Skip to content

fix: suppress dependabot for non-production ecosystems #498

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ruromero merged 2 commits into from
Apr 29, 2026
Merged

fix: suppress dependabot for non-production ecosystems #498

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b574984
fix: suppress dependabot for non-production ecosystems
ruromero Apr 29, 2026
eb93cda
fix: correct project name in CONVENTIONS.md
ruromero Apr 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
88 changes: 59 additions & 29 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,70 +30,100 @@ updates:
patterns:
- "*"

# ── Test fixture manifests (suppress all updates including security) ─
# These directories contain intentionally pinned dependencies used as
# test fixtures. They must NOT be updated by dependabot.
- package-ecosystem: "npm"
directories:
- "/test/providers/tst_manifests/npm/**"
- "/test/providers/tst_manifests/pnpm/**"
- "/test/providers/tst_manifests/yarn-berry/**"
- "/test/providers/tst_manifests/yarn-classic/**"
- "/test/providers/tst_manifests/js-common/**"
- "/test/providers/provider_manifests/npm/**"
- "/test/providers/provider_manifests/pnpm/**"
- "/test/providers/provider_manifests/yarn-berry/**"
- "/test/providers/provider_manifests/yarn-classic/**"
# ── Non-production ecosystems (no real deps, suppress everything) ────
# The repo has no production maven/pip/go/gradle/cargo dependencies.
# A root-level ignore-all entry ensures security updates are also
# suppressed, since per-directory entries with globs don't reliably
# block them.
- package-ecosystem: "maven"
directory: "/"
schedule:
interval: "monthly"
open-pull-requests-limit: 0
labels: []
Comment thread
ruromero marked this conversation as resolved.
ignore:
- dependency-name: "*"
- package-ecosystem: "pip"
directories:
- "/test/providers/tst_manifests/pip/**"
- "/test/providers/tst_manifests/pyproject/**"
directory: "/"
schedule:
interval: "monthly"
open-pull-requests-limit: 0
labels: []
ignore:
- dependency-name: "*"
- package-ecosystem: "uv"
directories:
- "/test/providers/tst_manifests/pyproject/**"
directory: "/"
schedule:
interval: "monthly"
open-pull-requests-limit: 0
labels: []
ignore:
- dependency-name: "*"
- package-ecosystem: "maven"
directories:
- "/test/providers/tst_manifests/maven/**"
- package-ecosystem: "gomod"
directory: "/"
schedule:
interval: "monthly"
open-pull-requests-limit: 0
labels: []
ignore:
- dependency-name: "*"
- package-ecosystem: "gradle"
directories:
- "/test/providers/tst_manifests/gradle/**"
directory: "/"
schedule:
interval: "monthly"
open-pull-requests-limit: 0
labels: []
ignore:
- dependency-name: "*"
- package-ecosystem: "cargo"
directories:
- "/test/providers/tst_manifests/cargo/**"
- "/test/providers/provider_manifests/cargo/**"
directory: "/"
schedule:
interval: "monthly"
open-pull-requests-limit: 0
labels: []
ignore:
- dependency-name: "*"
- package-ecosystem: "gomod"

# ── Test fixture manifests (npm only) ───────────────────────────────
# npm is the production ecosystem so it cannot use a root-level
# ignore-all. Glob patterns (/**) don't reliably match nested
# subdirectories for security updates, so every directory containing
# a package.json is listed explicitly. Update this list when adding
# new test fixtures.
- package-ecosystem: "npm"
directories:
- "/test/providers/tst_manifests/golang/**"
- "/test/providers/provider_manifests/npm/with_lock_file"
- "/test/providers/provider_manifests/npm/without_lock_file"
- "/test/providers/provider_manifests/npm/workspace_member_with_lock"
- "/test/providers/provider_manifests/npm/workspace_member_with_lock/packages/module-a"
- "/test/providers/provider_manifests/npm/workspace_member_without_lock"
- "/test/providers/provider_manifests/npm/workspace_member_without_lock/packages/module-a"
- "/test/providers/provider_manifests/pnpm/with_lock_file"
- "/test/providers/provider_manifests/pnpm/without_lock_file"
- "/test/providers/provider_manifests/pnpm/workspace_member_without_lock"
- "/test/providers/provider_manifests/pnpm/workspace_member_without_lock/packages/module-a"
- "/test/providers/provider_manifests/yarn-berry/with_lock_file"
- "/test/providers/provider_manifests/yarn-berry/without_lock_file"
- "/test/providers/provider_manifests/yarn-classic/with_lock_file"
- "/test/providers/provider_manifests/yarn-classic/without_lock_file"
- "/test/providers/tst_manifests/npm/package_json_deps_with_exhortignore_object"
- "/test/providers/tst_manifests/npm/package_json_deps_with_mixed_dep_types"
- "/test/providers/tst_manifests/npm/package_json_deps_without_exhortignore_object"
- "/test/providers/tst_manifests/npm/workspace_member"
- "/test/providers/tst_manifests/npm/workspace_member/packages/member-a"
- "/test/providers/tst_manifests/pnpm/package_json_deps_with_exhortignore_object"
- "/test/providers/tst_manifests/pnpm/package_json_deps_with_mixed_dep_types"
- "/test/providers/tst_manifests/pnpm/package_json_deps_without_exhortignore_object"
- "/test/providers/tst_manifests/pnpm/workspace_member"
- "/test/providers/tst_manifests/pnpm/workspace_member/packages/member-a"
- "/test/providers/tst_manifests/yarn-berry/package_json_deps_with_exhortignore_object"
- "/test/providers/tst_manifests/yarn-berry/package_json_deps_with_mixed_dep_types"
- "/test/providers/tst_manifests/yarn-berry/package_json_deps_without_exhortignore_object"
- "/test/providers/tst_manifests/yarn-berry/workspace_member"
- "/test/providers/tst_manifests/yarn-berry/workspace_member/packages/member-a"
- "/test/providers/tst_manifests/yarn-classic/package_json_deps_with_exhortignore_object"
- "/test/providers/tst_manifests/yarn-classic/package_json_deps_with_mixed_dep_types"
- "/test/providers/tst_manifests/yarn-classic/package_json_deps_without_exhortignore_object"
schedule:
interval: "monthly"
labels: []
Expand Down
6 changes: 5 additions & 1 deletion CONVENTIONS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Coding Conventions

<!-- This file documents project-specific coding standards for exhort-javascript-api. -->
<!-- This file documents project-specific coding standards for trustify-da-javascript-client. -->

## Language and Framework

Expand Down Expand Up @@ -90,6 +90,10 @@ test/
- DCO (Developer Certificate of Origin) required
- Semantic versioning (`0.3.0` in package.json)

## Test Fixtures

- **Dependabot suppression**: Test fixture directories contain intentionally pinned (sometimes vulnerable) dependencies. When adding a new test fixture directory with a manifest file, review `.github/dependabot.yml` to ensure the new path is covered. Non-npm ecosystems are suppressed via root-level `ignore: [{dependency-name: "*"}]` entries. npm fixtures use per-directory entries with `/**` globs; add the parent directory if a new npm/pnpm/yarn fixture tree is introduced.

## Dependencies

- **Package manager**: npm with `package-lock.json`
Expand Down
Loading