Workflows do not have access to defined variables when runnning by dependabot

[neilime]

Select Topic Area

Bug

Body

I just started to use Configuration Variables, and it's pretty cool and useful +1

In my case, I'm using it for centralizing duplicated configurations across the organisation (e.g. a OCI registry url...) and repositories non sensible settings widely used in workflows (deployment urls...)

Is is working like a charm and avoid hard coding these variables in yml files.

BUT, it looks like dependabot did not have access to these variables, so every workflow triggered by dependabot (e.g. pull request checks)

Example with variable "OCI_REGISTRY", missing.

• Workflow:

• Logs:

Is there anything to configure to make it works, I am doing something wrong?

[tbouffard]

See also #44322: this is the same behavior for Pull Request created from a fork repository.

[dym-ok]

Yes, it is surprising how variables have only made it to the Actions subsection of Secrets and variables, but not to Codespaces or Dependabot.

I wonder what's an ETA for this could be? Otherwise it's really difficult to use variables in any PR-related workflows if Dependabot scanning is enabled.

[MarkIannucci]

@ashokirla, I thought I'd surface this discussion since you wrote the blog post announcing this functionality. Does GitHub have plans to make the configuration variables accessible to dependabot and codespaces?

[ashokirla]

Hi @MarkIannucci , yes we already have this ask in our backlog and will look into it this quarter.

[tauhid621]

👋 The changes to support Actions Variables for dependabot actor PRs was deployed. Every workflow triggered by dependabot actor would have access to Actions Variables.

The docs would be updated soon.

[isaacsanders]

Is this on a released version of GHES? Are there release notes to refer to?

[mikelax]

👋 The changes to support Actions Variables for dependabot actor PRs was deployed. Every workflow triggered by dependabot actor would have access to Actions Variables.

The docs would be updated soon.

I know this is an old thread but I am not seeing the docs about variables reflected of this change. It would be helpful as I just spent some time trying to figure out of dependabot has access to Org level variables.