dependabot / dependabot/dependabot-core
Dependabot access to Azure Artifacts via managed identity
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Feature description
Hi!
[Current documention](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/guidance-for-the-configuration-of-private-registries-for-dependabot#azure-artifacts) suggest to define Personal Access Token from Azure DevOps in dependabot.yml in order for Dependabot to be able to work with private Azure registries.
However Micrsoft recommends and [provides secretless access](https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-portal%2Cwindows) to Azure resources with help of managed identities and federated credentials. There is [github action](https://github.com/marketplace/actions/azure-login) for worlflows to gain access to ephemeral token of a managed identitiy.
Is there any way to run this action from dependabot.yml or similar approach for dependabot to gain access to ephemeral token of managed identity? It would be good feature to move away from expiring and user-related PATs.
Contributor guide
Research direction
Start with the Azure Artifacts section of the Dependabot documentation and the dependabot.yml configuration path described in the issue. Compare the proposed Azure Login action and managed-identity flow with Dependabot's existing private-registry authentication, then define what configuration and token handoff would be needed for PAT-free access and document the supported behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, github-actions
- Domain
- authentication, cloud, devops
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100