Skip to content

Commit 9eccffe

Browse files
hubwritershati-patelasciimikejasonrudolph
authored
[March 15] Dependabot version updates support for private registries (#17985)
* Update the UI for allowing private repos * Private reg support WiP * More WiP for private reg support * Apply review comment about internal repos * Add Dependabot secrets article plus details of allowing remote code execution * Add link to private registries info * Fix conflict on PR * Add 'private_source_*' errors to troubleshooting * Update content/github/administering-a-repository/configuration-options-for-dependency-updates.md Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> * Update content/github/administering-a-repository/managing-encrypted-secrets-for-dependabot.md Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> * Update content/github/administering-a-repository/managing-encrypted-secrets-for-dependabot.md Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> * Update content/github/administering-a-repository/managing-encrypted-secrets-for-dependabot.md Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> * Update content/github/administering-a-repository/managing-encrypted-secrets-for-dependabot.md Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> * Update content/github/setting-up-and-managing-organizations-and-teams/managing-security-and-analysis-settings-for-your-organization.md Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> * Update data/reusables/dependabot/private-dependencies-note.md Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> * Update data/reusables/dependabot/supported-package-managers.md Co-authored-by: Mike McDonald <2575327+asciimike@users.noreply.github.com> * Update content/github/administering-a-repository/configuration-options-for-dependency-updates.md Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> * Update content/github/administering-a-repository/configuration-options-for-dependency-updates.md Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> * Update content/github/administering-a-repository/configuration-options-for-dependency-updates.md Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> * Update content/github/administering-a-repository/configuration-options-for-dependency-updates.md Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> * Update content/github/administering-a-repository/configuration-options-for-dependency-updates.md Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> * Update content/github/administering-a-repository/configuration-options-for-dependency-updates.md Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> * Update content/github/administering-a-repository/configuration-options-for-dependency-updates.md Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> * Update content/github/administering-a-repository/configuration-options-for-dependency-updates.md Co-authored-by: Mike McDonald <2575327+asciimike@users.noreply.github.com> * Update content/github/administering-a-repository/configuration-options-for-dependency-updates.md Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> * Update content/github/administering-a-repository/managing-encrypted-secrets-for-dependabot.md Co-authored-by: Jason Rudolph <jason@jasonrudolph.com> * Update content/github/administering-a-repository/configuration-options-for-dependency-updates.md Co-authored-by: Mike McDonald <2575327+asciimike@users.noreply.github.com> * Update content/github/administering-a-repository/configuration-options-for-dependency-updates.md Co-authored-by: Mike McDonald <2575327+asciimike@users.noreply.github.com> * Move registries section below updates as requested by reviewer. * Correct heading level of 'allow' subheading Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com> Co-authored-by: Mike McDonald <2575327+asciimike@users.noreply.github.com> Co-authored-by: Jason Rudolph <jason@jasonrudolph.com>
1 parent 83f1e3a commit 9eccffe

14 files changed

Lines changed: 442 additions & 67 deletions

‎assets/images/help/dependabot/dependabot-secrets.png‎

36.1 KB
Loading

‎assets/images/help/dependabot/secret-repository-access.png‎

107 KB
Loading

‎assets/images/help/dependabot/update-remove-org-secret.png‎

36.7 KB
Loading

‎assets/images/help/dependabot/update-remove-repo-secret.png‎

45.9 KB
Loading

‎content/github/administering-a-repository/about-dependabot-version-updates.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,9 @@ You can configure version updates for repositories that contain a dependency man
4040

4141
{% note %}
4242

43-
{% data reusables.dependabot.private-dependencies-note %} Additionally, {% data variables.product.prodname_dependabot %} doesn't support private {% data variables.product.prodname_dotcom %} dependencies for all package managers. See the details in the table below.
43+
{% data reusables.dependabot.private-dependencies-note %}
44+
45+
{% data variables.product.prodname_dependabot %} doesn't support private {% data variables.product.prodname_dotcom %} dependencies for all package managers. See the details in the table below.
4446

4547
{% endnote %}
4648

‎content/github/administering-a-repository/configuration-options-for-dependency-updates.md‎

Lines changed: 316 additions & 34 deletions
Large diffs are not rendered by default.

‎content/github/administering-a-repository/enabling-and-disabling-version-updates.md‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,12 @@ You enable {% data variables.product.prodname_dependabot_version_updates %} by c
1818

1919
### Enabling {% data variables.product.prodname_dependabot_version_updates %}
2020

21-
{% data reusables.dependabot.create-dependabot-yml %}
22-
1. Use `package-ecosystem` to specify the package managers to monitor.
21+
{% data reusables.dependabot.create-dependabot-yml %} For information, see "[Configuration options for dependency updates](/github/administering-a-repository/configuration-options-for-dependency-updates)."
22+
1. Add a `version`.
23+
1. Optionally, if you have dependencies in a private registry, add a `registries` section containing authentication details.
24+
1. Add an `updates` section, with an entry for each package manager you want {% data variables.product.prodname_dependabot %} to monitor.
2325
1. For each package manager, use:
26+
- `package-ecosystem` to specify the package manager.
2427
- `directory` to specify the location of the manifest or other definition files.
2528
- `schedule.interval` to specify how often to check for new versions.
2629
{% data reusables.dependabot.check-in-dependabot-yml %}

‎content/github/administering-a-repository/index.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ versions:
6464
{% link_in_list /enabling-and-disabling-version-updates %}
6565
{% link_in_list /listing-dependencies-configured-for-version-updates %}
6666
{% link_in_list /managing-pull-requests-for-dependency-updates %}
67+
{% link_in_list /managing-encrypted-secrets-for-dependabot %}
6768
{% link_in_list /customizing-dependency-updates %}
6869
{% link_in_list /configuration-options-for-dependency-updates %}
6970
{% link_in_list /keeping-your-actions-up-to-date-with-dependabot %}

‎content/github/administering-a-repository/managing-encrypted-secrets-for-dependabot.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
title: Managing encrypted secrets for Dependabot
3+
intro: You can store sensitive information, like passwords and access tokens, as encrypted secrets and then reference these in the {% data variables.product.prodname_dependabot %} configuration file.
4+
versions:
5+
free-pro-team: '*'
6+
---
7+
8+
### About encrypted secrets for {% data variables.product.prodname_dependabot %}
9+
10+
{% data variables.product.prodname_dependabot %} secrets are encrypted credentials that you create at either the organization level or the repository level.
11+
When you add a secret at the organization level, you can specify which repositories can access the secret. You can use secrets to allow {% data variables.product.prodname_dependabot %} to update dependencies located in private package registries. When you add a secret it's encrypted before it reaches {% data variables.product.prodname_dotcom %} and it remains encrypted until it's used by {% data variables.product.prodname_dependabot %} to access a private package registry.
12+
13+
After you add a {% data variables.product.prodname_dependabot %} secret, you can reference it in the _dependabot.yml_ configuration file like this: {% raw %}`${{secrets.NAME}}`{% endraw %}, where "NAME" is the name you chose for the secret. For example:
14+
15+
{% raw %}
16+
```yaml
17+
password: ${{secrets.MY_ARTIFACTORY_PASSWORD}}
18+
```
19+
{% endraw %}
20+
21+
For more information, see "[Configuration options for dependency updates](/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-private-registries)."
22+
23+
#### Naming your secrets
24+
25+
The name of a {% data variables.product.prodname_dependabot %} secret:
26+
* Can only contain alphanumeric characters (`[A-Z]`, `[0-9]`) or underscores (`_`). Spaces are not allowed. If you enter lowercase letters these are changed to uppercase.
27+
* Must not start with the `GITHUB_` prefix.
28+
* Must not start with a number.
29+
30+
### Adding a repository secret for {% data variables.product.prodname_dependabot %}
31+
32+
{% data reusables.github-actions.permissions-statement-secrets-repository %}
33+
34+
{% data reusables.repositories.navigate-to-repo %}
35+
{% data reusables.repositories.sidebar-settings %}
36+
{% data reusables.github-actions.sidebar-secret %}
37+
{% data reusables.dependabot.dependabot-secrets-button %}
38+
1. Click **New repository secret**.
39+
1. Type a name for your secret in the **Name** input box.
40+
1. Enter the value for your secret.
41+
1. Click **Add secret**.
42+
43+
The name of the secret is listed on the Dependabot secrets page. You can click **Update** to change the secret value. You can click **Remove** to delete the secret.
44+
45+
![Update or remove a repository secret](/assets/images/help/dependabot/update-remove-repo-secret.png)
46+
47+
### Adding an organization secret for {% data variables.product.prodname_dependabot %}
48+
49+
When creating a secret in an organization, you can use a policy to limit which repositories can access that secret. For example, you can grant access to all repositories, or limit access to only private repositories or a specified list of repositories.
50+
51+
{% data reusables.github-actions.permissions-statement-secrets-organization %}
52+
53+
{% data reusables.organizations.navigate-to-org %}
54+
{% data reusables.organizations.org_settings %}
55+
{% data reusables.github-actions.sidebar-secret %}
56+
{% data reusables.dependabot.dependabot-secrets-button %}
57+
1. Click **New organization secret**.
58+
1. Type a name for your secret in the **Name** input box.
59+
1. Enter the **Value** for your secret.
60+
1. From the **Repository access** dropdown list, choose an access policy.
61+
1. If you chose **Selected repositories**:
62+
63+
* Click {% octicon "gear" aria-label="The Gear icon" %}.
64+
* Choose the repositories that can access this secret.
65+
![Select repositories for this secret](/assets/images/help/dependabot/secret-repository-access.png)
66+
* Click **Update selection**.
67+
68+
1. Click **Add secret**.
69+
70+
The name of the secret is listed on the Dependabot secrets page. You can click **Update** to change the secret value or its access policy. You can click **Remove** to delete the secret.
71+
72+
![Update or remove an organization secret](/assets/images/help/dependabot/update-remove-repo-secret.png)

‎content/github/managing-security-vulnerabilities/troubleshooting-dependabot-errors.md‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,9 +76,20 @@ There are separate limits for security and version update pull requests, so that
7676

7777
The best way to resolve this error is to merge or close some of the existing pull requests and trigger a new pull request manually. For more information, see "[Triggering a {% data variables.product.prodname_dependabot %} pull request manually](#triggering-a-dependabot-pull-request-manually)."
7878

79-
#### {% data variables.product.prodname_dependabot %} can't resolve your dependency files
79+
#### {% data variables.product.prodname_dependabot %} can't resolve or access your dependencies
8080

81-
If {% data variables.product.prodname_dependabot %} attempts to check whether dependency references need to be updated in a repository, but can't access one or more of the referenced files, the operation will fail with the error message "{% data variables.product.prodname_dependabot %} can't resolve your LANGUAGE dependency files." The API error type is `git_dependencies_not_reachable`.
81+
If {% data variables.product.prodname_dependabot %} attempts to check whether dependency references need to be updated in a repository, but can't access one or more of the referenced files, the operation will fail with the error message "{% data variables.product.prodname_dependabot %} can't resolve your LANGUAGE dependency files." The API error type is `git_dependencies_not_reachable`.
82+
83+
Similarly, if {% data variables.product.prodname_dependabot %} can't access a private package registry in which a dependency is located, one of the following errors is generated:
84+
85+
* "Dependabot can't reach a dependency in a private package registry"<br>
86+
(API error type: `private_source_not_reachable`)
87+
* "Dependabot can't authenticate to a private package registry"<br>
88+
(API error type:`private_source_authentication_failure`)
89+
* "Dependabot timed out while waiting for a private package registry"<br>
90+
(API error type:`private_source_timed_out`)
91+
* "Dependabot couldn't validate the certificate for a private package registry"<br>
92+
(API error type:`private_source_certificate_failure`)
8293

8394
To allow {% data variables.product.prodname_dependabot %} to update the dependency references successfully, make sure that all of the referenced dependencies are hosted at accessible locations.
8495

0 commit comments

Comments
 (0)