From a431f3912def008ff7c64570c79242612fd73085 Mon Sep 17 00:00:00 2001
From: Ruben Romero Montes <rromerom@redhat.com>
Date: Mon, 13 Apr 2026 16:08:30 +0200
Subject: [PATCH] chore: exclude test fixture manifests from Dependabot

The src/test/resources/tst_manifests/ directory contains intentionally
pinned (and sometimes vulnerable) dependencies used as test data.
Dependabot was raising version and security update PRs for these
fixtures, which should never be upgraded automatically.

Add ecosystem entries for npm, pip, gomod, gradle, and cargo with
exclude-paths covering src/test/** and open-pull-requests-limit: 0
so Dependabot skips those manifests entirely for version updates.

Note: exclude-paths does not apply to Dependabot security updates.
Security update PRs for test fixtures must be closed manually and
their alerts dismissed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/dependabot.yml | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 20500ef8..0f593d2a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,3 +10,41 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+  # Prevent Dependabot from scanning test fixture manifests.
+  # These contain intentionally pinned (and sometimes vulnerable)
+  # dependencies used as test data for the dependency-analysis client.
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    exclude-paths:
+      - "src/test/**"
+    open-pull-requests-limit: 0
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    exclude-paths:
+      - "src/test/**"
+    open-pull-requests-limit: 0
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    exclude-paths:
+      - "src/test/**"
+    open-pull-requests-limit: 0
+  - package-ecosystem: "gradle"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    exclude-paths:
+      - "src/test/**"
+    open-pull-requests-limit: 0
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    exclude-paths:
+      - "src/test/**"
+    open-pull-requests-limit: 0