The property '#/registries' of type string did not match the following type: object

[dammitjim]

Select Topic Area

Bug

Body

Hi there,

I am receiving an error within dependency graph that my dependabot config is invalid.

The property '#/registries' of type string did not match the following type: object

My dependabot.yml is as follows:

version: 2
registries: "*"
updates:
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"
    groups:
      pip-deps:
        patterns:
          - "*"
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    groups:
      actions-deps:
        patterns:
          - "*"

The github documentation lists this as an allowed value here: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#registries

Thank you for your time.

[carogalvin]

Hi @dammitjim , thanks for pointing this out! This is actually an error in our docs 😱 I'll look to get that fixed.

There are 2 places you can use the registries key: at the top level, where you define the registries, and within the updates blocks. At the top level, you need to define the registries and their access information if needed. Within the updates blocks (in your case, the pip or actions blocks), you can specify registries: "*" which will tell Dependabot to use any/all of the registries you defined at the top level.

So in this case, what you need to do is something like:

version: 2
registries:
  python-example:
    type: python-index
    url: https://example.com/_packaging/my-feed/pypi/example
    username: octocat
    password: ${{secrets.MY_BASIC_AUTH_PASSWORD}}
updates:
  - package-ecosystem: "pip"
    directory: "/"
    registries: "*"
    schedule:
      interval: "daily"
    groups:
      pip-deps:
        patterns:
          - "*"
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    groups:
      actions-deps:
        patterns:
          - "*"

You can read more information about what needs to be in that top level registries block here: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot