Skip to content

Organization Dependabot Secret

Definition of a Dependabot Secret on organization level, the following properties are supported:

Key Value Description Note
name string The name of the secret
selected_repositories list[string] List of repositories that can use the secret only applicable if visibility is set to selected
value SecretValue The secret value
visibility string Controls which repositories can use the secret public, private or selected

Dependabot secrets are used by Dependabot, e.g. to access private registries, and are the only secrets available to workflows triggered by Dependabot, see Configuring access to private registries for Dependabot. They are managed independently of the Organization Secrets of GitHub Actions: a Dependabot secret and an Actions secret can have the same name and different values.

The value should reference a credential provider instead of being written in clear text, see SecretValue.

Jsonnet Function

orgs.newOrgDependabotSecret('<name>') {
  <key>: <value>
}

Validation rules

  • a name that is not uppercase triggers an error, as GitHub normalizes secret names to uppercase
  • redacted secret values (********) trigger a validation info and will skip the secret during processing
  • specifying a non-empty list of selected_repositories while visibility is not set to selected triggers a warning

Example usage

orgs.newOrg('OtterdogTest') {
  ...
  dependabot_secrets+: [
    orgs.newOrgDependabotSecret('REGISTRY_TOKEN') {
      selected_repositories+: [
        "test-repo"
      ],
      value: "pass:path/to/my/secret/value",
      visibility: "selected",
    },
  ],
  ...
}