dependabot / dependabot/dependabot-core

Dependabot access to Azure Artifacts via managed identity

Open
#8,208 3 comments 17 reactions 0 assignees View on GitHub
T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Feature description

Hi!

[Current documention](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/guidance-for-the-configuration-of-private-registries-for-dependabot#azure-artifacts) suggest to define Personal Access Token from Azure DevOps in dependabot.yml in order for Dependabot to be able to work with private Azure registries.

However Micrsoft recommends and [provides secretless access](https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-portal%2Cwindows) to Azure resources with help of managed identities and federated credentials. There is [github action](https://github.com/marketplace/actions/azure-login) for worlflows to gain access to ephemeral token of a managed identitiy.

Is there any way to run this action from dependabot.yml or similar approach for dependabot to gain access to ephemeral token of managed identity? It would be good feature to move away from expiring and user-related PATs.

Contributor guide

Open the contributing guide

Research direction

Start with the Azure Artifacts section of the Dependabot documentation and the dependabot.yml configuration path described in the issue. Compare the proposed Azure Login action and managed-identity flow with Dependabot's existing private-registry authentication, then define what configuration and token handoff would be needed for PAT-free access and document the supported behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, github-actions
Domain
authentication, cloud, devops
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.