ci(dependabot): ignore torch/transformers for diffusers to fix Jetson-index auth failure (#10913)

The weekly "Dependabot Updates" pip job for /backend/python/diffusers has been
failing with `private_source_authentication_failure` against the Jetson pip
index (https://pypi.jetson-ai-lab.io/jp6/cu129/), referenced by that backend's
requirements-l4t12.txt. diffusers is the only dependabot-configured pip
directory that pulls from that private index, so it is the only update job that
fails; the other backends update cleanly.

torch and transformers are deliberately pinned in this backend for
reproducibility (see backend/python/diffusers/requirements-*.txt and #9979), so
we do not want dependabot bumping them anyway. Ignoring both dependencies for
this directory stops dependabot from resolving them against the unreachable
Jetson index and keeps the weekly update job green, without removing update
coverage for the rest of the backend's dependencies.


Assisted-by: Claude:opus-4.8 [Claude Code]

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Co-authored-by: Ettore Di Giacinto <mudler@localai.io>

Author: localai-org-maint-bot

.github/dependabot.yml

@@ -45,6 +45,16 @@ updates:
     directory: "/backend/python/diffusers"
     schedule:
       interval: "weekly"
+    # torch and transformers are deliberately pinned in this backend (see
+    # backend/python/diffusers/requirements-*.txt and issue #9979), and the
+    # l4t12 variant resolves them from the Jetson pip index
+    # (https://pypi.jetson-ai-lab.io/jp6/cu129/). dependabot cannot authenticate
+    # against that index and fails the whole weekly update with a
+    # private_source_authentication_failure. Ignore the two pinned deps we don't
+    # want bumped anyway so the job stays green.
+    ignore:
+    - dependency-name: "torch"
+    - dependency-name: "transformers"
   - package-ecosystem: "pip"
     directory: "/backend/python/exllama"
     schedule: