dependabot / dependabot/dependabot-core

Fails with `private_source_authentication_failure` for a public repository

Open
#11,686 6 comments 0 reactions 0 assignees View on GitHub
L: docker L: docker:compose L: github:actions T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

Docker

### Package manager version

_No response_

### Language version

_No response_

### Manifest location and content before the Dependabot update

Dockerfile: https://github.com/efasel/fleet-dependabot/blob/main/Dockerfile
```
FROM fleetdm/fleet:v4.64.0
```

### dependabot.yml content

https://github.com/efasel/fleet-dependabot/blob/main/.github/dependabot.yml

```
version: 2

updates:
- package-ecosystem: "docker"
directory: "/"
schedule:
interval: "weekly"
```

### Updated dependency

* from: [v4.64.0](https://hub.docker.com/layers/fleetdm/fleet/v4.64.0/images/sha256-be6d416dc209718f8c4b4328b6704880bb51039a548df09cc40736787e5bf291)
* to: [v4.64.1](https://hub.docker.com/layers/fleetdm/fleet/v4.64.1/images/sha256-7cbd70d03edad1f27221489406440e23e2bde5a7f277952b217d6a378244198a)

### What you expected to see, versus what you actually saw

I expected to get a pull request like "Bump fleetdm/fleet from v4.64.0 to v4.64.1 in /"

Instead the dependabot run failed.

* log of failing dependabot run: https://github.com/efasel/fleet-dependabot/actions/runs/13567189333/job/37922845763

[summary at the end:](https://github.com/efasel/fleet-dependabot/runs/37922845763?check_suite_focus=true#step:3:7233)
```
Dependabot encountered '1' error(s) during execution, please check the logs for more details.
+-------------------------------------------------------+
| Dependencies failed to update |
+---------------+---------------------------------------+
| fleetdm/fleet | private_source_authentication_failure |
+---------------+---------------------------------------+
Failure running container 6a1bf00a7faa552294f48f53af6a72ad7b1d1e5bddbf8d46c3bb5882faeb5efc
Cleaned up container 6a1bf00a7faa552294f48f53af6a72ad7b1d1e5bddbf8d46c3bb5882faeb5efc
proxy | 2025/02/27 13:17:24 1182/3557 calls cached (33%)
proxy | 2025/02/27 13:17:24 Posting metrics to remote API endpoint
proxy | 2025/02/27 13:17:24 Successfully posted metrics data via api client
Error: Dependabot encountered an error performing the update

Error: The updater encountered one or more errors.

For more information see: https://github.com/efasel/fleet-dependabot/network/updates/971624566 (write access to the repository is required to view the log)
🤖 ~ finished: error reported to Dependabot ~
```

### Native package manager behavior

### Images of the diff or a link to the PR, issue, or logs

### Smallest manifest that reproduces the issue

https://github.com/efasel/fleet-dependabot is a repo just to show this behaviour. It only contains this one-line Dockerfile plus the dependabot.yml for Docker.

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure with the linked fleet-dependabot repository, its Dockerfile, and .github/dependabot.yml. Start with the linked Actions run and Dependabot update log, then trace the Docker update path handling fleetdm/fleet and private_source_authentication_failure. Done means the public image updates from v4.64.0 to v4.64.1 and produces the expected pull request.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, ruby
Domain
devops, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.