bjornrud
Has anyone used the github actions hosted dependabot beta for private hex repositories? We would love dependabot to notify application owners in our org when another team updates their libraries.
Unfortunately, am getting 403s every time dependabot attempts to check our private hex.
From the logs, Dependabot is showing the following:
proxy | 2020/07/13 16:25:22 403 https://repo.hex.pm:443/repos/us/packages/ourpackage
The relevant portions of our .github/dependabot.yml are:
version: 2
updates:
# Keep mix dependencies up to date
- package-ecosystem: "mix"
directory: "/"
schedule:
interval: "weekly"
assignees:
- "OURORG/ourteam"
labels:
- "dependabot-update"
rebase-strategy: "disabled"
Where Next?
Trending in Questions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Practical resources that improve the lives of professional developers.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #blog-post
- #ai
- #phoenix_html
- #iex
- #elixirconf-us
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Producing high quality Elixir screencasts since 2017.
Enabling companies to succeed by building software people love.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 5- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
davydog187
I’m running into the same issue. I can see that there is support for private hex repos, but since Dependabot moved to Github, its unclear what I need to do to grant it access.
Did you end up figuring this issue out @bjornrud ?
sorentwo
Private hex repos used to work before Dependabot moved to GitHub. Now it appears they have added private access for a variety of package managers, but not Elixir
davydog187
I poked Bruce Williams on twitter, maybe he knows who can help!
https://twitter.com/davydog187/status/1363852667467010053
sorentwo
Excellent. I hopped onto the Twitter thread!
davydog187
An update from @bruce
Tweet: https://twitter.com/wbruce/status/1364004498667040769?s=20
Roadmap: Dependabot version updates: support for private registries (Cloud Beta) · Issue #67 · github/roadmap · GitHub
TL;DR: Private registries are currently not available for dependabot with elixir, but are scheduled on the roadmap