Is there an existing issue for this?
Feature description
Dependabot's internal uv/pip resolver does not use my runner image's keyring credentials at all. I have an image with keyrings.google-artifactregistry-auth plugin installed. This is so that we can use Google's Application Default Credentials to automatically authenticate to our internal registry. This set up works for all of our internal runners except Dependabot runners.
We don't want to generate tokens and store them in github or anything. The machine that dependabot is running on is attached to a service account that is authorized to access our internal resources but there is no way I have found to configure dependabot to do so.
In the end, I get an error
Dependabot can't resolve your Python dependency files
Dependabot failed to update your dependencies because there was an error resolving your Python dependency files.
Dependabot encountered the following error:
× No solution found when resolving dependencies:
╰─▶ Because only the following versions of <internal-package> are
available:
<internal-package>
<internal-package>
and your project depends on <internal-package>, we
can conclude that your project's requirements are unsatisfiable.
hint: An index URL
(https://us-west1-python.pkg.dev/<project-id>/<internal-package>x/simple)
could not be queried due to a lack of valid authentication credentials
(401 Unauthorized).
Like I said, I have a custom runner image that is built with:
FROM ghcr.io/actions/actions-runner:latest
...
COPY --from=ghcr.io/astral-sh/uv:0.11.19 /uv /uvx /bin/
RUN <<EOF
#!/bin/bash
uv tool install --with keyrings.google_artifactregistry_auth keyring
EOF
And this works for all of our custom workflows excluding dependabot
Is there an existing issue for this?
Feature description
Dependabot's internal uv/pip resolver does not use my runner image's keyring credentials at all. I have an image with
keyrings.google-artifactregistry-authplugin installed. This is so that we can use Google's Application Default Credentials to automatically authenticate to our internal registry. This set up works for all of our internal runners except Dependabot runners.We don't want to generate tokens and store them in github or anything. The machine that dependabot is running on is attached to a service account that is authorized to access our internal resources but there is no way I have found to configure dependabot to do so.
In the end, I get an error
Like I said, I have a custom runner image that is built with:
And this works for all of our custom workflows excluding dependabot