|
| 1 | +--- |
| 2 | +title: Setting up Dependabot to run on github-hosted action runners using the Azure Private Network |
| 3 | +intro: You can configure an Azure Virtual Network (VNET) to run {% data variables.product.prodname_dependabot %} on {% data variables.product.company_short %}-hosted runners. |
| 4 | +versions: |
| 5 | + feature: dependabot-vnet-support |
| 6 | +permissions: '{% data reusables.permissions.dependabot-various-tasks %}' |
| 7 | +topics: |
| 8 | + - Repositories |
| 9 | + - Dependabot |
| 10 | + - Version updates |
| 11 | + - Security updates |
| 12 | + - Dependencies |
| 13 | + - Pull requests |
| 14 | +allowTitleToDifferFromFilename: true |
| 15 | +shortTitle: Configure VNET |
| 16 | +--- |
| 17 | + |
| 18 | +## Configuring VNET for {% data variables.product.prodname_dependabot_updates %} |
| 19 | + |
| 20 | +{% data reusables.dependabot.vnet-support-private-preview-note %} |
| 21 | + |
| 22 | +This article provides step-by-step instructions for running {% data variables.product.prodname_dependabot %} on {% data variables.product.company_short %}-hosted runners configured with VNET. The article explains: |
| 23 | + |
| 24 | +* How to create runner groups for your enterprise or organization with a VNET configuration. |
| 25 | +* How to create {% data variables.product.company_short %}-hosted runners for {% data variables.product.prodname_dependabot %} in the runner group. |
| 26 | +* How to enable {% data variables.product.prodname_dependabot %} on large runners. |
| 27 | +* How to configure Azure VNET firewall IP rules. |
| 28 | + |
| 29 | +To use {% data variables.product.company_short %}-hosted runners with Azure VNET, you first need to configure your Azure resources, then create a private network configuration in {% data variables.product.github %}. |
| 30 | + |
| 31 | +## Configuring Azure resources |
| 32 | + |
| 33 | +To learn how to use {% data variables.product.company_short %}-hosted runners with an Azure private network, see [Configuring your Azure resources](/admin/configuring-settings/configuring-private-networking-for-hosted-compute-products/configuring-private-networking-for-github-hosted-runners-in-your-enterprise#configuring-your-azure-resources). |
| 34 | + |
| 35 | +> [!NOTE] |
| 36 | +> |
| 37 | +> * The `databaseId` which is required in the script for configuring the Azure resources can refer to any of the following depending on whether you are configuring the resources for an enterprise or an organization: |
| 38 | +> * The enterprise slug, which you can identify by looking at the URL for your enterprise, `https://github.com/enterprises/SLUG`, or |
| 39 | +> * The login for the organization account, which you can identify by looking at the URL for your organization, `https://github.com/organizations/ORGANIZATION_LOGIN`. |
| 40 | +> * The script will return the full payload for the created resource. The `GitHubId` hash value returned in the payload for the created resource is the network settings resource ID you will use in the next steps while setting up a network configuration in {% data variables.product.github %} |
| 41 | +
|
| 42 | +## Configuring a VNET-injected runner for {% data variables.product.prodname_dependabot_updates %} in your enterprise |
| 43 | + |
| 44 | +After configuring your Azure resources, you can use an Azure Virtual Network (VNET) for private networking by creating a network configuration{% ifversion ghec %} at the enterprise or organization level{% else %} at the organization level{% endif %}. Then, you can associate that network configuration to runner groups. |
| 45 | + |
| 46 | +1. Add a new network configuration for your enterprise. See [Add a new network configuration for your enterprise](/admin/configuring-settings/configuring-private-networking-for-hosted-compute-products/configuring-private-networking-for-github-hosted-runners-in-your-enterprise#1-add-a-new-network-configuration-for-your-enterprise) |
| 47 | +1. Create a runner group for the enterprise and select the organizations that you want to run {% data variables.product.prodname_dependabot_updates %} for. See [Create a runner group for your enterprise](/admin/configuring-settings/configuring-private-networking-for-hosted-compute-products/configuring-private-networking-for-github-hosted-runners-in-your-enterprise#2-create-a-runner-group-for-your-enterprise) |
| 48 | +1. Create and add a {% data variables.product.company_short %}-hosted runner to the enterprise runner group. See [Adding a larger runner to an enterprise](/actions/using-github-hosted-runners/using-larger-runners/managing-larger-runners#adding-a-larger-runner-to-an-enterprise). Important points are as follows: |
| 49 | + * The runner name must be **dependabot** |
| 50 | + * Choose a Linux x64 platform. |
| 51 | + * Select the suitable Ubuntu version. |
| 52 | + * When adding your {% data variables.product.company_short %}-hosted runner to a runner group, select the runner group you created in the previous step. |
| 53 | + |
| 54 | + > [!NOTE] |
| 55 | + > Naming the {% data variables.product.company_short %}-hosted runner **dependabot** assigns the **dependabot** label to the runner, which enables it to pick up jobs triggered by {% data variables.product.prodname_dependabot %} on actions. |
| 56 | +
|
| 57 | +{% ifversion fpt or ghec %} |
| 58 | + |
| 59 | +<!-- This section is currently only valid for dotcom. It'll need reviewing for GHES 3.18 --> |
| 60 | + |
| 61 | +## Enabling {% data variables.product.prodname_dependabot %} for the organization |
| 62 | + |
| 63 | +You now need to enable {% data variables.product.prodname_dependabot %} on _self-hosted runners_ for your organization in order to enable {% data variables.product.prodname_dependabot %} on large runners. See [Enabling or disabling {% data variables.product.prodname_dependabot %} on larger runners](/code-security/dependabot/working-with-dependabot/about-dependabot-on-github-actions-runners#enabling-or-disabling-dependabot-on-larger-runners). |
| 64 | + |
| 65 | +{% data reusables.profile.access_org %} |
| 66 | +{% data reusables.organizations.org_settings %} |
| 67 | +1. In the "Security" section of the sidebar, select the **{% data variables.product.UI_advanced_security %}** dropdown menu, then click **{% data variables.product.prodname_global_settings_caps %}**. |
| 68 | +1. Under **{% data variables.product.prodname_dependabot %}**, select **{% data variables.product.prodname_dependabot %} on self-hosted runners**. This step is required, as it ensures that future {% data variables.product.prodname_dependabot %} jobs will run on the larger {% data variables.product.company_short %}-hosted runner that has the `dependabot` name. |
| 69 | + |
| 70 | +{% endif %} |
| 71 | + |
| 72 | +## Triggering a {% data variables.product.prodname_dependabot %} run |
| 73 | + |
| 74 | +Now that you've set up private networking with VNET, you can start a {% data variables.product.prodname_dependabot %} run. |
| 75 | + |
| 76 | +{% data reusables.dependabot.trigger-run %} |
| 77 | + |
| 78 | +## Checking logs and active jobs for {% data variables.product.prodname_dependabot_updates %} |
| 79 | + |
| 80 | +* You can view the logs of the {% data variables.product.prodname_dependabot %} workflow in the **Actions** tab of your repository. Ensure you select the {% data variables.product.prodname_dependabot %} job on the left sidebar of the Actions page. |
| 81 | + |
| 82 | +  |
| 83 | + |
| 84 | +* You can view the active jobs in the page containing informatuon about the runner. To access that page, click the **Policies** tab for the enterprise, select **Actions** on the left sidebar, click the **Runner group** tab, and select your runner. |
| 85 | + |
| 86 | +  |
| 87 | + |
| 88 | +## Configuring Azure VNET firewall IP rules |
| 89 | + |
| 90 | +If your Azure VNET environment is configured with a firewall with an IP allowlist, you may need to update your list of allowed IP addresses to use the {% data variables.product.company_short %}-hosted runners IP addresses sourced from the meta API endpoint. |
| 91 | + |
| 92 | +* {% data variables.product.github %} provides the following public endpoint for its IP ranges: |
| 93 | + > GET <https://api.github.com/meta> |
| 94 | +* Copy and paste the following curl command in your terminal or command prompt and replace the placeholder bearer token value with your actual value. |
| 95 | + |
| 96 | + ```bash copy |
| 97 | + curl -L \ |
| 98 | + -H "Accept: application/vnd.github+json" \ |
| 99 | + -H "Authorization: Bearer YOUR-TOKEN" \ |
| 100 | + -H "X-GitHub-Api-Version: 2022-11-28" \ |
| 101 | + https://api.github.com/meta |
| 102 | + ``` |
| 103 | + |
| 104 | +* From the response, look for the **actions** key. |
| 105 | + |
| 106 | + ```bash |
| 107 | + "actions": [ ... ] |
| 108 | + ``` |
| 109 | + |
| 110 | + These are the IP ranges used by {% data variables.product.prodname_actions %} runners, including {% data variables.product.prodname_dependabot %} and hosted runners. |
| 111 | + |
| 112 | +* Add these IPs to your firewall allowlist. |
0 commit comments