Clarify Dependabot is exempt from IP allow list enforcement

[emisanada]

Summary

Updates the Dependabot IP allow list documentation to accurately reflect that Dependabot is a first-party GitHub App whose repository access is exempt from IP allow list restrictions.

Why

The current docs state that customers "must set up a self-hosted runner or enable Dependabot for use with larger runners" when using IP allow lists. This is inaccurate for Dependabot's core operations:

• Dependabot is a privileged first-party app with explicit ip_allowlist_exempt: true capability
• Its repository access (reading dependency files, creating PRs) bypasses IP allow list enforcement by design
• Customers have observed this working and are confused because the docs say otherwise (internal ref)

Changes

Rewrites data/reusables/dependabot/ip-allow-list-dependabot.md to:

1. State clearly that Dependabot's repository access is exempt from IP allow lists
2. Remove misleading "must" language about requiring self-hosted/larger runners for basic Dependabot functionality
3. Keep runner guidance for other use cases where static IPs are needed (e.g., accessing private package registries behind firewalls)

What this does NOT cover

The interaction between GITHUB_TOKEN in Dependabot workflow steps and IP allow list enforcement is nuanced and not fully documented here. The Actions app has a different exemption scope (ip_allowlist_exempt_for_internal_apis only). This PR focuses solely on clarifying Dependabot's own access, which is unambiguously exempt.

Affected pages

This reusable appears on:

• Restricting network traffic to your enterprise with an IP allow list

[github-actions]

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

• Spin up a codespace
• Set up a local development environment

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to the data directory are not included in this table.

Source	Review	Production	What Changed
admin/configuring-settings/hardening-security-for-your-enterprise/restricting-network-traffic-to-your-enterprise-with-an-ip-allow-list.md	ghec	ghec	from reusable

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates Dependabot IP allow list guidance to clarify that Dependabot’s repository access is exempt from IP allow list restrictions, while still advising static IP solutions for workflows that need them.

Changes:

• Replaces runner-IP-focused opening with a statement about Dependabot’s exemption from IP allow list restrictions.
• Reframes the “must use self-hosted/larger runners” guidance as conditional on needing static IPs for other resources (e.g., private registries).
• Minor wording cleanup in the larger runners/static IP sentence.

Show a summary per file

File	Description
data/reusables/dependabot/ip-allow-list-dependabot.md	Clarifies Dependabot’s IP allow list behavior and refines guidance on when static IP runners are needed.

Copilot's findings

• Files reviewed: 1/1 changed files
• Comments generated: 1

[emisanada]

Closing — moving to docs-internal per DIY docs guidelines.