-
Notifications
You must be signed in to change notification settings - Fork 61k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fixing Azure DevOps NuGet Dependabot config examples #20617
Conversation
Automatically generated comment ℹ️This comment is automatically generated and will be overwritten every time changes are committed to this branch. The table contains an overview of files in the Content directory changesYou may find it useful to copy this table into the pull request summary. There you can edit it to share links to important articles or changes and to give a high-level overview of how the changes in your pull request support the overall goals of the pull request.
fpt: Free, Pro, Team |
If we still wanted to show a
|
👋 @joshjohanning Thanks for opening a PR! I'll get it triaged! ⚡ |
We may want to see how hard it is to simply get the underlying issue fixed, IMO that'd be better from a security perspective than switching away from tokens: Not sure how hard that is though, I'll take a look... |
I agree that the best solution is probably to have that bug fixed... But I'm not sure if it makes any difference from a security perspective, at least in the Azure DevOps example, since Azure DevOps is going to be a Personal Access Token regardless of whether we're able to use FWIW, msft docs reference using a username and password to auth to Azure Artifacts, for example, which uses a PAT for the password (and coincidentally, the username field can be anything). But right now us showing Azure DevOps examples that don't work is not ideal. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the update
Thanks very much for contributing! Your pull request has been merged 🎉 You should see your changes appear on the site in approximately 24 hours. If you're looking for your next contribution, check out our help wanted issues ⚡ |
Sorry for the slow response @joshjohanning, I looked into this more and what you say makes complete sense. Especially:
I didn't realize they accepted the PAT either way. Thanks again for this! |
Woot woot! Thanks @jeffwidman |
Why:
The documentation as is doesn't work with using
token: ${{secrets.MY_AZURE_DEVOPS_TOKEN}}
You receive a 401 error in the Dependabot logs, as shown below:
Others have had this issue, mentioned here: dependabot/dependabot-core#3555
One of the solutions as to add a
:
somewhere in thetoken
to force it to use basic auth, like this:But instead,
username
andpassword
is a cleaner and more consistent solution since that what the other examples right above it are using:For tracking purposes, I mistakenly created this as a PR in my repo in March, but I have verified that this is still an issue today. joshjohanning#53
What's being changed:
On the Dependabot version updates configuration page, changing the Azure DevOps examples to use
username
andpassword
instead oftoken
.There are two instances of an Azure DevOps Artifact feed being used, and in both cases, it uses the
token
property to authenticate. However, that doesn't work. In lieu of thetoken
property being fixed to not have to manually include a:
somewhere in the token property for it to use basic auth to be able to connect, we should just useusername
andpassword
using the personal access token, like shown in the screenshots below.Changing this:

To:

We are still saying that it can use a username and password OR token, though. If we still wanted to show an example of using a token, I suggest we do that for the regular nuget feed url (
https://nuget.example.com/v3/index.json
) and not the Azure DevOps artifact feed url since that doesn't work.Check off the following:
Writer impact (This section is for GitHub staff members only):