ARTIFACTORY: How to integrate Github Dependabot with JFrog Artifactory

Introduction: 

Github Dependabot can be used to automatically check for newer versions of your dependencies. This article will guide you through the process of integrating Github Dependabot with JFrog Artifactory.


Enabling Dependabot in GitHub:

Dependabot is disabled by default, so you will need to enable it manually. To enable Dependabot in your Github repository, click on Insights → Dependency Graph → Dependabot → Enable Dependabot

 


Once Dependabot has been enabled, you can click on Create Config File.

 

Connecting Dependabot to Artifactory:

For Dependabot to connect to Artifactory, you will need to specify the Artifactory connection details in ./github/dependabot.yml
You can connect Dependabot to Artifactory using your Login Credentials, or an Access Token. In this example, we will be using Access Token. It is possible to create an Access Token with the following options:

Option A - Generate the token from the JFrog UI:

1. In the JFrog Platform, navigate to Administration (1) → User Management (2) → Access Tokens (3).
2. Click + Generate Token (top right) (4).
3. In the generate dialog:
   • Description: Description of the token's purpose. (e.g., GitHub Dependabot)
   • Token scope: select a group or a user with Read access on the remote repository.
   • Expiration time: choose a value that matches your rotation policy (e.g., 1 year).
4. Click Generate. Copy the token immediately - it is only displayed once. Store it in GitHub as a Dependabot secret named ARTIFACTORY_TOKEN.

 

Option B - Generate the token via Create Token REST API: 

 curl -u <user>:<password> \
   -X POST "https://<your-instance>.jfrog.io/access/api/v1/tokens" \
   -H "Content-Type: application/json" \
   -d '{
     "scope": "applied-permissions/groups:dependabot-readers",
     "expires_in": 31536000,
     "description": "GitHub Dependabot"
   }'

Note: 
If an “Unsupported authentication method Basic” response is returned, authenticate with an existing token instead. Replace -u <user>:<password> with -H "Authorization: Bearer <existing-token>".

The response contains an access_token field - store its value as the Dependabot secret in GitHub.

Note: Required token and permissions
Use a JFrog Access Token to authenticate with Dependabot. It is possible to create the Access Token with a user or a group scope. 
The minimum permission is Read permission on the underlying remote repository.

Copy your Token from Artifactory and head to your Github settings page. In Github, click on Settings → Security → Secret → Depenabot → New Repository Secret. Paste in your Access Token and give it a desired name. For this example, we named our token, JFROG_AUTH_TOKEN.
 
 

Once done, you can add your desired configuration to the dependabot.yml. More detailed information regarding configuration options can be found in this document. 
You can find an example of this configuration below: 

 

URL: https://<servername>.jfrog.io/artifactory/api/<package_type>/<repository_name>
Token: ${{secrets.<Name_of_your_token>}} 
Once done, click save. 


Verifying the Connection:

To verify that Dependabot is able to successfully connect to Artifactory, please head to Insights → Dependency Graph → Dependabot → Enable Dependabot → Last Checked

 

You should see 200 response codes in the log if the connection to Artifactory was successful:

​​​​​​​