config.yml: registries

The file

registries is a map keyed by a name you choose, exactly like a Dependabot registries block, so an existing Dependabot configuration can be reused almost verbatim.

Registry fields

Credentials

Secrets are never written into the file. username and password take ${{ENV_VAR}} references, resolved from the environment when Argus loads the config. A literal (non-reference) password is rejected outright, and a reference to a variable that is not set is a hard error rather than a silent fall-back to anonymous access. The resolved values are used only for HTTP Basic auth and are never logged: an authentication failure reports the status code, never the secret.

References can also resolve from a secret manager rather than the environment, for example password: ${{secret:artifactory-password}} from AWS Secrets Manager. See Secrets.

Multiple registries

List as many registries as you need. For each coordinate, Argus queries every registry that should serve it: a replaces-base: true virtual repository is queried for everything, and an includes list restricts a registry to matching groupId prefixes. The version lists are unioned. A registry that does not have the artifact returns a 404 and is skipped, so a generous set of registries is safe. Every request goes to your own hosts, so internal coordinates never reach the public internet.

What Argus reads

Version existence checks are one HTTP GET per registry per coordinate, and the thing fetched is not a vendor API. It is the same static file Maven itself maintains:

<url>/<groupId with dots as slashes>/<artifactId>/maven-metadata.xml

For org.springframework.security:spring-security-bom against a registry whose url is https://nexus.acme.internal/repository/maven-public, the request is https://nexus.acme.internal/repository/maven-public/org/springframework/security/spring-security-bom/maven-metadata.xml. Argus parses only the <versioning><versions> list from the body. It does not trust the <latest>/<release> hints, and it never calls a registry’s search or REST API. Any Maven-layout repository works: Nexus, Artifactory, or a plain web server over a directory.

Response handling, which is what you need when troubleshooting: 200 is parsed (responses are capped at 8 MB); 404 means the coordinate is simply not in that registry, recorded as artifact not present, not an error; 401/403 is a credentials problem and fails discovery with the status only (credentials are never echoed); 5xx and network errors are retried twice with short backoff, then reported. Requests send Basic auth when the registry has credentials configured. Listings are cached per coordinate for the run and unioned across registries; pre-release versions are filtered out of the union.

The practical consequence: any discovery question can be reproduced with curl. Take the metadata URL from the log line (or build it by hand as above), add -u user:token if the registry needs it, and you are seeing exactly what Argus saw: same file, same status. When the question is “why do my registries disagree”, the registry-audit/*.json files contain each registry’s answer side by side, with an inSync/behind verdict. They are written on every run that has couplings configured, one file per coordinate the couplings name.

Verifying discovery

To confirm a multi-registry setup is actually working, Argus logs what it found for every coordinate it looks up during anchor upgrades. Each registry it queries produces one of two lines, registry searched: versions found (with the registry id, the metadata URL, and the actual versions returned) or registry searched: artifact not present, followed by a registry version discovery complete summary across all registries. This is how you tell a working integration (versions coming back) from a misconfigured one (every registry reporting not present, or a registry metadata fetch failed warning).

These lines are written at info level to the anchor log (anchor.log by default, kept as a job artifact), so they are available without extra configuration. Set ARGUS_LOG_LEVEL=debug to additionally surface per-fetch detail: the exact URL before each request, retries, cache hits, and which registries were skipped for not serving a groupId. Credentials are never logged; an authentication failure reports only the HTTP status. See Environment variables.

When it is used

Registry discovery powers anchor upgrades. When a config.yml with registries is present, Argus uses it for registry-backed discovery. If the file carries only libraries/couplings policy and no registries, version discovery still falls back to Maven while remediation policy comes from the same config file.