dependabot / dependabot/dependabot-core

Support for Google Artifact Repository (docker registry) / GCP Workload Identity Federation

Open
#5,836 5 comments 37 reactions 0 assignees View on GitHub
F: configuration-file F: private-registries 💂‍♂️ L: docker T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Feature description

Hi!

any plan to add support for Google Artifact Repository (docker registry) ?

it could be great if we can rely on the same integration that we have in Github Action with a token generated through
**GCP Workload Identity Federation work with Github Provider**

**Example for GithubAction**
```
- id: "auth"
name: "Authenticate to Google Cloud"
uses: "google-github-actions/auth@v0"
with:
token_format: access_token
workload_identity_provider: xxx
service_account: xxx

- name: Login to Artifact Registry
uses: docker/login-action@v1
with:
registry: us-central1-docker.pkg.dev
username: oauth2accesstoken
password: ${{ steps.auth.outputs.access_token }}
```

Thanks

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are named in the issue. Start by locating the existing Docker registry authentication integration and any GitHub Actions or GCP credential handling, then determine how Google Artifact Registry and Workload Identity Federation fit together. Done means Dependabot can authenticate and work with the specified Google Artifact Registry flow.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, github-actions, google-cloud
Domain
authentication, cloud, devops
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.