dependabot / dependabot/dependabot-core
Support Dependabot commands by GitHub apps
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Feature description
Whenever a Dependabot command (e.g. `@dependabot rebase`) is filed via a GitHub app (which has write access to the repo) the following error message occurs:
`Sorry, only users with push access can use that command.`
Feature request is to allow GitHub apps with specific permissions to use Dependabot commands.
Currently you have to use a PAT from an existing user which is a security issue.
Contributor guide
Research direction
No files, tests, or entry points are named. Start by locating the Dependabot command authorization path and how GitHub App permissions are represented, then determine the required permission checks and compatibility constraints. Done means authorized GitHub Apps can issue supported Dependabot commands without a user PAT while existing access restrictions remain enforced.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github, ruby
- Domain
- authorization, backend
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100