How to configure Dependabot for a private monorepo using multiple private package registries (GPR/npm) and CodeQL analysis?

[Fortotest]

Select Topic Area

Question

Body

Hi Security team,

I'm trying to lock down our security posture for a large, complex monorepo, and I'm facing a very difficult configuration problem.

Our Setup:

• A single, large private monorepo.
• The monorepo contains multiple projects (Node.js, Python, Go).
• We use multiple private package registries: some Node packages are on GitHub Packages (GPR), and some are on a private npm registry (like Artifactory).
• We use GitHub Advanced Security, including Dependabot and CodeQL.

The Problem:

1. Dependabot: How do I configure dependabot.yml to authenticate against both GPR (using GITHUB_TOKEN) and the external private npm registry (using a secret) simultaneously? The documentation seems to show one or the other, not both in the same config for a single monorepo.
2. CodeQL: How do I configure the CodeQL workflow to correctly scan all projects (Node, Python, Go) in the monorepo during a single run, while also respecting the private registry configurations so it can pull dependencies for analysis? Our builds are failing at the autobuild step because it can't resolve the private packages.

This combination of Dependabot + CodeQL + Monorepo + Multiple Private Registries is proving extremely difficult. What is the best-practice dependabot.yml and codeql-analysis.yml configuration for this specific, complex scenario?

Thanks!

[ysolomon-plat]

I second this

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬