Clarify Dependabot is exempt from IP allow list enforcement#44594
Closed
emisanada wants to merge 3 commits into
Closed
Clarify Dependabot is exempt from IP allow list enforcement#44594emisanada wants to merge 3 commits into
emisanada wants to merge 3 commits into
Conversation
Add a warning note that Dependabot runs on standard GitHub-hosted runners may succeed despite an IP allow list being enabled, and that this behavior is not guaranteed or supported. This addresses customer confusion documented in github/enterprise-primitives#5258 where a Dependabot run succeeded on a GitHub-hosted runner while the organization IP allow list was enabled. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github-actions
Bot
added
the
triage
Contributor
How to review these changes 👓Thank you for your contribution. To review these changes, choose one of the following options: A Hubber will need to deploy your changes internally to review. Table of review linksNote: Please update the URL for your staging server or codespace. The table shows the files in the
Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server 🤖 This comment is automatically generated. |
Dependabot is a first-party GitHub App that is explicitly exempt from IP allow list enforcement. Update the docs to accurately reflect this: - Dependabot's own repo access (reading deps, creating PRs) is exempt - Additional workflow steps using GITHUB_TOKEN may still be blocked - Self-hosted/larger runners are only needed for those additional steps Previously the docs implied Dependabot would be blocked entirely by IP allow lists, which does not match the actual implementation. Addresses: github/enterprise-primitives#5258 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
emisanada
changed the title
Dependabot is a first-party GitHub App with explicit IP allow list exemption. Update docs to: - State clearly that Dependabot repo access is exempt from IP allow lists - Remove misleading guidance that self-hosted runners are required - Keep self-hosted/larger runner guidance for other use cases (e.g., accessing private registries behind firewalls) Addresses: github/enterprise-primitives#5258 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
emisanada
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates the Dependabot IP allow list documentation to accurately reflect that Dependabot is a first-party GitHub App whose repository access is exempt from IP allow list restrictions.
Why
The current docs state that customers "must set up a self-hosted runner or enable Dependabot for use with larger runners" when using IP allow lists. This is inaccurate for Dependabot's core operations:
ip_allowlist_exempt: truecapabilityChanges
Rewrites
data/reusables/dependabot/ip-allow-list-dependabot.mdto:What this does NOT cover
The interaction between
GITHUB_TOKENin Dependabot workflow steps and IP allow list enforcement is nuanced and not fully documented here. The Actions app has a different exemption scope (ip_allowlist_exempt_for_internal_apisonly). This PR focuses solely on clarifying Dependabot's own access, which is unambiguously exempt.Affected pages
This reusable appears on: