How to disable for a fork?

@hugovk

I enabled Dependabot for a fork (https://github.com/hugovk/pytest), to make sure it was working smoothly before creating a PR to add it upstream (https://github.com/pytest-dev/pytest). Upstream is now using it, it's working well, thanks!

However, I now want to disable Dependabot for my fork but cannot find a way.

https://app.dependabot.com/accounts/hugovk says:

You've successfully migrated pytest to GitHub 🎉

At https://github.com/settings/installations/8631454, Dependabot Preview only has access to other repos:

At https://github.com/hugovk/pytest/settings/security_analysis I have everything disabled:

Deleting https://github.com/hugovk/pytest/blob/master/.github/dependabot.yml is not an option, because this is a fork, and it needs to be kept in sync with upstream.

How can I disable Dependabot for my fork?

Package manager/ecosystem

Python

Manifest contents prior to update

version: 2
updates:
- package-ecosystem: pip
  directory: "/testing/plugins_integration"
  schedule:
    interval: weekly
    time: "03:00"
  open-pull-requests-limit: 10
  allow:
  - dependency-type: direct
  - dependency-type: indirect

https://github.com/hugovk/pytest/blob/master/.github/dependabot.yml
https://github.com/hugovk/pytest/blob/master/testing/plugins_integration/requirements.txt

Edit: as the 2022-11-24 solution is obscured by the thousands of hidden items below, here it is for clarity:

Hmm... from when we shipped this on November 7th going forward, no repos should be default opted-in.

One exception is any repo, fork-or-no-fork will be automatically opted in if you've selected the Automatically enable for new repositories option in your user or org settings. But that's essentially inheriting a manual opt-in.

Forks that were created before November 7th will require manual disabling... we considered disabling them, but couldn't easily distinguish between those who did/didn't manually enable it from the beginning, so it was safer/more predictable for users if we left them untouched.

To disable, as @hugovk mentions above you need to either delete/re-create the fork, or click Disable on the forked repo's /settings/security_analysis page:

For PR's that were already sitting open when you disable Dependabot, I think nothing further happens to them unless you do it. They won't get auto-rebased or auto-closed.

This is happening in CPython repo as well which has 17K forks. It would help us greatly if dependabot can be disabled in forks. Thanks.

We're aware of this issue and planning a fix. The workaround for now is to delete the fork and re-create it without enabling Dependabot security updates. Dependabot version updates (setup from config file) isn't enabled by default on new forks but will be if security updates has ever been turned on and since disabled.

Thanks for clearly communicating! Any "ish" timeline on this?

(I have unrelated issues in the forks, so deleting and recreating isn't quite as easy as it could be.)

@patcon

@patcon we'll get to it in the next couple of months :/ going to bump it up again with the team and see if we can get to it sooner.

Getting this issue on a fork of https://github.com/EFForg/https-everywhere

Disabling actions did not prevent new PRs being generated

Seems to be a duplicate of #2198

@feelepxyz

@feelepxyz bumping it again, as it has been three months since this comment in #2804 (comment)

The workaround also doesn't work for forks I want private because I cannot change visibility of a (Github) fork, so I'm mirroring instead. Would the solution here also allow us to disable dependabot in mirrored repositories?

I think there is a need to act here because each fork has a master branch that cannot be changed from upstream after the fork is created. Those dependabots from forks will run infinite! At least as long as the owner of the fork does not fix his master branch what is expectable for 99% of the forks. Thinking global, this is a totally unneeded wast of resources and energy ...

@feelepxyz

@feelepxyz 🙏 for another bump with the team. We can't use dependabot on nixpkgs with 6.5k forks.

@feelepxyz

@feelepxyz 🙏 for another bump with the team. We can't use dependabot on nixpkgs with 6.5k forks.

Thanks for raising this. We've been pretty stretched so haven't managed to get to this yet. We still want to get this fixed but can't promise a date yet.

We've been pretty stretched

I have understanding for this 😄 .. If you see a chance to prioritize this it would be great / IMO it is a KO criteria for projects with a huge community (a lot forks). Anyway thanks a lot for having an eye on this.

This is a REAL annoyence. It's spamming forks with unnecessary messages. Can we get this fixed rather sooner than later?

Disable dependabot

Navigation Menu

Repository navigation

How to disable for a fork? #2804

81 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

How to disable for a fork? #2804

Description

Activity

Mariatta commented on Dec 1, 2020

feelepxyz commented on Dec 3, 2020

patcon commented on Jan 26, 2021

feelepxyz commented on Jan 29, 2021

wesinator commented on Feb 15, 2021

ldez commented on Feb 26, 2021

trivikr commented on May 4, 2021

featheredtoast commented on May 20, 2021

return42 commented on Jun 18, 2021

domenkozar commented on Jul 27, 2021

feelepxyz commented on Jul 28, 2021

return42 commented on Jul 28, 2021

ziegenberg commented on Aug 2, 2021

81 remaining items

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions