Update OIDC authentication section for clarity - #46033
loganvolkers wants to merge 1 commit into
Conversation
Removed note about OIDC authentication support for organization-level private registries. This no longer appreas to be true: https://github.blog/changelog/2026-04-14-dependabot-and-code-scanning-org-level-private-registries/
|
This pull request only removes existing content. Before submitting a content-removal pull request, please open an issue explaining the proposed removal and wait for approval from the GitHub Docs team. Once the change has been approved, you can open a new pull request and link it to the issue. |
How to review these changes 👓Thank you for your contribution. To review these changes, choose one of the following options: A Hubber will need to deploy your changes internally to review. Table of review linksNote: Please update the URL for your staging server or codespace. The table shows the files in the
Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server 🤖 This comment is automatically generated. |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The remaining OIDC overview still incorrectly describes the feature as Dependabot-only.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
What changed in this PR
Removes an outdated note that incorrectly excluded code scanning default setup from OIDC authentication support.
Changes:
- Deletes the obsolete OIDC limitation note.
| File | Description |
|---|---|
giving-org-access-private-registries.md |
Removes outdated OIDC guidance. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| @@ -106,9 +106,6 @@ See [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/manage-your-depe | |||
|
|
|||
| OIDC (OpenID Connect) authentication allows {% data variables.product.prodname_dependabot %} to use short-lived credentials from your cloud identity provider to access private registries, eliminating the need to store long-lived secrets. With OIDC, credentials are generated dynamically for each {% data variables.product.prodname_dependabot %} update job. You must configure a trust relationship between your cloud provider and {% data variables.product.github %} before {% data variables.product.prodname_dependabot %} can authenticate. | |||

Removed note about OIDC authentication support for organization-level private registries. This no longer appreas to be true: https://github.blog/changelog/2026-04-14-dependabot-and-code-scanning-org-level-private-registries/
Why:
Closes: #46032
What's being changed (if available, include any code snippets, screenshots, or gifs):
Removes the outdated Notes block.
Check off the following: