I've been evaluating GitHub Advanced Security, specifically Dependabot, as part of a broader HR software platform security review. Our primary codebase integrates several private NuGet packages hosted on an internal Azure Artifacts feed. Dependabot consistently fails to authenticate with this private feed during its dependency graph updates.
I have configured the `nuget.config` file in the repository root with the correct package source and credentials, and I've also added the feed as a private registry in the repository's Dependabot secrets (`NUGET_FEED_URL`, `NUGET_USERNAME`, `NUGET_PASSWORD`). Despite this, the "Dependency graph" service consistently logs authentication failures for that specific source.
My current setup includes:
* A `nuget.config` with a `packageSourceCredentials` section for the private feed.
* Repository secrets configured as per the GitHub documentation for private registries.
* The `dependabot.yml` file located in `.github/` with updates set for `nuget`.
The specific error in the dependency graph summary is: "Dependabot encountered errors updating your dependencies. There was an error accessing one of your NuGet sources."
Before I open a support ticket, I wanted to see if others in the community have encountered similar integration issues. My questions are:
* Has anyone successfully configured Dependabot to work with a private Azure Artifacts (or similar private NuGet) feed, and if so, were there any non-obvious configuration steps?
* Is there a known issue with the `packageSourceCredentials` in `nuget.config` when used in conjunction with repository-level Dependabot secrets? Should one method be preferred over the other?
* Are there specific credential formats (e.g., personal access token scopes for Azure DevOps) that are required for Dependabot that differ from a standard developer machine's authentication?
I am trying to determine if this is a misconfiguration on my part or a potential limitation of the service.