Skip to main content
我们经常发布文档更新，此页面的翻译可能仍在进行中。有关最新信息，请访问英语文档。
 

 

Managing encrypted secrets for Dependabot

本文内容

You can store sensitive information, like passwords and access tokens, as encrypted secrets and then reference these in the Dependabot configuration file.

Note: Dependabot security and version updates are currently in public beta and subject to change.

About encrypted secrets for Dependabot

Dependabot secrets are encrypted credentials that you create at either the organization level or the repository level. When you add a secret at the organization level, you can specify which repositories can access the secret. You can use secrets to allow Dependabot to update dependencies located in private package registries. When you add a secret it's encrypted before it reaches GitHub and it remains encrypted until it's used by Dependabot to access a private package registry.

After you add a Dependabot secret, you can reference it in the dependabot.yml configuration file like this: ${{secrets.NAME}}, where "NAME" is the name you chose for the secret. For example: 

password: ${{secrets.MY_ARTIFACTORY_PASSWORD}}

For more information, see "Configuration options for the dependabot.yml file."

Naming your secrets

The name of a Dependabot secret:

  • Can only contain alphanumeric characters ([A-Z], [0-9]) or underscores (_). Spaces are not allowed. If you enter lowercase letters these are changed to uppercase.
  • Must not start with the GITHUB_ prefix.
  • Must not start with a number.

Adding a repository secret for Dependabot

要为个人帐户存储库创建机密，你必须是存储库所有者。 要为组织存储库创建密码，必须具有 admin 访问权限。

  1. 在 your GitHub Enterprise Server instance 上，导航到存储库的主页。

  2. 在存储库名称下，单击 “设置”。 “存储库设置”按钮

  3. In the sidebar, click Dependabot. Dependabot secrets sidebar option

  4. Click New repository secret.

  5. Type a name for your secret in the Name input box.

  6. Enter the value for your secret.

  7. Click Add secret.

    The name of the secret is listed on the Dependabot secrets page. You can click Update to change the secret value. You can click Remove to delete the secret.

    Update or remove a repository secret

Adding an organization secret for Dependabot

When creating a secret in an organization, you can use a policy to limit which repositories can access that secret. For example, you can grant access to all repositories, or limit access to only private repositories or a specified list of repositories.

要在组织级别创建机密，必须具有 admin 访问权限。

  1. 在 your GitHub Enterprise Server instance 上，导航到组织的主页。

  2. 在组织名称下，单击“设置”。 组织设置按钮

  3. In the sidebar, click Dependabot. Dependabot secrets sidebar option

  4. Click New organization secret.

  5. Type a name for your secret in the Name input box.

  6. Enter the Value for your secret.

  7. From the Repository access dropdown list, choose an access policy.

  8. If you chose Selected repositories:

    • Click .
    • Choose the repositories that can access this secret. Select repositories for this secret
    • Click Update selection.

  9. Click Add secret.

    The name of the secret is listed on the Dependabot secrets page. You can click Update to change the secret value or its access policy. You can click Remove to delete the secret.

    Update or remove an organization secret

Adding Dependabot to your registries IP allow list

If your private registry is configured with an IP allow list, you can find the IP addresses Dependabot uses to access the registry in the meta API endpoint, under the dependabot key. For more information, see "Meta."