Dependabot Whitelist Action
Name: navikt/dependabot-whitelist
Checks if a dependency update from a Dependabot-generated PR is whitelisted. This is useful when we want
to enable auto-merging trusted dependencies. Unlike whitelisting in Dependabots allow
configuration,
this action will preserve the pull-request, making it a notice and available for manual review.
Usage Instruction
Create a workflow for e.g. pull_request_target
name: Dependabot Pull Request
on: pull_request_target
jobs:
check-whitelist:
runs-on: ubuntu-latest
if: github.actor == 'dependabot[bot]'
steps:
- uses: navikt/dependabot-whitelist@v1
with:
whitelist: |
io.ktor:ktor-server-netty
jvm
org.jetbrains.kotlinx:kotlinx-coroutines-jdk8
This action will fail with exit code 1
on any violation.
Configuration
No dependencies are whitelisted by default.
Major versions often comes with breaking changes or additional required actions, that makes it applicable for human review like going through the changelog or waiting for zero days threats etc.
Option | Required | Default Value | Description |
---|---|---|---|
whitelist |
yes |
'' | A multi-line string of packages |
major |
no |
false |
Whitelist major versions |
minor |
no |
true |
Whitelist minor versions |
patch |
no |
true |
Whitelist patch versions |
token |
no |
${{ github.token }} |
An alternative to the default GitHub Token |