fix(mix): authenticate hex private repos configured in hostRules (#23901)

lib/modules/manager/mix/__snapshots__/artifacts.spec.ts.snap

 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`modules/manager/mix/artifacts authenticates to private repositories 1`] = `
+exports[`modules/manager/mix/artifacts authenticates to private repositories in updated dependecies 1`] = `
 [
   {
     "file": {
@@ -12,7 +12,7 @@ exports[`modules/manager/mix/artifacts authenticates to private repositories 1`]
 ]
 `;
 
-exports[`modules/manager/mix/artifacts authenticates to private repositories 2`] = `
+exports[`modules/manager/mix/artifacts authenticates to private repositories in updated dependecies 2`] = `
 [
   {
     "cmd": "docker ps --filter name=renovate_sidecar -aq",

lib/modules/manager/mix/artifacts.spec.ts

@@ -31,6 +31,7 @@ describe('modules/manager/mix/artifacts', () => {
   beforeEach(() => {
     jest.resetAllMocks();
     jest.resetModules();
+    hostRules.getAll.mockReturnValue([]);
 
     env.getChildProcessEnv.mockReturnValue(envMock.basic);
     GlobalConfig.set(adminConfig);
@@ -134,7 +135,7 @@ describe('modules/manager/mix/artifacts', () => {
     expect(execSnapshots).toMatchSnapshot();
   });
 
-  it('uses constaints on install mode', async () => {
+  it('uses constraints on install mode', async () => {
     GlobalConfig.set({ ...adminConfig, binarySource: 'install' });
     fs.readLocalFile.mockResolvedValueOnce('Old mix.lock');
     fs.findLocalSiblingOrParent.mockResolvedValueOnce('mix.lock');
@@ -163,7 +164,7 @@ describe('modules/manager/mix/artifacts', () => {
     ]);
   });
 
-  it('authenticates to private repositories', async () => {
+  it('authenticates to private repositories in updated dependecies', async () => {
     jest.spyOn(docker, 'removeDanglingContainers').mockResolvedValueOnce();
     GlobalConfig.set({
       ...adminConfig,
@@ -228,6 +229,64 @@ describe('modules/manager/mix/artifacts', () => {
     );
   });
 
+  it('authenticates to private repositories configured in hostRules', async () => {
+    GlobalConfig.set({ ...adminConfig, binarySource: 'install' });
+    fs.readLocalFile.mockResolvedValueOnce('Old mix.lock');
+    fs.findLocalSiblingOrParent.mockResolvedValueOnce('mix.lock');
+    const execSnapshots = mockExecAll();
+    fs.readLocalFile.mockResolvedValueOnce('New mix.lock');
+    hostRules.getAll.mockReturnValueOnce([
+      { matchHost: 'https://hex.pm/api/repos/an_organization/' },
+      { matchHost: 'https://hex.pm/api/repos/unauthorized_organization/' },
+      { matchHost: 'https://hex.pm/api/repos/does_not_match_org/packages/' },
+      { matchHost: 'https://example.com/api/repos/also_does_not_match_org/' },
+      { matchHost: 'hex.pm' },
+    ]);
+    hostRules.find.mockReturnValueOnce({ token: 'an_organization_token' });
+    hostRules.find.mockReturnValueOnce({}); // unauthorized_organization token missing
+    hostRules.find.mockReturnValueOnce({ token: 'does_not_match_org_token' });
+
+    // erlang
+    getPkgReleases.mockResolvedValueOnce({
+      releases: [
+        { version: '22.3.4.26' },
+        { version: '23.1.1.0' },
+        { version: '24.3.4.1' },
+        { version: '24.3.4.2' },
+        { version: '25.0.0.0' },
+      ],
+    });
+    // elixir
+    getPkgReleases.mockResolvedValueOnce({
+      releases: [
+        { version: 'v1.8.2' },
+        { version: 'v1.13.3' },
+        { version: 'v1.13.4' },
+      ],
+    });
+
+    const result = await updateArtifacts({
+      packageFileName: 'mix.exs',
+      updatedDeps: [{ depName: 'some_package' }],
+      newPackageFileContent: '{}',
+      config,
+    });
+
+    expect(result).toEqual([
+      {
+        file: { type: 'addition', path: 'mix.lock', contents: 'New mix.lock' },
+      },
+    ]);
+    expect(execSnapshots).toMatchObject([
+      { cmd: 'install-tool erlang 25.0.0.0' },
+      { cmd: 'install-tool elixir v1.13.4' },
+      {
+        cmd: 'mix hex.organization auth an_organization --key an_organization_token',
+      },
+      { cmd: 'mix deps.update some_package' },
+    ]);
+  });
+
   it('returns updated mix.lock in subdir', async () => {
     GlobalConfig.set({
       ...adminConfig,

lib/modules/manager/mix/artifacts.ts

@@ -10,10 +10,15 @@ import {
   writeLocalFile,
 } from '../../../util/fs';
 import * as hostRules from '../../../util/host-rules';
+import { regEx } from '../../../util/regex';
 
 import type { UpdateArtifact, UpdateArtifactsResult } from '../types';
 
 const hexRepoUrl = 'https://hex.pm/';
+const hexRepoOrgUrlRegex = regEx(
+  `https://hex\\.pm/api/repos/(?<organization>[a-z0-9_]+)/$`,
+  'g'
+);
 
 export async function updateArtifacts({
   packageFileName,
@@ -51,6 +56,24 @@ export async function updateArtifacts({
 
   const organizations = new Set<string>();
 
+  const hexHostRulesWithMatchHost = hostRules
+    .getAll()
+    .filter(
+      (hostRule) =>
+        !!hostRule.matchHost && hexRepoOrgUrlRegex.test(hostRule.matchHost)
+    );
+
+  for (const { matchHost } of hexHostRulesWithMatchHost) {
+    if (matchHost) {
+      const result = hexRepoOrgUrlRegex.exec(matchHost);
+
+      if (result?.groups) {
+        const { organization } = result.groups;
+        organizations.add(organization);
+      }
+    }
+  }
+
   for (const { packageName } of updatedDeps) {
     if (packageName) {
       const [, organization] = packageName.split(':');