Dependabot Whitelist Action

Name: navikt/dependabot-whitelist

Checks if a dependency update from a Dependabot-generated PR is whitelisted. This is useful when we want to enable auto-merging trusted dependencies. Unlike whitelisting in Dependabots allow configuration, this action will preserve the pull-request, making it a notice and available for manual review.

Usage Instruction

Create a workflow for e.g. pull_request_target

name: Dependabot Pull Request
on: pull_request_target
jobs:
  check-whitelist:
    runs-on: ubuntu-latest
    if: github.actor == 'dependabot[bot]'
    steps:
      - uses: navikt/dependabot-whitelist@v1
        with:
          whitelist: |
            io.ktor:ktor-server-netty
            jvm
            org.jetbrains.kotlinx:kotlinx-coroutines-jdk8

This action will fail with exit code 1 on any violation.

Configuration

No dependencies are whitelisted by default.

Major versions often comes with breaking changes or additional required actions, that makes it applicable for human review like going through the changelog or waiting for zero days threats etc.