Dependabot on GitHub Actions

Restrictions when Dependabot triggers events

Dependabot 能够在其拉取请求和评论上触发 GitHub Actions 工作流程；但是，某些事件的处理方式不同。

For workflows initiated by Dependabot (github.actor == 'dependabot[bot]') using the pull_request, pull_request_review, pull_request_review_comment, push, create, deployment, and deployment_status events, these restrictions apply:

• GITHUB_TOKEN has read-only permissions by default.
• Secrets are populated from Dependabot secrets. GitHub Actions secrets are not available.

For workflows initiated by Dependabot (github.actor == 'dependabot[bot]') using the pull_request_target event, if the base ref of the pull request was created by Dependabot (github.event.pull_request.user.login == 'dependabot[bot]'), the GITHUB_TOKEN will be read-only and secrets are not available.

These restrictions apply even if the workflow is re-run by a different actor.

For more information, see Keeping your GitHub Actions and workflows secure: Preventing pwn requests.

Requirements for using Dependabot with self-hosted runners

To generate Dependabot updates using self-hosted runners, you need to properly configure your system, network, and certificates.

System requirements

用于 Dependabot 运行器的任何虚拟机 (VM) 都必须满足自托管运行器的要求。 此外，它们还必须满足以下要求。

• Linux 操作系统

• x64 体系结构

• 安装有运行器用户访问权限的 Docker：

  • 建议在无根模式下安装 Docker，并将运行器配置为在没有 root 特权的情况下访问 Docker。
  • 或者，安装 Docker 并授予运行器用户提升的权限来运行 Docker。

CPU 和内存要求将取决于在给定 VM 上部署的并发运行器的数量。 作为指导，我们已在一台 2 CPU 8GB 的计算机上成功设置了 20 个运行器，但最终，CPU 和内存要求将在很大程度上取决于正在更新的存储库。 某些生态系统需要比其他生态系统更多的资源。

如果在 VM 上指定了 14 个以上的并发运行器，则还必须更新 Docker /etc/docker/daemon.json 配置，以增加 Docker 可以创建的默认网络数。

{
  "default-address-pools": [
    {"base":"10.10.0.0/16","size":24}
  ]
}

Network requirements

Dependabot 运行器需要访问公共互联网、GitHub.com 以及将在 Dependabot updates 更新中使用的任何内部注册表。 为了最大程度地降低内部网络的风险，应该限制虚拟机 (VM) 对内部网络的访问。 如果运行器下载了一个被劫持的依赖项，这将减少内部系统损坏的可能性。

Certificate configuration

If Dependabot needs to interact with registries that use self-signed certificates, those certificates must also be installed on the self-hosted runners that run Dependabot jobs. This security hardens the connection. You must also configure Node.js to use the certificate, because most actions are written in JavaScript and run using Node.js, which does not use the operating system certificate store.