fix: suppress dependabot for non-production ecosystems#498
Merged
ruromero merged 2 commits intoApr 29, 2026
Conversation
Add root-level `ignore: [{dependency-name: "*"}]` entries for all
ecosystems with no production dependencies (maven, pip, uv, gomod,
gradle, cargo).
Replace glob patterns with explicit directory listings for npm test
fixture entries, since `/**` globs don't reliably match nested
subdirectories for security updates.
Add test fixture guidance to CONVENTIONS.md.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Reviewer's GuideConfigures Dependabot so that non-production ecosystems (maven, pip, uv, gomod, gradle, cargo) are globally ignored, and replaces fragile glob-based npm test fixture suppression with explicit per-directory entries plus documentation in CONVENTIONS.md. Flow diagram for Dependabot update decision after configuration changesflowchart TD
A[Dependabot scans repository] --> B[Detect manifest file]
B --> C[Identify ecosystem]
C -->|maven or pip or uv or gomod or gradle or cargo| D[Apply root level ignore star]
D --> E[Suppress all updates]
C -->|npm| F[Check directory against explicit fixture list]
F -->|directory listed as fixture| G[Suppress all updates for this manifest]
F -->|directory not listed| H[Treat as production npm dependency]
H --> I[Allow security and version update PRs]
C -->|other ecosystems if any| J[Use default Dependabot behavior]
J --> I
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- The new "Test Fixtures" section in CONVENTIONS.md still describes npm fixtures as using
/**globs, but the Dependabot config now uses explicit directory listings; updating that description to match the new approach would avoid confusion for future changes. - The npm test fixture directory list in
.github/dependabot.ymlis now quite long and manual; consider grouping by common parent directories or adding a brief comment near each block to clarify which fixture tree it covers, to make it easier to maintain when new fixtures are added.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The new "Test Fixtures" section in CONVENTIONS.md still describes npm fixtures as using `/**` globs, but the Dependabot config now uses explicit directory listings; updating that description to match the new approach would avoid confusion for future changes.
- The npm test fixture directory list in `.github/dependabot.yml` is now quite long and manual; consider grouping by common parent directories or adding a brief comment near each block to clarify which fixture tree it covers, to make it easier to maintain when new fixtures are added.
## Individual Comments
### Comment 1
<location path=".github/dependabot.yml" line_range="36-43" />
<code_context>
+ - package-ecosystem: "npm"
</code_context>
<issue_to_address>
**issue (bug_risk):** The npm test-fixture block no longer ignores all dependencies, so Dependabot will create PRs for these directories.
The previous npm fixture config explicitly ignored all dependencies:
```yaml
ingore:
- dependency-name: "*"
```
In the new `npm` block this ignore section is missing, so Dependabot will now open update PRs (including security ones) for every `package.json` in these test-fixture directories, which conflicts with the header comment that fixtures must not be updated. To preserve the original behavior, please add:
```yaml
ignore:
- dependency-name: "*"
```
under this npm entry.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
This was referenced Apr 29, 2026
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Strum355
approved these changes
Apr 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ignore: [{dependency-name: "*"}]entries for all ecosystems with no production dependencies (maven, pip, uv, gomod, gradle, cargo)/**glob patterns with explicit directory listings for npm test fixture entries, since globs don't reliably match nested subdirectories for security updatesContext
Per-directory entries with
/**globs don't reliably suppress Dependabot security updates for nested subdirectories (e.g., workspace memberpackages/member-a). Root-levelignore: *reliably blocks both version and security updates for non-production ecosystems (proven in the Java client). For npm (production ecosystem), explicit directory listings replace unreliable globs.Test plan
🤖 Generated with Claude Code
Summary by Sourcery
Adjust Dependabot configuration to fully suppress updates for non-production ecosystems and test fixtures while preserving production npm updates, and document the conventions for managing these fixtures.
Build:
Documentation: