How to allow Dependabot to reach private repo within my org for RubyGems updates?

[brooksClo19]

Select Topic Area

Question

Body

I have a private repo w/ dependabot setup to create alerts as needed. Dependabot is getting 404s when trying to access other private repos which contain ruby gems and are within the same github org. I created an access token with repo as the granted scope. I added the secret to my org dependabot secrets and shared it directly with the two repos in question here.

see my dependabot.ymls which I placed in the .github directory (one at a time of course) and regardless of configurations I've tried I've received the error messages below. Anyone have any success with a similar config?
Try #1

version: 2
registries:
  ruby-github:
    type: rubygems-server
    url: https://github.com/my-org/my-private-repo
    username: github-username
    password: ${{secrets.VALUE}}
    replaces-base: true
updates:
  - package-ecosystem: "bundler"
    directory: "/"
    insecure-external-code-execution: allow
    registries: "*"
    schedule:
      interval: "daily"

Try #2

version: 2
registries:
  my-private-repo:
    type: git
    url: https://github.com/my-org/my-private-repo
    username: github-username
    password: ${{secrets.VALUE}}
updates:
  - package-ecosystem: "gitsubmodule"
    directory: "/"
    registries:
      - my-private-repo
    schedule:
      interval: "daily"

Error from UI

Dependabot failed to update your dependencies

The following git repository was unreachable and caused the update to fail: [my-private-repo](https://github.com/my-org/my-private-repo).

Dependabot can't update bundler dependency files that reference private git repositories. Please consider using a [git registry](https://docs.github.com/en/code-security/supply-chain-security/configuration-options-for-dependency-updates#git).

Error in logs

  proxy | 2023/03/30 19:20:19 [034] GET https://github.com:443/my-org/my-private-repo.git/info/refs?service=git-upload-pack
  proxy | 2023/03/30 19:20:19 [034] * authenticating git server request (host: github.com)
  proxy | 2023/03/30 19:20:19 [034] 404 https://github.com:443/my-org/my-private-repo.git/info/refs?service=git-upload-pack
  proxy | 2023/03/30 19:20:19 [034] * auth'd git request returned 404, retrying without auth
  proxy | 2023/03/30 19:20:19 [034] * de-auth'd request returned 401, replacing response

[brooksClo19]

This was due to my package-ecosystem being bundler which does not currently support private repositories.

[lvonk]

Hi @brooksClo19 I am running into the same issue. How did you know it wasn't supported? Is there a way to get around this?

[ksweetie]

I got this working for our repo that has a Gemfile pointing to private repos. Here's our config:

registries:
  github:
    type: git
    url: https://github.com
    username: x-access-token
    password: ${{secrets.DEPENDABOT_GEMS_PAT}}

There are several places in the GitHub UI to store secrets, but you want to find the Dependabot Secrets section to add it.