GitHub automatically runs the jobs that generate Dependabot pull requests on GitHub Actions if you have GitHub Actions enabled for the repository. When Dependabot is enabled, these jobs will run by bypassing Actions policy checks and disablement at the repository or organization level.
Important
If Dependabot is enabled for a repository, it will always run on GitHub Actions, bypassing both Actions policy checks and disablement at the repository or organization level. This ensures that security and version update workflows always run when Dependabot is enabled.
Using GitHub Actions runners allows you to more easily identify Dependabot job errors and manually detect and troubleshoot failed runs. You can also integrate Dependabot into your CI/CD pipelines by using GitHub Actions APIs and webhooks to detect Dependabot job status such as failed runs, and perform downstream processing. For more information, see REST API endpoints for GitHub Actions and Webhook events and payloads.
New repositories that you create in your user account or in your organization will automatically be configured to run Dependabot on GitHub Actions using standard GitHub-hosted runners if any of the following is true:
Future releases of GitHub will remove the ability to disable running Dependabot on GitHub Actions.
Enabling Dependabot on GitHub Actions may increase the number of concurrent jobs run in your account. If required, customers on enterprise plans can request a higher limit for concurrent jobs. For more information, contact us through the [GitHub Support portal](https://support.github.com/), or contact your sales representative.
To run Dependabot jobs on GitHub Actions, GitHub creates a dynamic workflow for each job. Unlike standard GitHub Actions workflows, dynamic workflows are generated for a specific run and are not stored in your repository's .github/workflows directory.
You may see workflow runs named dynamic/dependabot/dependabot-updates or check runs with (dynamic) appended to their names. To troubleshoot errors or configuration problems, on the repository's Actions tab, filter the workflow runs to show only Dependabot update jobs, then open a workflow run to view the logs.
You can run Dependabot on GitHub Actions using:
Running Dependabot on standard GitHub-hosted or self-hosted runners does not count towards your included GitHub Actions minutes. For Dependabot on larger runners, GitHub will bill your organization at the regular rate. See Actions runner pricing.
Note
Private networking is supported with either an Azure Virtual Network (VNET) or the Actions Runner Controller (ARC) for Dependabot on GitHub Actions. See Setting up Dependabot to run on self-hosted action runners using the Actions Runner Controller and Setting up Dependabot to run on github-hosted action runners using the Azure Private Network.
You can select a runner type for Dependabot at the organization or repository level:
dependabot label. You can also specify a runner group to limit jobs to matching runners in that group.Warning
If the specified runner group does not exist, Dependabot reports an error immediately. If the group exists but no online runner in the group matches the configured label, the job remains queued until a matching runner is available. Make sure the repository can access the specified runner group.
Labeled runners are not available for public repositories. These repositories use standard GitHub-hosted runners.
If you are transitioning to using Dependabot on GitHub Actions runners and you restrict access to your organization's or repository's private resources, you may need to update your list of allowed IP addresses. For example, if you currently limit access to your private resources to the IP addresses that Dependabot uses, you should update your allowlist to use the GitHub-hosted runners IP addresses sourced from the meta API endpoint. For more information, see REST API endpoints for meta data.
To enable Dependabot on GitHub Actions runners, see Configuring Dependabot on GitHub-hosted runners and Configuring Dependabot on self-hosted runners.