ls-remote failing after automerge on Bitbucket – could not read Username – No such device or address

[DidierLoiseau]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

Other (please specify)

Which version of Renovate are you using?

42.15.0, 42.99.0 & 43.96.0 (but on Node 22)

Please tell us more about your question or problem

I am trying to implement automerge for some patch versions of our parent poms on Bitbucket, with Renovate CLI running on Jenkins. I have tried with Renovate 42.15.0 and 42.99.0 (we don’t have Node 24 on our Jenkins¹). I am only trying on a personal repository for now.

Everything works properly, PRs are created when automerge: false or when a build fails ("automergeType": "branch"). However, after automerging (which works fine), it says Restarting repository job after automerge result and then tries to do an ls-remote, which seems to have the proper header, but it fails regardless with

fatal: could not read Username for 'https://example.com': No such device or address

Strangely, this ls-remote only seems to happen after an automerge. I guess it’s not needed for the initial clone?

AFAICT the ls-remote URL is correct, and I can execute the command locally just fine (without the Bearer).

I also tried with a host rule {"hostType": "bitbucket-server", "token": "{{ secrets.BITBUCKET_TOKEN }}"} (with secrets.BITBUCKET_TOKEN: process.env.RENOVATE_TOKEN) but that did not help.

In local (macOS 15), it works with username and password, but then the fetchBranchCommits() line contains **redacted**@ in the URL. With token it fails in the same way as on Jenkins, and even stranger: it appears to remove my credentials from osxkeychain! (only in case of automerge)

I’m including the logs from the automerging until the error, as well as a simplified version of the printed combined config (I essentially removed onboardingConfig, ignorePresets and the non-automerge packageRules)

¹ I actually tried 43.96.0 on Node 22, and despite complaining about the unsupported version, it ran regardless and produced the same error

Logs (if relevant)

Logs: Combined config

DEBUG: Combined config
       "config": {
         "endpoint": "https://example.com/alm/bitbucket/",
         "platform": "bitbucket-server",
         "baseBranchPatterns": [
           "develop",
           "/^release\\/v?31\\.2\\.[xX]$/",
           "/^release\\/v?32\\.0\\.[xX]$/"
         ],
         "separateMinorPatch": true,
         "dependencyDashboard": false,
         "enabledManagers": ["maven", "npm"],
         "secrets": {"MAVEN_USER": "***********", "MAVEN_PASSWORD": "***********"},
         "prHourlyLimit": 10,
         "automergeType": "branch",
         "repositories": ["~didier.loiseau_mycompany.com/myapp-tasklist"],
         "npmrc": "***********",
         "hostRules": [
           {
             "hostType": "maven",
             "matchHost": "https://example.com/alm/nexus/repository/maven_group",
             "username": "{{ secrets.MAVEN_USER }}",
             "password": "{{ secrets.MAVEN_PASSWORD }}"
           }
         ],
         "packageRules": [
           {
             "matchDatasources": ["maven"],
             "registryUrls": [
               "https://example.com/alm/nexus/repository/maven_group"
             ]
           },
           {
             "description": [
               "Enable automerge for patches of specific MYAPP parent and api artifacts (up to 31.2.2)"
             ],
             "matchDatasources": ["maven"],
             "matchPackageNames": [
               "com.example.myapp:myapp-backend-parent",
               "com.example.myapp:myapp-parent",
               "com.example.myapp:myapp-api-parent"
             ],
             "matchCurrentVersion": "[31.2.0,31.2.2)",
             "matchRepositories": ["**"],
             "groupName": "MYAPP parents",
             "allowedVersions": "<=31.2.2",
             "automerge": true
           },
           {
             "description": [
               "Enable automerge for patches of specific MYAPP parent and api artifacts (up to 32.0.17)"
             ],
             "matchDatasources": ["maven"],
             "matchPackageNames": [
               "com.example.myapp:myapp-backend-parent",
               "com.example.myapp:myapp-parent",
               "com.example.myapp:myapp-api-parent"
             ],
             "matchCurrentVersion": "[32.0.0,32.0.17)",
             "matchRepositories": ["**"],
             "groupName": "MYAPP parents",
             "allowedVersions": "<=32.0.17",
             "automerge": true
           },
         ],
         "token": "***********",
         "recreateWhen": "always",
         "reportType": "file",
         "reportPath": "renovate-report.json"
       }

Logs: automerge and failure

DEBUG: branch status check result (repository=~didier.loiseau_mycompany.com/myapp-microservice, baseBranch=release/31.2.X, branch=renovate/release/31.2.X-patch-myapp-parents)
       "commitStatus": {"cancelled": 0, "successful": 2, "inProgress": 0, "failed": 0, "unknown": 0}
DEBUG: Branch status green (repository=~didier.loiseau_mycompany.com/myapp-microservice, baseBranch=release/31.2.X, branch=renovate/release/31.2.X-patch-myapp-parents)
DEBUG: Automerging branch (repository=~didier.loiseau_mycompany.com/myapp-microservice, baseBranch=release/31.2.X, branch=renovate/release/31.2.X-patch-myapp-parents)
DEBUG: Setting current branch to release/31.2.X (repository=~didier.loiseau_mycompany.com/myapp-microservice, baseBranch=release/31.2.X, branch=renovate/release/31.2.X-patch-myapp-parents)
DEBUG: latest commit (repository=~didier.loiseau_mycompany.com/myapp-microservice, baseBranch=release/31.2.X, branch=renovate/release/31.2.X-patch-myapp-parents)
       "branchName": "release/31.2.X",
       "latestCommitDate": "2026-03-23T00:31:22+01:00",
       "sha": "469dc857c1a8850b2312e0f54d88071a7255a64a"
 INFO: Branch automerged (repository=~didier.loiseau_mycompany.com/myapp-microservice, baseBranch=release/31.2.X, branch=renovate/release/31.2.X-patch-myapp-parents)
DEBUG: mergeStatus=automerged (repository=~didier.loiseau_mycompany.com/myapp-microservice, baseBranch=release/31.2.X, branch=renovate/release/31.2.X-patch-myapp-parents)
DEBUG: Deleted remote branch: renovate/release/31.2.X-patch-myapp-parents (repository=~didier.loiseau_mycompany.com/myapp-microservice, baseBranch=release/31.2.X, branch=renovate/release/31.2.X-patch-myapp-parents)
DEBUG: Deleted local branch: renovate/release/31.2.X-patch-myapp-parents (repository=~didier.loiseau_mycompany.com/myapp-microservice, baseBranch=release/31.2.X, branch=renovate/release/31.2.X-patch-myapp-parents)
DEBUG: Branch is automerged - returning (repository=~didier.loiseau_mycompany.com/myapp-microservice, baseBranch=release/31.2.X, branch=renovate/release/31.2.X-patch-myapp-parents)
DEBUG: getBranchPr(renovate/develop-patch-myapp-parents) (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: findPr(renovate/develop-patch-myapp-parents, "undefined", "open") (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: getPrList() (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: Found PR #41 (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: getPr(41) (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: getBranchPr(renovate/develop-patch-update-myapp-dependencies) (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: findPr(renovate/develop-patch-update-myapp-dependencies, "undefined", "open") (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: getPrList() (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: Found PR #38 (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: getPr(38) (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: getBranchPr(renovate/develop-major-update-myapp-dependencies) (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: findPr(renovate/develop-major-update-myapp-dependencies, "undefined", "open") (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: getPrList() (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: Found PR #39 (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: getPr(39) (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: getBranchPr(renovate/release/31.2.X-patch-update-myapp-dependencies) (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: findPr(renovate/release/31.2.X-patch-update-myapp-dependencies, "undefined", "open") (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: getPrList() (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: Found PR #40 (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: getPr(40) (repository=~didier.loiseau_mycompany.com/myapp-microservice)
 INFO: Restarting repository job after automerge result (repository=~didier.loiseau_mycompany.com/myapp-microservice)
 INFO: Repository started (repository=~didier.loiseau_mycompany.com/myapp-microservice)
       "renovateVersion": "42.15.0"
DEBUG: Using localDir: /tmp/renovate/repos/bitbucket-server/~didier.loiseau_mycompany.com/myapp-microservice (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: PackageFiles.clear() - Package files deleted (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: initRepo("{
         "repository": "~didier.loiseau_mycompany.com/myapp-microservice"
       }") (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: hostRules: applying Bearer authentication for example.com (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: Using queue: host=example.com, concurrency=16 (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: ~didier.loiseau_mycompany.com/myapp-microservice owner = ~DIDIER.LOISEAU_ARHS-DEV-BE.COM (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: fetchBranchCommits(): url=https://example.com/alm/bitbucket/scm/~didier.loiseau_mycompany.com/myapp-microservice.git (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: Git function thrown (repository=~didier.loiseau_mycompany.com/myapp-microservice)
       "err": {
         "task": {
           "commands": [
             "-c",
             "http.extraHeader=Authorization: Bearer **redacted**",
             "ls-remote",
             "--heads",
             "https://example.com/alm/bitbucket/scm/~didier.loiseau_mycompany.com/myapp-microservice.git"
           ],
           "format": "utf-8",
           "parser": "[function]"
         },
         "message": "fatal: could not read Username for 'https://example.com': No such device or address\n",
         "stack": "Error: fatal: could not read Username for 'https://example.com': No such device or address\n\n    at Object.action (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/plugins/error-detection.plugin.ts:42:29)\n    at PluginStore.exec (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/plugins/plugin-store.ts:54:29)\n    at /home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:124:42\n    at new Promise (<anonymous>)\n    at GitExecutorChain.handleTaskData (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:121:14)\n    at GitExecutorChain.attemptRemoteTask (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:97:40)\n    at processTicksAndRejections (node:internal/process/task_queues:105:5)\n    at GitExecutorChain.attemptTask (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:61:18)"
       }
DEBUG: git error (repository=~didier.loiseau_mycompany.com/myapp-microservice)
       "err": {
         "task": {
           "commands": [
             "-c",
             "http.extraHeader=Authorization: Bearer **redacted**",
             "ls-remote",
             "--heads",
             "https://example.com/alm/bitbucket/scm/~didier.loiseau_mycompany.com/myapp-microservice.git"
           ],
           "format": "utf-8",
           "parser": "[function]"
         },
         "message": "fatal: could not read Username for 'https://example.com': No such device or address\n",
         "stack": "Error: fatal: could not read Username for 'https://example.com': No such device or address\n\n    at Object.action (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/plugins/error-detection.plugin.ts:42:29)\n    at PluginStore.exec (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/plugins/plugin-store.ts:54:29)\n    at /home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:124:42\n    at new Promise (<anonymous>)\n    at GitExecutorChain.handleTaskData (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:121:14)\n    at GitExecutorChain.attemptRemoteTask (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:97:40)\n    at processTicksAndRejections (node:internal/process/task_queues:105:5)\n    at GitExecutorChain.attemptTask (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:61:18)"
       }
DEBUG: Unknown Bitbucket initRepo error (repository=~didier.loiseau_mycompany.com/myapp-microservice)
       "err": {
         "task": {
           "commands": [
             "-c",
             "http.extraHeader=Authorization: Bearer **redacted**",
             "ls-remote",
             "--heads",
             "https://example.com/alm/bitbucket/scm/~didier.loiseau_mycompany.com/myapp-microservice.git"
           ],
           "format": "utf-8",
           "parser": "[function]"
         },
         "message": "fatal: could not read Username for 'https://example.com': No such device or address\n",
         "stack": "Error: fatal: could not read Username for 'https://example.com': No such device or address\n\n    at Object.action (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/plugins/error-detection.plugin.ts:42:29)\n    at PluginStore.exec (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/plugins/plugin-store.ts:54:29)\n    at /home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:124:42\n    at new Promise (<anonymous>)\n    at GitExecutorChain.handleTaskData (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:121:14)\n    at GitExecutorChain.attemptRemoteTask (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:97:40)\n    at processTicksAndRejections (node:internal/process/task_queues:105:5)\n    at GitExecutorChain.attemptTask (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:61:18)"
       }
ERROR: Repository has unknown error (repository=~didier.loiseau_mycompany.com/myapp-microservice)
       "err": {
         "task": {
           "commands": [
             "-c",
             "http.extraHeader=Authorization: Bearer **redacted**",
             "ls-remote",
             "--heads",
             "https://example.com/alm/bitbucket/scm/~didier.loiseau_mycompany.com/myapp-microservice.git"
           ],
           "format": "utf-8",
           "parser": "[function]"
         },
         "message": "fatal: could not read Username for 'https://example.com': No such device or address\n",
         "stack": "Error: fatal: could not read Username for 'https://example.com': No such device or address\n\n    at Object.action (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/plugins/error-detection.plugin.ts:42:29)\n    at PluginStore.exec (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/plugins/plugin-store.ts:54:29)\n    at /home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:124:42\n    at new Promise (<anonymous>)\n    at GitExecutorChain.handleTaskData (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:121:14)\n    at GitExecutorChain.attemptRemoteTask (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:97:40)\n    at processTicksAndRejections (node:internal/process/task_queues:105:5)\n    at GitExecutorChain.attemptTask (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:61:18)"
       }
DEBUG: Unknown res: unknown-error (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: Repository result: unknown-error, status: unknown, enabled: undefined, onboarded: undefined (repository=~didier.loiseau_mycompany.com/myapp-microservice)
ERROR: Repository has unknown error (repository=~didier.loiseau_mycompany.com/myapp-microservice)
       "err": {
         "message": "unknown-error",
         "stack": "Error: unknown-error\n    at renovateRepository (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/renovate/lib/workers/repository/index.ts:103:13)\n    at processTicksAndRejections (node:internal/process/task_queues:105:5)\n    at Object.renovateRepository (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/renovate/lib/workers/repository/index.ts:140:32)\n    at attributes.repository (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/renovate/lib/workers/global/index.ts:188:11)\n    at start (/home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/renovate/lib/workers/global/index.ts:173:7)\n    at /home/jenkins/workspace/MYAPP-4503-renovate-auto-merge/node_modules/renovate/lib/renovate.ts:19:22"
       }
DEBUG: Unknown res: unknown-error (repository=~didier.loiseau_mycompany.com/myapp-microservice)
DEBUG: Repository result: unknown-error, status: unknown, enabled: undefined, onboarded: undefined (repository=~didier.loiseau_mycompany.com/myapp-microservice)

[Churro]

That's presumably because a duplicate Authorization header is sent during ls-remote on the retry after automerge. With username/password, the credentials are in the URL. If you use a token, it is passed as an extra clone option, i.e., git clone -c "http.extraHeader=Authorization: Bearer ...", which is written into .git/config.

Now the issue is that after automerge succeeds (for which it used the credentials from .git/config), the local repo data is still there, so when calling git -c "http.extraHeader=Authorization: Bearer ..." ls-remote the Authorization header is once filled implicitly from .git/config and once explicitly via the -c argument.

Bitbucket then rejects the duplicate header and falls back to username/password auth, which in your case is the credential helper that tries to read from stdin. I guess that the error causes the stored credentials to be removed from the keychain.

To verify this hypothesis, you could copy this cleanup block:

renovate/lib/workers/repository/index.ts

Lines 191 to 197 in 91049f0

	if (localDir && !repoConfig.persistRepoData) {
	try {
	await deleteLocalFile('.');
	} catch (err) /* istanbul ignore if */ {
	logger.warn({ err }, 'localDir deletion error');
	}
	}

directly after the logger.info statement and before the recursive await renovateRepository() call:

renovate/lib/workers/repository/index.ts

Lines 158 to 160 in 91049f0

	if (canRetry) {
	logger.info('Restarting repository job after automerge result');
	const recursiveRes = await renovateRepository(repoConfig, false);

[DidierLoiseau]

Thanks a lot, I can indeed confirm that the proposed change fixes it. Should I report it as bug then, or can this discussion be converted into one?