chore: exclude test fixture manifests from Dependabot

[ruromero]

Summary

• Add Dependabot ecosystem entries for npm, pip, gomod, gradle, and cargo with exclude-paths: ["src/test/**"] and open-pull-requests-limit: 0
• Prevents Dependabot from raising version update PRs for test fixture manifests in src/test/resources/tst_manifests/
• These manifests contain intentionally pinned (and sometimes vulnerable) dependencies used as test data for the dependency-analysis client

Note: exclude-paths only applies to Dependabot version updates. Security update PRs for test fixtures (e.g. #403, #404, #405, #407) must be closed manually and their alerts dismissed.

Test plan

• Verify dependabot.yml is valid YAML
• After merge, verify no new Dependabot version update PRs are created for src/test/ manifests
• Close existing test fixture security update PRs (build(deps): bump axios from 0.19.2 to 1.15.0 in /src/test/resources/tst_manifests/it/npm #403, build(deps): bump axios from 0.19.2 to 1.15.0 in /src/test/resources/tst_manifests/npm/deps_with_no_ignore #404, build(deps): bump axios from 0.19.0 to 1.15.0 in /src/test/resources/tst_manifests/yarn-classic/deps_with_mixed_dep_types #405, build(deps): bump axios from 0.19.2 to 1.15.0 in /src/test/resources/tst_manifests/npm/deps_with_ignore #407) and dismiss their alerts

🤖 Generated with Claude Code

[qodo-code-review]

Review Summary by Qodo

Add Dependabot exclusions for test fixture manifests

✨ Enhancement

Walkthroughs

Description

• Add Dependabot ecosystem entries for npm, pip, gomod, gradle, cargo
• Exclude test fixture manifests in src/test/** from version updates
• Set open-pull-requests-limit to 0 to prevent automatic PRs
• Test fixtures contain intentionally pinned vulnerable dependencies

Diagram

flowchart LR
  A["dependabot.yml"] -->|"Add npm, pip, gomod,<br/>gradle, cargo entries"| B["Exclude src/test/**"]
  B -->|"Set limit to 0"| C["Prevent test fixture<br/>version update PRs"]

Loading

File Changes

1. .github/dependabot.yml ⚙️ Configuration changes +38/-0

Configure Dependabot to exclude test fixture manifests

• Added Dependabot ecosystem entries for npm, pip, gomod, gradle, and cargo
• Configured exclude-paths to skip src/test/** directory for all new ecosystems
• Set open-pull-requests-limit to 0 to prevent automatic version update PRs
• Added explanatory comments about test fixture manifests containing intentionally pinned
 dependencies

.github/dependabot.yml

---

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1)   📘 Rule violations (0)   📎 Requirement gaps (0)

🐞\ ⚙ Maintainability (1)

1. Dependabot updates disabled 🐞 ⚙

Description

The new npm/pip/gomod/gradle/cargo entries set open-pull-requests-limit: 0, which prevents
Dependabot from opening any version-update PRs for those ecosystems across the repo (not just for
test fixtures). Combined with exclude-paths: ["src/test/**"], this likely means these entries won’t
manage the fixture manifests they’re intended to address and may silently block future updates if
non-test manifests are introduced later.

Code

.github/dependabot.yml[R16-50]

+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    exclude-paths:
+      - "src/test/**"
+    open-pull-requests-limit: 0
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    exclude-paths:
+      - "src/test/**"
+    open-pull-requests-limit: 0
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    exclude-paths:
+      - "src/test/**"
+    open-pull-requests-limit: 0
+  - package-ecosystem: "gradle"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    exclude-paths:
+      - "src/test/**"
+    open-pull-requests-limit: 0
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    exclude-paths:
+      - "src/test/**"
+    open-pull-requests-limit: 0

Evidence

The Dependabot config explicitly disables version-update PR creation for these ecosystems
(open-pull-requests-limit: 0) and excludes src/test/**, while representative manifests for these
ecosystems in the repo are located under src/test/resources/tst_manifests/... (which matches the
excluded path).

.github/dependabot.yml[16-50]
src/test/resources/tst_manifests/it/npm/package.json[1-16]
src/test/resources/tst_manifests/it/pypi/requirements.txt[1-3]
src/test/resources/tst_manifests/it/golang/go.mod[1-10]
src/test/resources/tst_manifests/it/gradle-groovy/build.gradle[1-17]
src/test/resources/tst_manifests/cargo/license/cargo_with_license/Cargo.toml[1-7]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
New Dependabot ecosystem entries (npm/pip/gomod/gradle/cargo) are configured with `open-pull-requests-limit: 0`, which disables *all* version-update PRs for those ecosystems across the repo, and they also exclude `src/test/**` where fixture manifests live. This can make the configuration ineffective for its stated goal and creates a future trap if real (non-test) manifests are added.

### Issue Context
Fixture manifests are under `src/test/resources/tst_manifests/...`, and the new entries exclude `src/test/**` while also setting `open-pull-requests-limit: 0`.

### Fix Focus Areas
- .github/dependabot.yml[16-50]

### Suggested remediation options
- If you only want to prevent *test fixture* version-update PRs, remove `open-pull-requests-limit: 0` and keep `exclude-paths`, so real manifests (if added outside `src/test/**`) can still get updates.
- If you truly want to disable version updates for these ecosystems repo-wide, keep `open-pull-requests-limit: 0` but add a short comment stating this is intentional and must be revisited if real manifests are added outside `src/test/**`.
- If these ecosystems are not used outside fixtures, consider removing these entries entirely to avoid inert configuration and re-add them only when/if real manifests are introduced.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

ⓘ The new review experience is currently in Beta. Learn more

[a-oren]

LGTM