fix: add uv to root-level ignore and use explicit paths#448
Open
ruromero wants to merge 2 commits intoguacsec:mainfrom
Open
fix: add uv to root-level ignore and use explicit paths#448ruromero wants to merge 2 commits intoguacsec:mainfrom
ruromero wants to merge 2 commits intoguacsec:mainfrom
Conversation
Add root-level `ignore: [{dependency-name: "*"}]` for the uv
ecosystem, missed in PR guacsec#431. Remove redundant per-directory entries
for ecosystems covered by root-level ignore-all. Replace glob
patterns with explicit directory listings for maven test fixtures,
since `/**` globs don't reliably match nested subdirectories for
security updates.
Add test fixture guidance to CONVENTIONS.md.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
Reviewer's GuideUpdates Dependabot configuration to correctly ignore uv-based dependencies and refine test fixture handling, while adding project-wide coding and Dependabot conventions documentation. Flow diagram for Dependabot decision on updates vs ignored fixturesflowchart TD
A[Start: Dependabot scans repository] --> B[Select package ecosystem]
B --> C{Ecosystem is maven?}
C -->|No| D[Check root-level ignore-all for this ecosystem]
D --> E{ignore_all_configured?}
E -->|Yes| F[Skip all updates including security]
E -->|No| G[Proceed with normal dependabot behavior]
C -->|Yes| H[Locate pom.xml file path]
H --> I{Path matches explicit maven test fixture directory?}
I -->|Yes| J[Apply per-directory ignore-all]
J --> F[Skip all updates including security]
I -->|No| K[Treat as production maven dependency]
K --> G[Proceed with normal dependabot behavior]
G --> L[Create or update dependency PRs]
F --> M[End]
L --> M[End]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
This was referenced Apr 29, 2026
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 2 issues, and left some high level feedback:
- CONVENTIONS.md has two
## Test Fixturessections with slightly different guidance (one still mentioning/**globs) — consider consolidating into a single section that matches the new explicit-directory Maven configuration. - The root-level Dependabot entries now include
open-pull-requests-limit: 0only forcargo; consider either relying solely onignore: [{ dependency-name: "*" }]or applyingopen-pull-requests-limitconsistently across ecosystems for clarity. - In
.github/dependabot.yml, the sequence of root-level ecosystems (npm, pip, uv, gomod, gradle, cargo) is now somewhat shuffled; consider reordering them consistently (e.g., alphabetically) to make the config easier to scan and maintain.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- CONVENTIONS.md has two `## Test Fixtures` sections with slightly different guidance (one still mentioning `/**` globs) — consider consolidating into a single section that matches the new explicit-directory Maven configuration.
- The root-level Dependabot entries now include `open-pull-requests-limit: 0` only for `cargo`; consider either relying solely on `ignore: [{ dependency-name: "*" }]` or applying `open-pull-requests-limit` consistently across ecosystems for clarity.
- In `.github/dependabot.yml`, the sequence of root-level ecosystems (npm, pip, uv, gomod, gradle, cargo) is now somewhat shuffled; consider reordering them consistently (e.g., alphabetically) to make the config easier to scan and maintain.
## Individual Comments
### Comment 1
<location path=".github/dependabot.yml" line_range="37" />
<code_context>
ignore:
- dependency-name: "*"
- - package-ecosystem: "gomod"
+ - package-ecosystem: "uv"
directory: "/"
schedule:
</code_context>
<issue_to_address>
**issue (bug_risk):** Double-check that Dependabot supports the "uv" ecosystem key in this context.
Dependabot’s docs list ecosystems like `pip`, `npm`, and `gomod`, but not `uv`. Unless you have custom support wired up, this key may be ignored or cause config errors. For Python projects using `uv`, you may still need to use the supported Python ecosystem (e.g., `pip`) or otherwise verify that your environment explicitly supports `uv` here.
</issue_to_address>
### Comment 2
<location path="CONVENTIONS.md" line_range="3" />
<code_context>
+# Coding Conventions
+
+<!-- This file documents project-specific coding standards for exhort-java-api. -->
+
+## Language and Framework
</code_context>
<issue_to_address>
**suggestion (typo):** Project name in the top comment seems inconsistent with the rest of the document.
The HTML comment still names `exhort-java-api`, but the rest of the file uses `trustifyda`. Please update this reference for consistency.
```suggestion
<!-- This file documents project-specific coding standards for trustifyda. -->
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| ignore: | ||
| - dependency-name: "*" | ||
| - package-ecosystem: "gomod" | ||
| - package-ecosystem: "uv" |
Contributor
There was a problem hiding this comment.
issue (bug_risk): Double-check that Dependabot supports the "uv" ecosystem key in this context.
Dependabot’s docs list ecosystems like pip, npm, and gomod, but not uv. Unless you have custom support wired up, this key may be ignored or cause config errors. For Python projects using uv, you may still need to use the supported Python ecosystem (e.g., pip) or otherwise verify that your environment explicitly supports uv here.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
a-oren
requested changes
Apr 30, 2026
Comment on lines
+84
to
+86
| ## Test Fixtures | ||
|
|
||
| - **Dependabot suppression**: Test fixture directories contain intentionally pinned (sometimes vulnerable) dependencies. When adding a new test fixture directory with a manifest file, review `.github/dependabot.yml` to ensure the new path is covered. Non-maven ecosystems are suppressed via root-level `ignore: [{dependency-name: "*"}]` entries. Maven fixtures use per-directory entries with `/**` globs since maven is the production ecosystem; add the parent directory if a new maven fixture tree is introduced. |
Contributor
There was a problem hiding this comment.
Duplicate "Test Fixtures" section, this one should be removed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ignore: [{dependency-name: "*"}]for the uv ecosystem (missed in PR ci: fix dependabot exclusions for non-production ecosystems #431)/**glob patterns with explicit directory listings for maven test fixturesContext
PR #431 added root-level ignore-all for npm, pip, gomod, gradle, cargo but missed
uv, causing Dependabot to create security PRs for pyproject.toml files in test fixtures (#439, #440, #441). Glob patterns are replaced with explicit paths since/**doesn't reliably match nested subdirectories for security updates.Test plan
🤖 Generated with Claude Code
Summary by Sourcery
Update Dependabot configuration to correctly suppress updates for test fixtures while preserving production maven updates, and document project coding and Dependabot conventions.
Bug Fixes:
Enhancements:
CI:
Documentation: