dependabot / dependabot/dependabot-core
Support for Google Artifact Repository (docker registry) / GCP Workload Identity Federation
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Feature description
Hi!
any plan to add support for Google Artifact Repository (docker registry) ?
it could be great if we can rely on the same integration that we have in Github Action with a token generated through
**GCP Workload Identity Federation work with Github Provider**
**Example for GithubAction**
```
- id: "auth"
name: "Authenticate to Google Cloud"
uses: "google-github-actions/auth@v0"
with:
token_format: access_token
workload_identity_provider: xxx
service_account: xxx
- name: Login to Artifact Registry
uses: docker/login-action@v1
with:
registry: us-central1-docker.pkg.dev
username: oauth2accesstoken
password: ${{ steps.auth.outputs.access_token }}
```
Thanks
Contributor guide
Research direction
No files, tests, or entry points are named in the issue. Start by locating the existing Docker registry authentication integration and any GitHub Actions or GCP credential handling, then determine how Google Artifact Registry and Workload Identity Federation fit together. Done means Dependabot can authenticate and work with the specified Google Artifact Registry flow.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, github-actions, google-cloud
- Domain
- authentication, cloud, devops
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100