Feature Request: Resource for managing Dependabot auto-triage rules (org and repo level)

[akh-99]

Description

GitHub provides Dependabot auto-triage rules (preset and custom) at both the organization and repository level. These rules allow automatic dismissal of low-impact alerts for development-scoped dependencies and custom auto-dismiss/reopen policies.

Currently, there is no Terraform resource to manage these rules. The only way to configure them is through the GitHub UI (Settings > Code security > Dependabot rules).

Requested Resources

• github_organization_dependabot_auto_triage_rule — manage org-level Dependabot auto-triage rules
• github_repository_dependabot_auto_triage_rule — manage repo-level Dependabot auto-triage rules

Example: Enable the GitHub preset rule at org level

resource "github_organization_dependabot_auto_triage_rule" "dismiss_low_impact" {
  rule_type = "built_in"
  rule_name = "dismiss-low-impact"
  state     = "enabled"
}

Example: Custom auto-triage rule

resource "github_organization_dependabot_auto_triage_rule" "dismiss_dev_deps" {
  rule_type   = "custom"
  name        = "Dismiss dev dependency alerts"
  state       = "enabled"
  target      = "development"
  action      = "dismiss"
  ecosystems  = ["npm", "pip"]
  severities  = ["low", "moderate"]
}

Use Case

Organizations managing GitHub configuration as Infrastructure as Code (IaC) with Terraform need the ability to configure Dependabot rules alongside other org/repo settings. Currently this is a manual UI-only step, which breaks the IaC workflow.

GitHub UI Reference

The setting is found at: Organization Settings > Code security and analysis > Dependabot rules

GitHub presets include:

• Dismiss low-impact alerts for development-scoped dependencies (Enabled/Disabled)
• Dismiss package malware alerts (Enabled/Disabled)

API Dependency

This feature likely requires a GitHub REST API endpoint for Dependabot auto-triage rules, which does not appear to exist yet. A prerequisite may be filing a request on the GitHub public roadmap.

References

• About Dependabot auto-triage rules
• Using GitHub preset rules

[github-actions]

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labeled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀