Skip to content

Commit e663186

Browse files
guicauladaguicaulada
authored
feat(dependabot-auto-triage): add dependabot-auto-triage workflow (#927)
* Add dependabot-auto-triage workflow * Run prettier * Fix example workflow on README.md * Add dependencies lockfile * Pin action on example workflow on README.md * Add action to release-plase-config.json * Add node_modules to .gitignore * Use octokit paginate instead of custom pagination * Add dismissal reason input validation * Add linting, tsconfig and tests * Run prettier * Remove minimatch mock implementations
1 parent 49c90b1 commit e663186

File tree

11 files changed

+1592
-0
lines changed

11 files changed

+1592
-0
lines changed

‎actions/dependabot-auto-triage/.bun-version‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
1.2.8

‎actions/dependabot-auto-triage/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
node_modules

‎actions/dependabot-auto-triage/README.md‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
# Auto Dismiss Dependabot Alerts
2+
3+
A GitHub composite action to automatically dismiss Dependabot alerts based on manifest paths using glob patterns.
4+
5+
## Usage
6+
7+
This action can be used in a workflow to automatically dismiss Dependabot alerts for specific manifest paths. This is particularly useful for repositories with dependencies that are not directly used in production or for which vulnerabilities may not be relevant.
8+
9+
### Example Workflow
10+
11+
Create a workflow file (e.g., `.github/workflows/auto-dismiss-dependabot-alerts.yml`) with the following content:
12+
13+
<!-- x-release-please-start-version -->
14+
15+
```yaml
16+
name: Auto Dismiss Dependabot Alerts
17+
18+
on:
19+
# Run daily to dismiss new alerts
20+
schedule:
21+
- cron: "0 0 * * *"
22+
23+
# Allow manual triggering
24+
workflow_dispatch:
25+
26+
jobs:
27+
auto-dismiss:
28+
runs-on: ubuntu-latest
29+
permissions:
30+
id-token: write
31+
contents: read
32+
steps:
33+
- name: Checkout repository
34+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
35+
36+
# Get GitHub App token with Dependabot alerts permissions
37+
- name: Retrieve GitHub App secrets
38+
id: get-secrets
39+
uses: grafana/shared-workflows/actions/[email protected]
40+
with:
41+
common_secrets: |
42+
DEPENDABOT_AUTO_TRIAGE_APP_ID=dependabot-auto-triage:app-id
43+
DEPENDABOT_AUTO_TRIAGE_APP_PRIVATE_KEY=dependabot-auto-triage:private-key
44+
45+
- name: Generate token
46+
id: generate-token
47+
uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
48+
with:
49+
app-id: ${{ env.DEPENDABOT_AUTO_TRIAGE_APP_ID }}
50+
private-key: ${{ env.DEPENDABOT_AUTO_TRIAGE_APP_PRIVATE_KEY }}
51+
52+
# Use the token with the auto-triage action
53+
- name: Auto Dismiss Dependabot Alerts
54+
uses: grafana/shared-workflows/actions/[email protected]
55+
with:
56+
token: ${{ steps.generate-token.outputs.token }}
57+
paths: |
58+
terraform/modules/**/*.json
59+
docker/vendor/**
60+
ksonnet/lib/argo-workflows/charts/**/*.json
61+
dismissal-reason: "not_used"
62+
dismissal-comment: "These dependencies are not used in production and pose no risk"
63+
```
64+
65+
<!-- x-release-please-end-version -->
66+
67+
### Inputs
68+
69+
| Name | Description | Required | Default |
70+
| ------------------- | ----------------------------------------------------------------------------------------------------------------- | -------- | ----------------------------------------------------- |
71+
| `token` | GitHub token with permissions to dismiss alerts | Yes | N/A |
72+
| `alert-types` | Comma-separated list of alert types to dismiss | No | `dependency` |
73+
| `paths` | Multi-line list of glob patterns to match manifest paths to dismiss | Yes | N/A |
74+
| `dismissal-comment` | Default comment to add when dismissing alerts | No | `Auto-dismissed based on manifest path configuration` |
75+
| `dismissal-reason` | Default reason for dismissal (options: `fix_started`, `inaccurate`, `no_bandwidth`, `not_used`, `tolerable_risk`) | No | `not_used` |
76+
77+
### How It Works
78+
79+
1. The action fetches all open Dependabot alerts for the repository
80+
2. For each alert, it checks if the manifest path matches any of the provided glob patterns
81+
3. If the path matches a pattern, it dismisses the alert with the specified reason and comment
82+
83+
### Glob Pattern Syntax
84+
85+
The action uses [minimatch](https://github.com/isaacs/minimatch) for glob pattern matching. Some common patterns:
86+
87+
- `**/*.json` - Match all JSON files in any directory
88+
- `terraform/modules/**` - Match all files in terraform/modules and subdirectories
89+
- `docker/vendor/**/package-lock.json` - Match all package-lock.json files in docker/vendor and subdirectories
90+
- `ksonnet/lib/*/charts/**` - Match all files in any charts subdirectory under ksonnet/lib/\*/
91+
92+
### Permissions
93+
94+
Due to API limitations, accessing and dismissing Dependabot alerts requires a GitHub App token with specific permissions. The standard `GITHUB_TOKEN` does not have sufficient access to the Dependabot API, even when `security-events: write` permissions are specified.
95+
96+
#### GitHub App Requirements
97+
98+
To use this action, you need:
99+
100+
1. A GitHub App with the following permissions:
101+
102+
- Repository permissions:
103+
- **Dependabot alerts**: Read & Write
104+
105+
2. The GitHub App needs to be installed on your repository or organization
106+
107+
3. The App ID and private key should be stored securely (e.g., in Vault)
108+
109+
The example workflow above demonstrates using the `actions/create-github-app-token` action to generate a token with the required permissions.
110+
111+
If you're experiencing "Resource not accessible by integration" errors, this indicates that the token being used doesn't have the necessary permissions to access the Dependabot API.
112+
113+
## License
114+
115+
This action is licensed under the same license as the parent repository.

‎actions/dependabot-auto-triage/action.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: "Auto Dismiss Dependabot Alerts"
2+
description: "Auto dismiss Dependabot alerts based on manifest path"
3+
inputs:
4+
token:
5+
description: "GitHub token with permissions to dismiss alerts"
6+
required: true
7+
alert-types:
8+
description: 'Comma-separated list of alert types to dismiss (default: "dependency")'
9+
required: false
10+
default: "dependency"
11+
paths:
12+
description: "Multi-line list of glob patterns to match manifest paths to dismiss"
13+
required: true
14+
# Example: |
15+
# terraform/modules/**/*.json
16+
# docker/vendor/**
17+
dismissal-comment:
18+
description: "Default comment to add when dismissing alerts"
19+
required: false
20+
default: "Auto-dismissed based on manifest path configuration"
21+
dismissal-reason:
22+
description: "Default reason for dismissal"
23+
required: false
24+
default: "not_used"
25+
# Options: 'fix_started', 'inaccurate', 'no_bandwidth', 'not_used', 'tolerable_risk'
26+
27+
runs:
28+
using: "composite"
29+
steps:
30+
- name: Install bun package manager
31+
uses: oven-sh/setup-bun@4bc047ad259df6fc24a6c9b0f9a0cb08cf17fbe5 # v2.0.1
32+
with:
33+
bun-version-file: ${{ github.action_path }}/.bun-version
34+
35+
- name: Install dependencies
36+
shell: bash
37+
working-directory: ${{ github.action_path }}
38+
run: |
39+
bun install --frozen-lockfile --production
40+
41+
- name: Auto dismiss Dependabot alerts
42+
shell: bash
43+
working-directory: ${{ github.action_path }}
44+
env:
45+
GITHUB_TOKEN: ${{ inputs.token }}
46+
INPUT_ALERT_TYPES: ${{ inputs.alert-types }}
47+
INPUT_PATHS: ${{ inputs.paths }}
48+
INPUT_DISMISSAL_COMMENT: ${{ inputs.dismissal-comment }}
49+
INPUT_DISMISSAL_REASON: ${{ inputs.dismissal-reason }}
50+
NODE_ENV: "production"
51+
run: |
52+
bun run src/index.ts

0 commit comments

Comments
 (0)