PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To let Dependabot download private packages hosted by GitHub, grant the repository that runs Dependabot Read access in each package’s Manage Actions access settings. Dependabot then uses its own GITHUB_TOKEN to request packages: read; you do not need a personal access token or a registry entry in dependabot.yml for those GitHub-hosted packages.
The permission is package-specific. If Dependabot needs dependencies from three private packages, add its repository to all three packages and select Read each time. This automatic path applies to GitHub Packages and Container registry images, not to arbitrary private registries operated by other services.
What automatic Dependabot access means
Dependabot runs dependency-update jobs in a repository. When an update requires downloading a private package, GitHub can authorize that request with the repository’s short-lived GITHUB_TOKEN, provided the package owner has granted the repository access. The grant is made on the package, rather than globally for every package in an organization.
Free tools Windows power users keep installed
One-click scans. No signup required.
GitHub documents this behavior for private packages in GitHub Packages and for images in the Container registry. Its documentation says the feature is available across every GitHub Packages ecosystem supported by Dependabot. Public packages do not need this private-package grant.
#1 Best Overall
For GitHub-hosted registries, the setup is deliberately small:
- Open the settings for each private package.
- Find Manage Actions access.
- Add the repository where Dependabot runs.
- Assign Read.
GitHub’s official explanation of the mechanism is that “Dependabot uses its GITHUB_TOKEN to request packages: read permission when pulling from *.pkg.github.com and ghcr.io.” See GitHub’s automatic Dependabot access documentation for the current wording and supported scope.
How the authentication flow works
The important distinction is between the token and the package permission. Dependabot has a GITHUB_TOKEN for its repository job, but that token is not automatically authorized to read every private package owned by an organization. The package’s access list determines whether the token is accepted.
Recommended Free Tools
- Dependabot starts an update job in the repository.
- When it needs a dependency from a GitHub-hosted registry, it presents the repository job’s
GITHUB_TOKEN. - The request asks for the
packages: readpermission. - GitHub checks whether that repository is listed under the package’s Manage Actions access settings with Read permission.
- If the grant matches, the package or image can be downloaded.
This is why adding a repository to one package does not authorize it for another package. Each private package has its own access decision. Repeat the grant for every package that an update may pull.
Automatic credentials are a fallback, not an unconditional override. GitHub states that explicit registry credentials and normal registry routing take precedence. Therefore, a repository can have the correct package grant and still use a different configured credential or route if one is already present. This precedence is especially relevant when diagnosing a setup that appears to ignore the automatic token.
Rank #2
Step-by-step: grant Dependabot access to a private package
1. Identify the repository that runs Dependabot
Use the exact repository in which the Dependabot configuration and update jobs live. The access grant is made for that repository, not for an individual developer and not for every repository in the organization by implication.
2. Open the private package’s settings
Navigate to the package in GitHub and open its settings. You need to perform this operation separately for every private package or container image that Dependabot must pull.
3. Open Manage Actions access
In the package settings, locate Manage Actions access. This is the package-level control that allows GitHub Actions jobs from selected repositories to use the package. Dependabot uses the same repository token mechanism described in GitHub’s documentation.
4. Add the Dependabot repository
Add the repository identified in step 1 to the access list. Check the owner and repository name carefully when organizations contain similarly named projects.
5. Select Read
Assign the repository Read access. Dependabot needs to download packages; the documented setup does not require Write access. Granting only Read follows least-privilege practice and avoids giving an update job permission to publish or modify package contents.
6. Repeat for every required package
Repeat steps 2 through 5 for each private package and each Container registry image used by the dependency graph. A successful grant for one package does not carry over to another.
7. Allow the next update job to use the grant
After the package access list is updated, let the next scheduled Dependabot update run or use the repository’s normal Dependabot update control. If the job still cannot download a dependency, use the troubleshooting checks below rather than immediately creating a personal access token.
What is covered
| Package source | Automatic token | Required action | Permission |
|---|---|---|---|
| Private GitHub Packages repositories | Repository GITHUB_TOKEN requesting packages: read |
Add the Dependabot repository under the package’s Manage Actions access | Read |
GitHub Container registry images at ghcr.io |
Repository GITHUB_TOKEN requesting packages: read |
Grant the repository access on each private image or package | Read |
| Other GitHub Packages ecosystems supported by Dependabot | Automatic GitHub token path | Apply the same package-specific grant to each private package | Read |
The table describes the ownership boundary: the registry must be hosted by GitHub and the package must be one of the ecosystems supported by Dependabot. The automatic path is not a general-purpose credential that Dependabot can present to any server.
What is not covered: third-party private registries
Artifactory, Azure Artifacts, Nexus and other non-GitHub services require a different configuration. GitHub Docs states that third-party registries can use the registry configuration in dependabot.yml or organization-level private registry settings. Depending on the service and setup, the supported authentication method may be a token, a username and password, or OIDC.
| Question | GitHub-hosted package | Third-party private registry |
|---|---|---|
| Where is access configured? | Package settings, under Manage Actions access | Top-level registries configuration in dependabot.yml or organization-level private registry settings |
| Credential used | Repository GITHUB_TOKEN requesting packages: read |
Configured token, username/password, or supported OIDC method |
| Scope of the grant | Each private package or image individually | The registry credentials and rules defined in the applicable configuration |
| Personal access token required? | No, when the package access grant is in place | Not necessarily; the service’s supported authentication determines the requirement |
Do not add a third-party registry’s credentials to the GitHub package access list. Conversely, adding a GitHub package to a third-party registry configuration does not replace the package’s Manage Actions access grant.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →For the detailed organization and repository options, consult GitHub’s private-registry configuration guide and its organization access guidance.
Replacing older personal-access-token entries
Some repositories were configured before automatic GitHub-hosted access was available and contain personal access token credentials for packages on GitHub. Once the repository has Read access on every relevant package, GitHub says those personal-access-token-based registry entries for the covered GitHub packages can be removed.
- Inventory the private GitHub packages and images that Dependabot actually uses.
- Grant the repository Read access on each package.
- Run or wait for an update job and confirm that package downloads succeed.
- Remove only the obsolete personal-access-token entries for those GitHub-hosted packages.
- Keep credentials that belong to third-party registries; the automatic GitHub path does not replace them.
Removing a token before confirming the package grants can turn a previously working update into an authentication failure. Make the access-list change first, validate the update, and then clean up the no-longer-needed secret or registry entry.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting private-package download failures
Dependabot reports that a private GitHub package is unauthorized
- Verify that the repository running Dependabot is listed on the package’s Manage Actions access page.
- Confirm that the entry has Read, not an unrelated permission or no permission.
- Check the package itself. A grant on a similarly named package or a different image does not authorize the dependency that failed.
- Repeat the check for every private package in the update, because authorization is package-specific.
One package works but another fails
This pattern usually indicates an incomplete access list rather than a problem with Dependabot’s token. Compare the working package and failing package settings, then add the repository with Read access to the failing package. The fact that both packages belong to the same organization does not make the grant automatically global.
The repository has an access grant, but the job uses the wrong credentials
Review the repository’s explicit registry credentials and routing. GitHub’s automatic credentials are fallback authentication; explicit credentials and normal registry routing take precedence. An older registry entry can therefore cause the job to use a different secret or endpoint even when the package grant is correct. Remove or correct the conflicting entry only after determining whether it is needed for another registry.
The dependency is hosted outside GitHub
Package ownership is the first troubleshooting branch. If the dependency is on a third-party service, Manage Actions access is not the solution. Configure that registry through the supported dependabot.yml or organization-level private-registry settings, using the authentication method accepted by that service.
A container image still cannot be pulled
For a private image in ghcr.io, confirm that the repository was granted Read access on the specific container package. Also check whether an explicit container credential or another registry route is taking precedence. The automatic mechanism applies to the GitHub Container registry; it does not authorize an image hosted at a different domain.
The GitHub interface looks different
GitHub can change navigation and labels. The documented control to look for is the package’s Manage Actions access setting. The behavior described here was checked against GitHub documentation on October 13, 2026; the retrieved pages did not display a publication date, so confirm the live documentation if your interface uses a revised label.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Security and maintenance considerations
Use the smallest useful permission
Dependabot needs to retrieve dependencies, so Read is the appropriate package permission for this workflow. There is no documented need to grant Write merely because the job runs through GitHub Actions.
Prefer package-level grants over broad secrets
The package-specific list lets you authorize exactly which repository may read exactly which private package. This avoids distributing a reusable personal access token when GitHub’s own repository token can perform the download.
Reduce credential-rotation work
GitHub describes the automatic path as avoiding the creation, management and rotation of personal access tokens for these GitHub-hosted packages. That is a maintenance benefit, not a measured time or failure-rate guarantee; the official material provides no numeric savings claim.
Review access when repositories or packages change
When a new private package is introduced, add the Dependabot repository before the first update that needs it. When a repository should no longer consume a package, remove it from that package’s Manage Actions access list. Keep the review focused on package ownership so third-party registry credentials are not accidentally removed.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Practical verification checklist
- The dependency is hosted in GitHub Packages or the GitHub Container registry.
- The repository running Dependabot is identified exactly.
- That repository appears under every required package’s Manage Actions access list.
- Each entry has Read permission.
- No explicit registry credential or routing rule is unintentionally taking precedence.
- Third-party registries remain configured through
dependabot.ymlor organization-level private-registry settings. - A subsequent Dependabot update confirms that the private package can be downloaded.
Once these checks pass, Dependabot can use its repository GITHUB_TOKEN for the covered GitHub-hosted packages without a personal access token or a dedicated GitHub registry entry in dependabot.yml.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
