Dependabot private registry config errors in CI

By Kaveh Alemi·Latchkey

Dependabot private feeds are declared in a top-level registries: block and attached to updates by name. A wrong type, a URL that does not match the ecosystem, or a secret that resolves to empty all stop Dependabot from authenticating or resolving.

What this error means

Dependabot logs show a registry-related failure: an unauthenticated request, "invalid registry configuration", or a package that never updates because its private feed is unreachable.

Dependabot failed to parse your dependabot.yml:
registries.internal.type "npm" is not a valid registry type.

Common causes

Wrong registry type keyword

Each ecosystem uses a specific type such as npm-registry, python-index, docker-registry, or maven-repository. A typo like npm is rejected at parse time.

A secret that resolves to an empty value

Referencing a Dependabot secret that does not exist yields an empty token or password, so the feed rejects the request.

How to fix it

Use the correct type and reference a real secret

1. Set type to the exact keyword for the ecosystem.
2. Reference a secret that exists in the Dependabot secrets store.
3. Attach the registry to the update by name.

registries:
  internal:
    type: python-index
    url: https://pypi.internal.example.com/simple
    username: ${{secrets.PYPI_USER}}
    password: ${{secrets.PYPI_PASSWORD}}
updates:
  - package-ecosystem: "pip"
    directory: "/"
    registries:
      - internal
    schedule:
      interval: "weekly"

Match the URL to the ecosystem

Point url at the correct feed endpoint (a simple index for pip, the registry base for npm). A mismatched path fails resolution even when auth is valid.

How to prevent it

• Use the exact registry type keyword for each ecosystem.
• Reference only secrets that exist in the Dependabot store.
• Keep registry URLs pointed at the correct feed endpoints.

Frequently asked questions

Related guides

References

• GitHub Actions documentation