Troubleshooting Dependabot on GitHub Actions

Restrictions when Dependabot triggers events

Dependabot is able to trigger GitHub Actions workflows on its pull requests and comments; however, certain events are treated differently.

For workflows initiated by Dependabot (github.actor == 'dependabot[bot]') using the pull_request, pull_request_review, pull_request_review_comment, push, create, deployment, and deployment_status events, these restrictions apply:

GITHUB_TOKEN has read-only permissions by default.
Secrets are populated from Dependabot secrets. GitHub Actions secrets are not available.

For workflows initiated by Dependabot (github.actor == 'dependabot[bot]') using the pull_request_target event, if the base ref of the pull request was created by Dependabot (github.event.pull_request.user.login == 'dependabot[bot]'), the GITHUB_TOKEN will be read-only and secrets are not available.

These restrictions apply even if the workflow is re-run by a different actor.

For more information, see Keeping your GitHub Actions and workflows secure: Preventing pwn requests.

Troubleshooting failures when Dependabot triggers existing workflows

为你的 GitHub Enterprise Server 实例设置 Dependabot 更新后，当现有工作流由 Dependabot 事件触发时，你可能会看到失败。

默认情况下，由 Dependabot 从 push、pull_request、pull_request_review 或 pull_request_review_comment 事件中触发的 GitHub Actions 工作流运行被视为从存储库分支中打开。与其他参与者触发的工作流不同，这意味着它们会接收一个只读 GITHUB_TOKEN，并且无权访问任何通常可用的机密。这将导致尝试写入仓库的任何工作流程在由 Dependabot 触发时失败。

有三种方法可以解决此问题：

可以更新工作流，使其不再由 Dependabot 使用如下表达式触发：if: github.actor != 'dependabot[bot]'。有关详细信息，请参阅“对工作流和操作中的表达式求值”。
可以修改工作流以使用包含 pull_request_target 的两步过程，该过程没有这些限制。有关详细信息，请参阅“通过 GitHub Actions 自动化 Dependabot”。
可为由 Dependabot 触发的工作流提供对机密的访问权限，并允许 permissions 术语增加 GITHUB_TOKEN 的默认范围。

Some troubleshooting advice is provided in this article. You can also see GitHub Actions 的工作流语法.

Accessing secrets

When a Dependabot event triggers a workflow, the only secrets available to the workflow are Dependabot secrets. GitHub Actions secrets are not available. You must therefore store any secrets that are used by a workflow triggered by Dependabot events as Dependabot secrets. For more information, see 为 Dependabot 配置对专用注册表的访问权限.

Dependabot secrets are added to the secrets context and referenced using exactly the same syntax as secrets for GitHub Actions. For more information, see 在 GitHub Actions 中使用机密.

If you have a workflow that will be triggered by Dependabot and also by other actors, the simplest solution is to store the token with the permissions required in an action and in a Dependabot secret with identical names. Then the workflow can include a single call to these secrets. If the secret for Dependabot has a different name, use conditions to specify the correct secrets for different actors to use.

For examples that use conditions, see 通过 GitHub Actions 自动化 Dependabot.

To access a private container registry on AWS with a user name and password, a workflow must include a secret for username and password.

In this example, when Dependabot triggers the workflow, the Dependabot secrets with the names READONLY_AWS_ACCESS_KEY_ID and READONLY_AWS_ACCESS_KEY are used. If another actor triggers the workflow, the actions secrets with those names are used.

YAML

name: CI
on:
  pull_request:
    branches: [ main ]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Login to private container registry for dependencies
        uses: docker/login-action@3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c
        with:
          registry: https://1234567890.dkr.ecr.us-east-1.amazonaws.com
          username: ${{ secrets.READONLY_AWS_ACCESS_KEY_ID }}
          password: ${{ secrets.READONLY_AWS_ACCESS_KEY }}

      - name: Build the Docker image
        run: docker build . --file Dockerfile --tag my-image-name:$(date +%s)

name: CI
on:
  pull_request:
    branches: [ main ]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Login to private container registry for dependencies
        uses: docker/login-action@3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c
        with:
          registry: https://1234567890.dkr.ecr.us-east-1.amazonaws.com
          username: ${{ secrets.READONLY_AWS_ACCESS_KEY_ID }}
          password: ${{ secrets.READONLY_AWS_ACCESS_KEY }}

      - name: Build the Docker image
        run: docker build . --file Dockerfile --tag my-image-name:$(date +%s)

Changing `GITHUB_TOKEN` permissions

By default, GitHub Actions workflows triggered by Dependabot get a GITHUB_TOKEN with read-only permissions. You can use the permissions key in your workflow to increase the access for the token:

YAML

name: CI
on: pull_request

# Set the access for individual scopes, or use permissions: write-all
permissions:
  pull-requests: write
  issues: write
  repository-projects: write
  ...

jobs:
  ...

name: CI
on: pull_request

# Set the access for individual scopes, or use permissions: write-all
permissions:
  pull-requests: write
  issues: write
  repository-projects: write
  ...

jobs:
  ...

For more information, see 自动令牌身份验证.

Manually re-running a workflow

When you manually re-run a Dependabot workflow, it will run with the same privileges as before even if the user who initiated the rerun has different privileges. For more information, see 重新运行工作流程和作业.