GitHub Dependabot の仕様、機能をおさらいする 2025

---
version: 2
updates:
    # GitHub Actions updates
  - package-ecosystem: "github-actions"
    directory: "/.github/workflows"
    schedule:
      interval: "weekly"

    # Docker updates
  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"

    # npm updates
  - package-ecosystem: npm
    directory: "/"
    schedule:
      interval: "daily"

version: 2
registries:
  gradle-artifactory:
    type: maven-repository
    url: https://acme.jfrog.io/artifactory/my-gradle-registry
    username: octocat
    password: ${{secrets.MY_ARTIFACTORY_PASSWORD}}
updates:
  - package-ecosystem: "gradle"
    directory: "/"
    registries: "*"
    schedule:
      interval: "monthly"

---
version: 2
updates:
    # npm updates
  - package-ecosystem: npm
    directory: "/"
    schedule:
      interval: "cron"
      cronjob: "0 0 * * *"
      timezone: "Asia/Tokyo"

# リポジトリのDependabot alertsを取得する
# 実行前にgh auth loginコマンドでログインしている
gh api \
  -H "Accept: application/vnd.github+json" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  /repos/<組織名 or アカウント名>/dependabotdemo/dependabot/alerts

[
  {
    "number": 5,
    "state": "open",
    "dependency": {
      "package": {
        "ecosystem": "npm",
        "name": "lodash"
      },
      "manifest_path": "javascript/yarn.lock",
      "scope": "runtime",
      "relationship": "direct"
    },
    "security_advisory": {
      "ghsa_id": "GHSA-35jh-r3h4-6jhm",
      "cve_id": "CVE-2021-23337",
      "summary": "Command Injection in lodash",
      "description": "`lodash` versions prior to 4.17.21 are vulnerable to Command Injection via the template function.",
      "severity": "high",
      "identifiers": [
        {
          "value": "GHSA-35jh-r3h4-6jhm",
          "type": "GHSA"
        },
        {
          "value": "CVE-2021-23337",
          "type": "CVE"
        }
      ],
      "references": [
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23337"
        },
        {
          "url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"
        },
        <省略>
      ],
      "published_at": "2021-05-06T16:05:51Z",
      "updated_at": "2024-04-17T18:39:19Z",
      "withdrawn_at": null,
      "vulnerabilities": [
        {
          "package": {
            "ecosystem": "npm",
            "name": "lodash"
          },
          "severity": "high",
          "vulnerable_version_range": "< 4.17.21",
          "first_patched_version": {
            "identifier": "4.17.21"
          }
        },
        {
          "package": {
            "ecosystem": "npm",
            "name": "lodash-es"
          },
          "severity": "high",
          "vulnerable_version_range": "< 4.17.21",
          "first_patched_version": {
            "identifier": "4.17.21"
          }
        },
        {
          "package": {
            "ecosystem": "npm",
            "name": "lodash.template"
          },
          "severity": "high",
          "vulnerable_version_range": "<= 4.5.0",
          "first_patched_version": null
        },
        {
          "package": {
            "ecosystem": "npm",
            "name": "lodash-template"
          },
          "severity": "high",
          "vulnerable_version_range": "<= 1.0.0",
          "first_patched_version": null
        }
      ],
      "cvss_severities": {
        "cvss_v3": {
          "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "score": 7.2
        },
        "cvss_v4": {
          "vector_string": null,
          "score": 0.0
        }
      },
      "epss": {
        "percentage": 0.00859,
        "percentile": 0.7394
      },
      "cvss": {
        "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
        "score": 7.2
      },
      "cwes": [
        {
          "cwe_id": "CWE-77",
          "name": "Improper Neutralization of Special Elements used in a Command ('Command Injection')"
        },
        {
          "cwe_id": "CWE-94",
          "name": "Improper Control of Generation of Code ('Code Injection')"
        }
      ]
    },
    "security_vulnerability": {
      "package": {
        "ecosystem": "npm",
        "name": "lodash"
      },
      "severity": "high",
      "vulnerable_version_range": "< 4.17.21",
      "first_patched_version": {
        "identifier": "4.17.21"
      }
    },
    "url": "https://api.github.com/repos/<組織名 or アカウント名>/dependabotdemo/dependabot/alerts/5",
    "html_url": "https://github.com/<組織名 or アカウント名>/dependabotdemo/security/dependabot/5",
    "created_at": "2025-06-15T09:57:31Z",
    "updated_at": "2025-06-15T09:57:31Z",
    "dismissed_at": null,
    "dismissed_by": null,
    "dismissed_reason": null,
    "dismissed_comment": null,
    "fixed_at": null,
    "auto_dismissed_at": null
  },
  <省略>
]

# セキュリティパッチが提供されているDependabotアラートを取得する
gh api \
  --method GET /repos/<組織名 or アカウント名>/dependabotdemo/dependabot/alerts \
  -F per_page=10 -F has=patch \
  --header 'Accept: application/vnd.github+json' \
  -H "X-GitHub-Api-Version: 2022-11-28"

name: Dependencies PR Check

on:
  pull_request:
    paths:
      - 'javascript/package.json'
      - 'javascript/package-lock.json'

jobs:
  dependencies-check:
    runs-on: ubuntu-latest
    steps:
      - name: Test Step1
        run: echo "This is a test step1."

    steps:
      - name: Test Step2
        run: echo "This is a test step2."

name: Dependencies PR Check

on:
  pull_request:
    paths:
      - 'javascript/package.json'
      - 'javascript/package-lock.json'

jobs:
  dependencies-check:
    runs-on: ubuntu-latest
    # Dependabotが作成したPull Requestの場合のみ処理を行う
    if: contains(github.event.pull_request.labels.*.name, 'dependencies')
    # またはPull Requestの作成者がdependabot[bot]の場合に処理を行う
    # if: github.actor == 'dependabot[bot]'
    steps:
      - name: Test Step
        run: echo "This is a test step to verify the workflow."

name: Notify Teams on Dependabot PR

on:
  pull_request:
    types: [opened]
    branches: [main]

jobs:
  notify-teams:
    runs-on: ubuntu-latest
    if: github.actor == 'dependabot[bot]'
    steps:
      - name: Send notification to Teams
        env:
          # WebhookのURLはセキュリティの観点からsecretsで参照すること
          TEAMS_WEBHOOK_URL: "<WebhookのURL>"
        run: |
          pr_title="${{ github.event.pull_request.title }}"
          pr_url="${{ github.event.pull_request.html_url }}"
          payload="{\"text\": \"Dependabot PR created: <a href='${pr_url}'>${pr_title}</a>\"}"
          curl -H "Content-Type: application/json" -d "$payload" "$TEAMS_WEBHOOK_URL"