Azure开发dependabot.yml中的NPM认证

Question

我目前有以下管道在工作：

schedules:
  - cron: "0 20 * * FRI"
    displayName: 'Weekly Run'
    always: true
    branches:
      include:
        - 'develop'

trigger: none

variables:
  DEPENDABOT_EXTRA_CREDENTIALS: '[{"type":"npm_registry","token":"$(DEPENDABOT_PAT)","registry":"SOME_URL"}]' # put the credentials for private registries and feeds
pool:
  vmImage: 'ubuntu-latest'

stages:
  - stage: CheckDependencies
    displayName: 'Check Dependencies'
    jobs:
      - job: Dependabot
        displayName: 'Run Dependabot'
        pool:
          vmImage: 'ubuntu-latest'
        steps:
          - task: dependabot@1
            displayName: 'Run Dependabot - npm'
            inputs:
              useConfigFile: false
              packageManager: 'npm'
              setAutoComplete: false
              azureDevOpsAccessToken: $(DEPENDABOT_PAT)  # env variable 
              gitHubAccessToken: $(GITHUB_TOKEN)  # env variable
              targetBranch: 'develop'
              openPullRequestsLimit: 15

但是，它已经开始给出以下警告：“在下一个小版本中，不推荐使用显式输入而不是配置文件。请迁移到使用配置文件. .azuredevops/dependabot.yml或. given /cisabot.yml。”

我在docs：https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#configuration-options-for-private-registries中添加了配置文件

配置文件如下所示：

version: 2
registries:
  npm-reg:
    type: npm-registry
    url: https://pkgs.dev.azure.com/BC-SDPR-Research/_packaging/Research/npm/registry/
    token: ${{secrets.AZURE_ACCESS_TOKEN}}
updates:
  - package-ecosystem: "npm"
    directory: "/"
    registries:
      - npm-reg
    schedule:
      interval: "weekly"
      day: "Friday"
      time: "20:00"
      timezone: "America/Los_Angeles"
    open-pull-requests-limit: 15
    setAutoComplete: false
    azureDevOpsAccessToken: ${{secrets.AZURE_ACCESS_TOKEN}}
    gitHubAccessToken: ${{secrets.GITHUB_TOKEN}}
    targetBranch: 'develop'
    openPullRequestsLimit: 15

我已经尝试了所有的东西，但我仍然收到错误:Dependabot：：Clients:Azure：：禁忌(Dependabot：：Clients：：Azure：：禁忌)

这很可能是由于我的npm注册中心的身份验证而产生的。

任何帮助都将不胜感激。

谢谢

Answer 1

基于这个职位和这篇吉特布的评论，我们不能使用token属性，而可以使用username&password属性，使用PAT令牌作为密码

registries:
  npm-reg:
  type: npm-registry
  url: https://pkgs.dev.azure.com/<org>/<id>/_packaging/<feed-name>/npm/registry/
  username: <username> # I am not 100% sure that this value HAS to match the PAT...
  password: ${{secrets.DEVOPS_PAT}} # this is the non-base64 encoded PAT