Dependabot can use Composer mirrors without fake tokens

The blocked host was the actual issue

Running an internal Composer mirror does not automatically make it available to Dependabot. Update jobs can only connect to hosts allowed through Dependabot’s outbound network rules, so putting a mirror URL in composer.json is not enough. The usual outcome is a failed update job because the mirror host is blocked before dependency resolution even starts. (docs.github.com)

When a mirror allowed unauthenticated reads, the old workaround was often a meaningless token created solely to register the host. That did not improve security, but it did add another secret to store, rotate, and document. GitHub now supports organization-level registries with Anonymous authentication, with no token, password, or OIDC setup required. (docs.github.com)

One setup for multiple Laravel repositories

The useful part is configured once at the organization level rather than inside every repository. Go to Settings → Secrets and variables → Private registries, create a new registry, enter the mirror URL, and select the registry type that matches Composer. Then choose the repositories that can use it and set the authentication method to Anonymous. (docs.github.com)

Once that is in place, each Laravel repository can keep its Dependabot file small. There is no need to duplicate mirror credentials across repositories when access is already granted by the organization. A minimal setup for Composer version updates looks like this:

version: 2
 
updates:
  - package-ecosystem: "composer"
    directory: "/"
    schedule:
      interval: "weekly"

Dependabot can use organization-level private registries alongside registries declared in dependabot.yml. Since the organization registry is made available only to the repositories you select, the mirror can be centralized without copying sensitive configuration into every project. (docs.github.com)

What this changes in a homelab

If the Composer mirror has a URL reachable from GitHub-hosted runners and it allows anonymous downloads, this solves one specific failure mode: Dependabot jobs are no longer blocked from reaching that host. Multiple Laravel repositories can use the same dependency entry point without storing a secret the server does not actually need. It does not make the mirror available to every repository in the organization, because access is controlled when the registry is created. (docs.github.com)

This is also easier to maintain when a homelab acts as a Composer cache or mirror. Connectivity policy belongs at the organization level, while each repository keeps only the update rules that are specific to it: ecosystem, directory, and schedule. That is a cleaner boundary between registry access and dependency maintenance policy. (docs.github.com)

The important limitations

Anonymous authentication does not make an internal-only service reachable from GitHub. If the mirror lives on a private subnet, behind a VPN, or on an address that GitHub-hosted runners cannot access, registering it will not change that. GitHub documents self-hosted runners for Dependabot when updates need access to internal networks, including the required network and certificate setup. (docs.github.com)

It is not the right choice for a registry that genuinely requires authentication. If the mirror expects a username, token, special headers, or another access-control mechanism, use a supported authentication method instead of selecting Anonymous. Also, the authentication type cannot be changed after the registry is created, so moving between token-based and anonymous access requires deleting and recreating the registry. (docs.github.com)

Finally, an anonymously readable mirror is still part of your software supply chain. Avoiding stored credentials is operationally useful, but you still need to protect the service, understand what it mirrors, and keep it reachable for the repositories that depend on it. Dependabot can open update pull requests, but validating those changes and trusting the package source remain team responsibilities. (docs.github.com)

• Source: GitHub Changelog
• Official documentation: Giving security features access to private registries