Add private NuGet feeds for GitHub-native dependabot in a global setting

[jasonycw]

We've been using dependabot for quite some time through https://app.dependabot.com/

Recently, I'm testing on GitHub native dependabot but I found 1 key feature is missing

On dependabot dashboard, under Config variables, there are options for us to add our own NuGet feed.
We have some NuGet package put under our GitHub Team private feed and by adding the feeds' URL in dependabot dashboard, dependabot-preview can create PR for our private package properly

It seems that there is no such option to add Config variables for the GitHub-native version, is this feature missing or is it hidden somewhere else?

I know we can add ./.github/dependabot.yml to setup the repositories one by one, but we would prefer one global setting like the one in https://app.dependabot.com/accounts/{github}/config-variables

If there is no such option in GitHub-native version, we may need to go back to https://app.dependabot.com/ for now since we don't have time to setup .yml for all of our repos again.

[jurre]

I think you're looking for https://docs.github.com/en/github/administering-a-repository/managing-encrypted-secrets-for-dependabot and https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates#configuration-options-for-private-registries, which landed just last week!

Lmk if I misunderstood

[jasonrudolph]

I think @jurre's reply will resolve this issue, so I'm going to close this out. If this doesn't resolve the issue, please let us know, and we'll follow up. 🙇

[jasonycw]

Hi @jurre and @jasonrudolph thanks for the reference, but it's still not quite the same as what I want.

Instead of just setting a secret and then adding dependabot.yml into each repository one by one, I am looking for a global setting place for managing the GitHub-native dependabot.

There are many global settings under https://app.dependabot.com/accounts/{github}/config-variables and https://app.dependabot.com/accounts/{github}/config-variables which apply to all repositories without the need to manually set it for every single one of them.

With the above settings, all repository managed by dependabot-preview will automatically know the NuGet feeds without me going into each repo and update any dependabot.yml.

If there are some more global config for dependabot under https://github.com/organizations/{github}/settings/security_analysis then that will be much better than the current repository by repository approach.

[jasonrudolph]

Hi @jurre and @jasonrudolph thanks for the reference, but it's still not quite the same as what I want.

Thanks for the clarification, @jasonycw. That does sound useful. ✨ I'm re-opening this issue so that we can track it as a feature request.

[asciimike]

I'm going to close this as a dupe of the more generally requested #3360, since it's the same feature (one registry config per org).

[AraHaan]

Closed it out as a dupe of itself man 😂.

[asciimike]

Ugh, my copy/paste is all wonky today. #3360 is what I meant.

[AraHaan]

Thanks, also for me I use a repository level nuget.config and dependabot seems to respect it as well.

Perhaps the issue creator could use that too? Plus if they use any CI's the CI's would use it as well too so it could be considered a bonus for that option too.

However I do admit, I wish I could set dependabot to check hourly for updates though or even once ever x minutes without having to manually tell it to check.