search

dependabot / dependabot-core

🤖 Dependabot's core logic for creating update PRs.
https://docs.github.com/en/code-security/dependabot
MIT License
4.6k stars 972 forks source link

Dependabot access to Azure Artifacts via managed identity #8208

Open ansereb opened 10 months ago

ansereb commented 10 months ago

Is there an existing issue for this?

Feature description

Hi!

Current documention suggest to define Personal Access Token from Azure DevOps in dependabot.yml in order for Dependabot to be able to work with private Azure registries.

However Micrsoft recommends and provides secretless access to Azure resources with help of managed identities and federated credentials. There is github action for worlflows to gain access to ephemeral token of a managed identitiy.

Is there any way to run this action from dependabot.yml or similar approach for dependabot to gain access to ephemeral token of managed identity? It would be good feature to move away from expiring and user-related PATs.

mijpeterson commented 2 months ago

I really want to heavily +1 this feature request. I've spent some time looking at running a custom version of dependabot through dependabot-script with the hope of being able to feed in an ephemeral access token. But configuration for private artifact feed credentials seemed limited/non-existent.

Is anyone on the dependabot team able to provide insight?