Dependabot
Fetches dependabot alerts for GitHub repositories, and passes them through the CCF policy engine.
This plugin is intended to be run as part of an aggregate agent, and will execute the policy suite for each repository.
This page is for operators who run the plugin-dependabot plugin with the CCF Agent, and for developers who write policies for it. It documents v0.8.0 and is generated from the plugin's README at v0.8.0.
Requirements
Authentication
To authenticate this plugin, you must provide a token which has at minimum the following permissions:
- Dependabot Alerts (read-only) - Used for reading alerts
- Administration (read-only) - Used to check whether a repository has alerts enabled
Policies
The policy bundles that work with this plugin, at their newest releases. The controls are the ones the bundle's policies list in their metadata.
| Bundle | Latest version | Controls covered | Compatible plugin lines |
|---|---|---|---|
plugin-dependabot-granular-policies | v0.2.0 | none listed | latest |
When writing OPA / Rego policies for this plugin, they must be added under the compliance_framework rego package:
# deny_critical_severity.rego
# package compliance_framework.[YOUR_RULE_PATH]
package compliance_framework.deny_critical_severity