dependabot / dependabot/dependabot-core

Support Dependabot commands by GitHub apps

Open
#9,147 6 comments 18 reactions 0 assignees View on GitHub
T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Feature description

Whenever a Dependabot command (e.g. `@dependabot rebase`) is filed via a GitHub app (which has write access to the repo) the following error message occurs:
`Sorry, only users with push access can use that command.`

Feature request is to allow GitHub apps with specific permissions to use Dependabot commands.

Currently you have to use a PAT from an existing user which is a security issue.

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are named. Start by locating the Dependabot command authorization path and how GitHub App permissions are represented, then determine the required permission checks and compatibility constraints. Done means authorized GitHub Apps can issue supported Dependabot commands without a user PAT while existing access restrictions remain enforced.

Written by the indexing model from the issue text.

Assessment

Tech stack
github, ruby
Domain
authorization, backend
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.