How to provide GitHub and Azure DevOps Token? #1509
Answered
by
rhyskoedijk
mikeKuester
asked this question in
Q&A
-
|
Hello, I'm a bit confused how to provide the tokens? I have a .NET 8 solution in a private organization and only packages from nuget.org. I started with dependabot-script and got this "partially" working. I wasn't able to limit the updates to security updates (seems to ignore my dependabot.yml and so on). But before digging deeper, I found this project here, installed the Marketplace Extension and create the mentioned pipeline: trigger:
- main
pool:
vmImage: ubuntu-latest
steps:
- task: dependabot@2I was wondering, that no tokens seems to be required, but I run the pipeline and was happy as it says: Success ... But, after opening the result, I saw that it has two errors:
In the readme.md I found only examples with tokens for private registries. Do I have to provide a GitHub and / or an Azure DevOps Access Token? Like with the dependabot-script? How? Full log |
Beta Was this translation helpful? Give feedback.
Answered by
rhyskoedijk
Dec 9, 2024
Replies: 1 comment 3 replies
-
|
@mikeKuester have a look at the task parameters documentation if you haven't already, it covers the token parameters you're looking for. Example using service connections: - task: dependabot@2
inputs:
azureDevOpsServiceConnection: 'Dependabot DevOps User'
gitHubConnection: 'Dependabot GitHub User'Example using access tokens: - task: dependabot@2
inputs:
azureDevOpsAccessToken: $(MY_SECRET_DEVOPS_TOKEN)
gitHubAccessToken: $(MY_SECRET_GITHUB_TOKEN)Regarding the error in your logs, it looks like a |
Beta Was this translation helpful? Give feedback.
3 replies
-
|
Hello @rhyskoedijk, 😯 sorry, shame on me. I searched hours for a solution with the other project and ... With the access tokens and the right path it works! Thank you. My .NET solution file is in the subfolder "DepenabotTestApp", so I have to use this setting: version: 2
updates:
- package-ecosystem: "nuget"
directory: "/DepenabotTestApp"
# only security updates
open-pull-requests-limit: 0The created pull requests leads me to a bug (character encoding in the PR message) and a question (this script updates the vulnerable package SharpZipLib to 1.3.3. and the dependabot-script to 1.4.2). I'll create an issue for the bug and try to search a bit, before creating a new question here. |
Beta Was this translation helpful? Give feedback.
-
|
Ok, I found the reason for different package version:
If I remove the limiting to the security updates ( |
Beta Was this translation helpful? Give feedback.
-
|
If you think there might be a problem with the selected version for the update, feel free to log an issue with the relevant logs from the update and we can investigate further. thanks |
Beta Was this translation helpful? Give feedback.
Answer selected by
mikeKuester
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
@mikeKuester have a look at the task parameters documentation if you haven't already, it covers the token parameters you're looking for.
Example using service connections:
Example using access tokens:
Regarding the error in your logs, it looks like a
dependabot.ymlmisconfiguration to me; Dependabot could not find any .NET solution or project files in the dire…