Cargo workspaces?

[heaths]

Select Topic Area

Question

Body

Are Cargo workspaces supported by default - or any Cargo.lock or Cargo.toml - for Dependabot? We have a .github/dependabot.yml file that is causing dependabot to run on an internal mirror/fork even though we've disabled dependabot. Can we safely delete this file so we're not getting disrupted in the mirror repo? Or is there another way to accomplish that? I see nothing obvious in repo settings or the dependabot.yml schema.

A cargo workspace

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[heaths]

Can anyone from the @dependabot answer?

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[heaths]

@andyfeller any idea how to get the attention of the Dependabot team? Someone had mentioned flagging the bot should help, but apparently not. This is a serious security concern with cargo workspaces. We're seeing inconsistent behavior, and often lacking of anything trustworthy.

[andyfeller]

So in the case above, you're actually mentioning the Dependabot GitHub App, not the actual team. 🤔

[andyfeller]

That being said, I'd normally tell a user or customer that Dependabot should be in sync with supported package managers within Dependency Graph, which includes Cargo.

[andyfeller]

Confirmed in https://docs.github.com/en/code-security/dependabot/ecosystems-supported-by-dependabot/supported-ecosystems-and-repositories#supported-ecosystems-and-repositories

[andyfeller]

We have a .github/dependabot.yml file that is causing dependabot to run on an internal mirror/fork even though we've disabled dependabot.

By internal mirror/fork, I'm assuming you mean a repository that has been forked but is not recognized as an actual fork. Meaning https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates#enabling-version-updates-on-forks doesn't apply.

I worry deleting this file might slip back upstream, so definitely encourage following up with https://support.github.com/ to ensure this gets escalated to the team.