Skip to content

docs(dependabot): distinguish private repositories from registries - #46044

Closed
aniruddhaadak80 wants to merge 1 commit into
github:mainfrom
aniruddhaadak80:fix/dependabot-private-dependency-terms
Closed

aniruddhaadak80 wants to merge 1 commit into
github:mainfrom
aniruddhaadak80:fix/dependabot-private-dependency-terms

Conversation

@aniruddhaadak80

@aniruddhaadak80 aniruddhaadak80 commented Sep 24, 2026 •

Copy link
Copy Markdown
Contributor

Why:

Closes: #45681

The Dependabot support matrix has separate Private repositories and Private registries columns, but the article does not explain what each column represents. The surrounding guidance explains how to grant access to private repositories and configure private registries, but readers can still interpret “Private repositories” as the repository being updated rather than a repository that hosts dependencies. This distinction is important because support for one hosting type does not imply support for the other.

What's being changed (if available, include any code snippets, screenshots, or gifs):

  • Rename the matrix column to Private Git repositories so it is clear that it refers to repositories hosting dependencies.
  • Add a short explanation distinguishing private Git repositories from private registries and identifying both as forms of private dependencies.
  • Leave all ecosystem support values unchanged.
  • Evidence: the current article and its support matrix are at https://docs.github.com/en/code-security/reference/supply-chain-security/supported-ecosystems-and-repositories, and the existing guidance describes private repository access separately from registries configuration.
  • Testing:
    • npm run build — passed.
    • npm run lint-content -- --paths content/code-security/reference/supply-chain-security/supported-ecosystems-and-repositories.md data/reusables/dependabot/supported-package-managers.md — passed with no errors.
    • npm test -- src/content-linter/tests/lint-files.ts src/content-linter/tests/unit/table-column-integrity-simple.ts — 3469 tests passed.
    • npm test -- src/content-render/tests/render-changed-and-deleted-files.ts — 2 tests passed.
    • git diff --check — passed.

Check off the following:

  • A subject matter expert (SME) has reviewed the technical accuracy of the content in this PR. In most cases, the author can be the SME. Open source contributions may require an SME review from GitHub staff.
  • The changes in this PR meet the docs fundamentals that are required for all content.
  • All CI checks are passing and the changes look good in the review environment.

@github-actions

Copy link
Copy Markdown
Contributor

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to the data directory are not included in this table.

Source Review Production What Changed
code-security/reference/supply-chain-security/supported-ecosystems-and-repositories.md fpt
ghec
ghes@ 3.22 3.21 3.20 3.19 3.18 3.17
fpt
ghec
ghes@ 3.22 3.21 3.20 3.19 3.18 3.17

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

@github-actions github-actions Bot added the triage Do not begin working on this issue until triaged by the team label Sep 24, 2026
@subatoi

subatoi commented Sep 24, 2026

Copy link
Copy Markdown
Contributor

Hi, regrettably I'm going to close this out—we haven't marked this as ready for community contributions yet, and are yet to make a determination about the best way to tackle the problem. Apologies that this won't be the outcome you were hoping for

@subatoi subatoi closed this Sep 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

triage Do not begin working on this issue until triaged by the team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Dependabot - Private "Registries"/"Dependencies"/"Repositories" is misleading

3 participants