How to do authentication for private feed when using docker image?

[ghost]

I'm using the docker approach to running dependabot in Azure DevOps. However I have a private feed (Azure DevOps based) and as such dependabot fails:

The following source could not be reached as it requires authentication (and any provided details were invalid or lacked the required permissions): https://pkgs.dev.azure.com/<org>/_packaging/library/nuget/v3/index.json (Dependabot::PrivateSourceAuthenticationFailure)

All the documentation I can find is for running dependabot with a YAML config, however I don't have any YAML config as I'm using docker. Is there any way to make this work via docker, or do I need to rethink my approach completely?

For good measure here's my complete pipeline:

name: 'Dependabot -- $(Date:yyyyMMdd)$(Rev:.r)'

trigger:
  branches:
    include:
    - main
  paths:
    include:
    - src

variables:
  - name: DIRECTORY_PATH
    value: /
  - name: PROJECT_PATH
    value: <org>/<Project>/_git/<Repo> # Contains actual values in my pipeline, I just anonymized it here.
  - name: PULL_REQUESTS_ASSIGNEE
    value: 'Dependabot'

pool:
  vmImage: 'ubuntu-22.04'

steps:
  - script: git clone https://github.com/dependabot/dependabot-script.git
    displayName: Clone Dependabot config repo

  - script: |
          cd dependabot-script
          docker build -t "dependabot/dependabot-script" -f Dockerfile .

  - script: |
          docker run --rm -e AZURE_ACCESS_TOKEN=$(System.AccessToken) \
                          -e PACKAGE_MANAGER='nuget' \
                          -e PROJECT_PATH='$(PROJECT_PATH)' \
                          -e DIRECTORY_PATH='$(DIRECTORY_PATH)' \
                          -e BRANCH='main' \
                          dependabot/dependabot-script

[mettolen]

Its a workaround, but works for me. You probably have nuget.config in you DIRECTORY_PATH that points to private repo. If you move nuget.config out from DIRECTORY_PATH, Dependabot will resort to checking package versions from nuget.org instead. It wont pump packages that are only available in you private repo, but it will pump everything available in nuget.org.

[cmorinupgrade]

@stsenvidan have you been successful with this?

[ghost]

@cmorinupgrade sadly no, I tried the workaround approach mentioned by mettolen, but I kept getting different path related errors that way. So for the time being I've put the whole thing on hold :-/

[sachip-msft]

Is there any solution, can someone share I am facing same issue.