Closed RyKilleen closed 2 years ago
Huh, that's weird. Sorry, I completely forgot about this. Dependabot has never used its own secrets previously; maybe GitHub changed something there. It runs a GitHub action so should use the same as all the other actions.
Yep, looks like I just need to duplicate the secret values in an additional section in settings. Makes sense from a security perspective. I'll knock this out today when I'm home.
Wonder if it makes sense to move our company certs to org level secrets as well?
FWIW I also submitted a feature request to GitHub to copy secrets into Dependabot or Org levels: https://github.community/t/feature-suggestion-copy-secrets-to-dependabot-secrets-or-org-secrets/263725
@RyKilleen I'm now seeing Dependabot builds running with secrets usage as expected. Going to consider this resolved. 👍
Awesome, thanks for tackling that!
Looks like dependabot no longer has access to secrets.
https://github.blog/changelog/2021-12-09-github-actions-changes-to-permissions-in-workflows-triggered-by-dependabot/