Managing Dependabot on self-hosted runners

About Dependabot on GitHub Actions self-hosted runners

Se você habilitar Dependabot em um novo repositório e tiver GitHub Actions habilitado, o Dependabot será executado em GitHub Actions por padrão.

Se você habilitar Dependabot em um novo repositório e tiver GitHub Actions desabilitado, o Dependabot será executado no aplicativo herdado em GitHub para executar Dependabot updates. Isso não fornece desempenho, visibilidade ou controle tão bom de trabalhos de Dependabot updates quanto GitHub Actions. Se você quiser usar o Dependabot com GitHub Actions, precisará garantir que o repositório habilite GitHub Actions, depois habilitar o "Dependabot on Actions runners" na página de "Code security" do repositório. For more information, see Sobre o Dependabot em executores do GitHub Actions.

You can help users of your organization and repositories to create and maintain secure code by setting up Dependabot security and version updates. With Dependabot updates, developers can configure repositories so that their dependencies are updated and kept secure automatically. Running Dependabot on GitHub Actions allows for better performance, and increased visibility and control of Dependabot jobs.

To have greater control over Dependabot access to your private registries and internal network resources, you can configure Dependabot to run on GitHub Actions self-hosted runners.

For security reasons, when running Dependabot on GitHub Actions self-hosted runners, Dependabot updates will not be run on public repositories.

For more information about configuring Dependabot access to private registries when using GitHub-hosted runners, see Diretrizes para a configuração de registros privados para o Dependabot. For information about which ecosystems are supported as private registries, see Removing Dependabot access to public registries.

Prerequisites

You must have Dependabot installed and enabled, and GitHub Actions enabled and in use. The "Dependabot on GitHub Actions Runners" setting for your organization should also be enabled. For more information, see Sobre o Dependabot em executores do GitHub Actions.

Your organization may have configured a policy to restrict actions and self-hosted runners from running in specific repositories, which in turn will not allow Dependabot to run on GitHub Actions self-hosted runners. In this case, the organization or repository level setting to enable "Dependabot on self-hosted runners" will not be visible in the web UI. For more information, see Desabilitar ou limitar o GitHub Actions para sua organização.

Configuring self-hosted runners for Dependabot updates

After you configure your organization or repository to run Dependabot on GitHub Actions, and before you enable Dependabot on self-hosted runners, you need to configure self-hosted runners for Dependabot updates.

System requirements for Dependabot runners

Qualquer máquina virtual (VM) que você usar para executores de Dependabot deve atender aos requisitos para executores auto-hospedados. Além disso, eles têm de cumprir os seguintes requisitos.

• Sistema operacional Linux

• Arquitetura x64

• Docker instalado com acesso para os usuários do executor:

  • Recomendamos instalar o Docker no modo sem raiz e configurar os executores para acessar o Docker sem privilégios root.
  • Como alternativa, instale o Docker e dê aos usuários do executor privilégios elevados para executar o Docker.

Os requisitos de CPU e memória dependerão do número de executores simultâneos que você implanta em uma determinada VM. Como orientação, criamos de forma bem-sucedida 20 executores em uma única máquina CPU de 8 GB, mas, em última análise, seus requisitos de CPU e memória dependerão fortemente da atualização dos repositórios. Alguns ecossistemas exigirão mais recursos do que outros.

Se você especificar mais de 14 executores simultâneos em uma VM, também precisará atualizar a configuração /etc/docker/daemon.json do Docker para aumentar o número padrão de redes que o Docker pode criar.

{
  "default-address-pools": [
    {"base":"10.10.0.0/16","size":24}
  ]
}

Network requirements for Dependabot runners

Os executores de Dependabot exigem acesso à internet pública, GitHub.com e a todos os registros internos que serão usados nas atualizações do Dependabot updates. Para minimizar o risco para sua rede interna, você deve limitar o acesso da Máquina Virtual (VM) à sua rede interna. Isto reduz o potencial de danos nos sistemas internos se um executor fizer o download de uma dependência capturada.

Você também precisa permitir o tráfego de saída para dependabot-actions.githubapp.com, a fim de impedir a falha dos trabalhos das Dependabot security updates. Para obter mais informações, confira "Sobre executores auto-hospedados".

Certificate configuration for Dependabot runners

If Dependabot needs to interact with registries that use self-signed certificates, those certificates must also be installed on the self-hosted runners that run Dependabot jobs. This security hardens the connection. You must also configure Node.js to use the certificate, because most actions are written in JavaScript and run using Node.js, which does not use the operating system certificate store.

Adding self-hosted runners for Dependabot updates

1. Provision self-hosted runners, at the repository or organization level. For more information, see Sobre executores auto-hospedados and Adicionar executores auto-hospedados.

2. Set up the self-hosted runners with the requirements described above. For example, on a VM running Ubuntu 20.04 you would:

   • Install Docker and ensure that the runner users have access to Docker. For more information, see the Docker documentation.
     • Install Docker Engine on Ubuntu
     • Recommended approach: Run the Docker daemon as a non-root user (Rootless mode)
     • Alternative approach: Manage Docker as a non-root user
   • Verify that the runners have access to the public internet and can only access the internal networks that Dependabot needs.
   • Install any self-signed certificates for registries that Dependabot will need to interact with.

3. Assign a dependabot label to each runner you want Dependabot to use. For more information, see Usar rótulos com os executores auto-hospedados.

4. Optionally, enable workflows triggered by Dependabot to use more than read-only permissions and to have access to any secrets that are normally available. For more information, see Troubleshooting Dependabot on GitHub Actions.

Enabling self-hosted runners for Dependabot updates

Once you have configured self-hosted runners for Dependabot updates, you can enable or disable Dependabot updates on self-hosted runners at the organization or repository level.

Note, disabling and re-enabling the "Dependabot on self-hosted runners" settings will not trigger a new Dependabot run.

Enabling or disabling for your repository

You can manage Dependabot on self-hosted runners for your private repository.

1. Em GitHub, acesse a página principal do repositório.

2. Abaixo do nome do repositório, clique em Configurações. Caso não consiga ver a guia "Configurações", selecione o menu suspenso , clique em Configurações.

   

3. Na seção "Security" da barra lateral, clique em Code security.

4. Under "Dependabot", to the right of "Dependabot on self-hosted runners", click Enable to enable the feature or Disable to disable it.

Enabling or disabling for your organization

You can enable Dependabot on self-hosted runners for all existing private repositories in an organization. Only repositories already configured to run Dependabot on GitHub Actions will be updated to run Dependabot on self-hosted runners the next time a Dependabot job is triggered.

1. No canto superior direito de GitHub, selecione sua foto de perfil e selecione Suas organizações.
2. Ao lado da organização, clique em Configurações.
3. In the "Security" section of the sidebar, click Code security then Global settings.
4. Under "Dependabot", select "Dependabot on self-hosted runners" to enable the feature or deselect to disable it. This action enables or disables the feature for all new repositories in the organization.

For more information, see Configurações de segurança globais para sua organização.