Repository Dependabot Secret

Definition of a Dependabot Secret on repository level, the following properties are supported:

Dependabot secrets are used by Dependabot, e.g. to access private registries, and are the only secrets available to workflows triggered by Dependabot, see Configuring access to private registries for Dependabot. They are managed independently of the Repository Secrets of GitHub Actions: a Dependabot secret and an Actions secret can have the same name and different values.

The value should reference a credential provider instead of being written in clear text, see SecretValue.

Jsonnet Function¶

orgs.newRepoDependabotSecret('<name>') {
  <key>: <value>
}

Validation rules¶

• a name that is not uppercase triggers an error, as GitHub normalizes secret names to uppercase
• redacted secret values (********) trigger a validation info and will skip the secret during processing

Example usage¶

orgs.newOrg('OtterdogTest') {
  ...
  _repositories+:: [
    ...
    orgs.newRepo('test-repo') {
      ...
      dependabot_secrets+: [
        orgs.newRepoDependabotSecret('REGISTRY_TOKEN') {
          value: "pass:path/to/secret",
        },
      ],
    }
  ]
}