在dependabot.yml Azure devops NPM 身份验证答案

【问题标题】：Azure devops NPM Authentication in dependabot.yml在dependabot.yml Azure devops NPM 身份验证
【发布时间】：2022-10-19 23:28:35
【问题描述】：

我目前有以下管道工作：

schedules:
  - cron: "0 20 * * FRI"
    displayName: 'Weekly Run'
    always: true
    branches:
      include:
        - 'develop'

trigger: none

variables:
  DEPENDABOT_EXTRA_CREDENTIALS: '[{"type":"npm_registry","token":"$(DEPENDABOT_PAT)","registry":"SOME_URL"}]' # put the credentials for private registries and feeds
pool:
  vmImage: 'ubuntu-latest'

stages:
  - stage: CheckDependencies
    displayName: 'Check Dependencies'
    jobs:
      - job: Dependabot
        displayName: 'Run Dependabot'
        pool:
          vmImage: 'ubuntu-latest'
        steps:
          - task: dependabot@1
            displayName: 'Run Dependabot - npm'
            inputs:
              useConfigFile: false
              packageManager: 'npm'
              setAutoComplete: false
              azureDevOpsAccessToken: $(DEPENDABOT_PAT)  # env variable 
              gitHubAccessToken: $(GITHUB_TOKEN)  # env variable
              targetBranch: 'develop'
              openPullRequestsLimit: 15

但是，它已经开始给出以下警告： “在下一个次要版本中将不推荐使用显式输入而不是配置文件。迁移到使用 .azuredevops/dependabot.yml 或 .github/dependabot.yml 的配置文件。”

我已经根据文档添加了配置文件：https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#configuration-options-for-private-registries

我的配置文件如下所示：

version: 2
registries:
  npm-reg:
    type: npm-registry
    url: https://pkgs.dev.azure.com/BC-SDPR-Research/_packaging/Research/npm/registry/
    token: ${{secrets.AZURE_ACCESS_TOKEN}}
updates:
  - package-ecosystem: "npm"
    directory: "/"
    registries:
      - npm-reg
    schedule:
      interval: "weekly"
      day: "Friday"
      time: "20:00"
      timezone: "America/Los_Angeles"
    open-pull-requests-limit: 15
    setAutoComplete: false
    azureDevOpsAccessToken: ${{secrets.AZURE_ACCESS_TOKEN}}
    gitHubAccessToken: ${{secrets.GITHUB_TOKEN}}
    targetBranch: 'develop'
    openPullRequestsLimit: 15

我已经尝试了一切，但我仍然收到错误： Dependabot::Clients::Azure::Forbidden (Dependabot::Clients::Azure::Forbidden)

这可能是由于使用我的 npm 注册表进行身份验证而产生的。

任何帮助将不胜感激。

谢谢

【问题讨论】：

标签： azure azure-pipelines dependabot

【解决方案1】：

基于this post和this Github issue comment，我们不能使用token属性，而是使用username&password属性，使用PAT令牌作为密码

registries:
  npm-reg:
  type: npm-registry
  url: https://pkgs.dev.azure.com/<org>/<id>/_packaging/<feed-name>/npm/registry/
  username: <username> # I am not 100% sure that this value HAS to match the PAT...
  password: ${{secrets.DEVOPS_PAT}} # this is the non-base64 encoded PAT

【讨论】：