You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/code-security/dependabot/dependabot-security-updates/customizing-dependabot-security-prs.md
+65-1Lines changed: 65 additions & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -44,12 +44,25 @@ For detailed guidance, see [Prioritizing meaningful updates](/code-security/depe
44
44
45
45
{% endif %}
46
46
47
+
{% ifversion dependabot-reviewers-deprecation %}
48
+
49
+
## Automatically adding reviewers
50
+
51
+
To ensure your project's security updates get addressed promptly by the appropriate team, you can automatically add reviewers to Dependabot pull requests using a CODEOWNERS file. See [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners).
52
+
53
+
{% else %}
54
+
47
55
## Automatically adding reviewers and assignees
48
56
57
+
> [!NOTE]
58
+
> The `reviewers` property is closing down and will be removed in a future release of GitHub Enterprise Server.
59
+
49
60
To ensure your project's security updates get **addressed promptly** by the appropriate team, use `reviewers` and `assignees` to automatically add individuals or teams as **reviewers or assignees** to pull requests.
50
61
51
62
For detailed guidance, see [Automatically adding reviewers and assignees](/code-security/dependabot/dependabot-version-updates/customizing-dependabot-prs#automatically-adding-reviewers-and-assignees).
52
63
64
+
{% endif %}
65
+
53
66
## Labeling pull requests with custom labels
54
67
55
68
To **prioritize** specific pull requests, or integrate them into CI/CD pipelines, use `labels` to apply your own **custom labels** to each pull request.
@@ -79,9 +92,58 @@ For detailed guidance, see [Changing the separator in the pull request branch na
79
92
In this example, the `dependabot.yml` file:
80
93
* Uses a private registry for updates to npm dependencies.
81
94
* Disables version updates for dependencies, so that any customizations apply to security updates only.
82
-
* Is customized so that {% data variables.product.prodname_dependabot %} applies custom labels to the pull requests and automatically adds reviewers and assignees.{% ifversion dependabot-grouped-security-updates-config %}
95
+
* Is customized so that {% data variables.product.prodname_dependabot %} applies custom labels to the pull requests and automatically adds {% ifversion ghes < 3.19 %}reviewers and {% endif %}assignees.{% ifversion dependabot-grouped-security-updates-config %}
83
96
* Groups security updates for golang dependencies into a single pull request.{% endif %}
84
97
98
+
{% ifversion dependabot-reviewers-deprecation %}
99
+
100
+
```yaml copy
101
+
# Example configuration file that:
102
+
# - Uses a private registry for npm updates
103
+
# - Ignores lodash dependency
104
+
# - Disables version-updates
105
+
# - Applies custom labels
106
+
{% ifversion dependabot-grouped-security-updates-config %}# - Group security updates for golang dependencies into a single pull request{%- endif %}
107
+
108
+
version: 2
109
+
registries:
110
+
# Define a private npm registry with the name `example`
111
+
example:
112
+
type: npm-registry
113
+
url: https://example.com
114
+
token: {% raw %}${{secrets.NPM_TOKEN}}{% endraw %}
115
+
updates:
116
+
- package-ecosystem: "npm"
117
+
directory: "/src/npm-project"
118
+
schedule:
119
+
interval: "daily"
120
+
# For Lodash, ignore all updates
121
+
ignore:
122
+
- dependency-name: "lodash"
123
+
# Disable version updates for npm dependencies
124
+
open-pull-requests-limit: 0
125
+
registries:
126
+
# Ask Dependabot to use the private registry for npm
127
+
- example
128
+
# Raise all npm pull requests for security updates with custom labels
129
+
labels:
130
+
- "npm dependencies"
131
+
- "triage-board"
132
+
# Raise all npm pull requests for security updates with assignees
There are various ways to customize your {% data variables.product.prodname_dependabot %} pull requests so that they better suit your own internal processes.
21
21
22
+
{% ifversion dependabot-reviewers-deprecation %}
23
+
24
+
For example, to integrate {% data variables.product.prodname_dependabot %}'s pull requests into your CI/CD pipelines, it can apply **custom labels** to pull requests, which you can then use to trigger action workflows.
25
+
26
+
{% else %}
27
+
22
28
For example:
23
29
* To maximize efficiency, {% data variables.product.prodname_dependabot %} can automatically add specific individuals or teams as **reviewers** to its pull requests for a particular package ecosystem.
24
30
* To integrate {% data variables.product.prodname_dependabot %}'s pull requests into your CI/CD pipelines, it can apply **custom labels** to pull requests, which you can then use to trigger action workflows.
25
31
32
+
{% endif %}
33
+
26
34
There are several different customization options which can all be used in combination, and tailored per package ecosystem.
27
35
36
+
{% ifversion dependabot-reviewers-deprecation %}
37
+
38
+
## Automatically adding reviewers
39
+
40
+
To ensure your project's security updates get addressed promptly by the appropriate team, you can automatically add reviewers to Dependabot pull requests using a CODEOWNERS file. See [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners).
41
+
42
+
{% else %}
43
+
28
44
## Automatically adding reviewers and assignees
29
45
30
46
By default, {% data variables.product.prodname_dependabot %} raises pull requests without any reviewers or assignees.
31
47
32
48
However, you may want pull requests to be consistently reviewed or dealt with by a specific individual or team that has expertise in that package ecosystem, or automatically assigned to a designated security team. In which case, you can use `reviewers` and `assignees` to set these values per package ecosystem.
33
49
50
+
> [!NOTE]
51
+
> The `reviewers` property is closing down and will be removed in a future release of GitHub Enterprise Server.
52
+
34
53
The example `dependabot.yml` file below changes the npm configuration so that all pull requests opened with version and security updates for npm have:
35
54
* A team ("`my-org/team-name`") and an individual ("`octocat`") automatically added as reviewers to the pull requests.
36
55
* An individual ("`user-name`") automatically assigned to the pull requests.
@@ -59,6 +78,8 @@ updates:
59
78
60
79
See also [`assignees`](/code-security/dependabot/working-with-dependabot/dependabot-options-reference#assignees--) and [`reviewers`](/code-security/dependabot/working-with-dependabot/dependabot-options-reference#reviewers--).
> The `reviewers` property is closing down and will be removed in a future release of GitHub Enterprise Server.
465
+
461
466
Specify individual reviewers, or teams of reviewers, for all pull requests raised for a package manager. For examples, see [AUTOTITLE](/code-security/dependabot/dependabot-version-updates/customizing-dependabot-prs).
462
467
463
468
{% data variables.product.prodname_dependabot %} default behavior:
@@ -471,6 +476,11 @@ When `reviewers` is defined:
471
476
472
477
Reviewers must have at least read access to the repository.
473
478
479
+
> [!NOTE]
480
+
> You can also automatically add reviewers and assignees using a CODEOWNERS file. See [AUTOTITLE](/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners).
**Required option.** Define how often to check for new versions for each package manager you configure using the `interval` parameter. Optionally, for daily and weekly intervals, you can customize when {% data variables.product.prodname_dependabot %} checks for updates. For examples, see [AUTOTITLE](/code-security/dependabot/dependabot-version-updates/optimizing-pr-creation-version-updates).
0 commit comments