
   envVars.forEach((envVar) => {
-    if (typeof combinedEnv[envVar] !== 'undefined') {
-      env[envVar] = combinedEnv[envVar];
+    if (typeof process.env[envVar] !== 'undefined') {
+      env[envVar] = process.env[envVar];
     }
   });
 
   // Copy containerbase url replacements
-  for (const key of Object.keys(combinedEnv)) {
+  for (const key of Object.keys(process.env)) {
     if (/^URL_REPLACE_\d+_(?:FROM|TO)$/.test(key)) {
-      env[key] = combinedEnv[key];
+      env[key] = process.env[key];
     }
   }
   return env;

lib/util/exec/utils.ts

@@ -6,7 +6,7 @@ import type { ExecOptions } from './types';
 export function getChildEnv({
   extraEnv,
   env: forcedEnv = {},
-}: ExecOptions): Record<string, string> {
+}: Pick<ExecOptions, 'env' | 'extraEnv'> = {}): Record<string, string> {
   const globalConfigEnv = getCustomEnv();
   const userConfiguredEnv = getUserEnv();
 

lib/util/git/index.ts

@@ -238,7 +238,7 @@ export async function initRepo(args: StorageConfig): Promise<void> {
   config.ignoredAuthors = [];
   config.additionalBranches = [];
   config.branchIsModified = {};
-  // TODO: safe to pass all env variables?
+  // TODO: safe to pass all env variables? use `getChildEnv` instead?
   git = simpleGit(GlobalConfig.get('localDir'), simpleGitConfig()).env({
     ...getEnv(),
     LANG: 'C.UTF-8',